96 lines
2.2 KiB
PL/PgSQL
96 lines
2.2 KiB
PL/PgSQL
CREATE OR REPLACE FUNCTION public.current_profile_id()
|
|
RETURNS uuid
|
|
LANGUAGE sql
|
|
STABLE
|
|
AS $$
|
|
SELECT nullif(current_setting('request.jwt.claim.sub', true), '')::uuid;
|
|
$$;
|
|
|
|
CREATE OR REPLACE FUNCTION public.is_tenant_member(p_tenant_id uuid)
|
|
RETURNS boolean
|
|
LANGUAGE sql
|
|
STABLE
|
|
SECURITY DEFINER
|
|
SET search_path = public
|
|
AS $$
|
|
SELECT EXISTS (
|
|
SELECT 1
|
|
FROM public.memberships
|
|
WHERE tenant_id = p_tenant_id
|
|
AND profile_id = public.current_profile_id()
|
|
);
|
|
$$;
|
|
|
|
CREATE OR REPLACE FUNCTION public.has_tenant_role(p_tenant_id uuid, p_roles public.membership_role[])
|
|
RETURNS boolean
|
|
LANGUAGE sql
|
|
STABLE
|
|
SECURITY DEFINER
|
|
SET search_path = public
|
|
AS $$
|
|
SELECT EXISTS (
|
|
SELECT 1
|
|
FROM public.memberships
|
|
WHERE tenant_id = p_tenant_id
|
|
AND profile_id = public.current_profile_id()
|
|
AND role = ANY (p_roles)
|
|
);
|
|
$$;
|
|
|
|
ALTER TABLE public.tenants ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE public.memberships ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE public.projects ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE public.project_quotas ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE public.vms ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE public.ssh_keys ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE public.audit_log ENABLE ROW LEVEL SECURITY;
|
|
|
|
CREATE POLICY tenants_member_select
|
|
ON public.tenants
|
|
FOR SELECT
|
|
USING (public.is_tenant_member(id));
|
|
|
|
CREATE POLICY memberships_member_select
|
|
ON public.memberships
|
|
FOR SELECT
|
|
USING (public.is_tenant_member(tenant_id));
|
|
|
|
CREATE POLICY projects_member_select
|
|
ON public.projects
|
|
FOR SELECT
|
|
USING (public.is_tenant_member(tenant_id));
|
|
|
|
CREATE POLICY project_quotas_member_select
|
|
ON public.project_quotas
|
|
FOR SELECT
|
|
USING (
|
|
EXISTS (
|
|
SELECT 1
|
|
FROM public.projects
|
|
WHERE projects.id = project_quotas.project_id
|
|
AND public.is_tenant_member(projects.tenant_id)
|
|
)
|
|
);
|
|
|
|
CREATE POLICY vms_member_select
|
|
ON public.vms
|
|
FOR SELECT
|
|
USING (
|
|
EXISTS (
|
|
SELECT 1
|
|
FROM public.projects
|
|
WHERE projects.id = vms.project_id
|
|
AND public.is_tenant_member(projects.tenant_id)
|
|
)
|
|
);
|
|
|
|
CREATE POLICY ssh_keys_member_select
|
|
ON public.ssh_keys
|
|
FOR SELECT
|
|
USING (public.is_tenant_member(tenant_id));
|
|
|
|
CREATE POLICY audit_log_admin_select
|
|
ON public.audit_log
|
|
FOR SELECT
|
|
USING (public.has_tenant_role(tenant_id, ARRAY['owner', 'admin']::public.membership_role[]));
|