mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-22 10:32:40 +08:00
79 lines
3.1 KiB
TypeScript
79 lines
3.1 KiB
TypeScript
import { CAPABILITIES_V52 } from './pg-0053-plugin-package-workflow-run-list-index';
|
|
import { definePostgresSqlMigration } from './sqlMigration';
|
|
|
|
export const CAPABILITIES_V53 = CAPABILITIES_V52.replace(
|
|
'"approved_action":1,',
|
|
'"approval_management_boundary":1,"approved_action":1,',
|
|
);
|
|
|
|
export const pg0054ApprovalManagementBoundaryMigration =
|
|
definePostgresSqlMigration({
|
|
id: 'pg-0054-approval-management-boundary',
|
|
statements: [
|
|
`
|
|
DO $ql3$
|
|
DECLARE
|
|
role_invalid boolean;
|
|
BEGIN
|
|
SELECT roles.rolname IS NULL
|
|
OR roles.rolcanlogin IS NOT TRUE
|
|
OR roles.rolsuper IS NOT FALSE
|
|
OR roles.rolcreatedb IS NOT FALSE
|
|
OR roles.rolcreaterole IS NOT FALSE
|
|
OR roles.rolreplication IS NOT FALSE
|
|
OR roles.rolbypassrls IS NOT FALSE
|
|
INTO role_invalid
|
|
FROM (SELECT 1) AS expected
|
|
LEFT JOIN pg_catalog.pg_roles AS roles
|
|
ON roles.rolname = 'ql3_approval_manager';
|
|
|
|
IF role_invalid IS NOT FALSE THEN
|
|
RAISE EXCEPTION
|
|
'required QingLong approval manager role is missing or privileged'
|
|
USING ERRCODE = 'insufficient_privilege';
|
|
END IF;
|
|
END
|
|
$ql3$
|
|
`.trim(),
|
|
`
|
|
DO $ql3$
|
|
BEGIN
|
|
EXECUTE format(
|
|
'GRANT CONNECT ON DATABASE %I TO ql3_approval_manager',
|
|
current_database()
|
|
);
|
|
END
|
|
$ql3$
|
|
`.trim(),
|
|
`GRANT USAGE ON SCHEMA "ql3" TO ql3_approval_manager`,
|
|
`REVOKE ALL ON ALL TABLES IN SCHEMA "ql3" FROM ql3_approval_manager`,
|
|
`REVOKE ALL ON ALL FUNCTIONS IN SCHEMA "ql3" FROM ql3_approval_manager`,
|
|
`GRANT SELECT ON "ql3"."schema_migrations", "ql3"."schema_capabilities", "ql3"."projects", "ql3"."project_role_bindings", "ql3"."tool_invocation_preview_artifacts" TO ql3_approval_manager`,
|
|
`GRANT SELECT, INSERT ON "ql3"."security_audit_events" TO ql3_approval_manager`,
|
|
`GRANT SELECT, UPDATE ON "ql3"."approval_requests" TO ql3_approval_manager`,
|
|
`GRANT SELECT, INSERT, UPDATE ON "ql3"."plugin_package_identity_keyset_ledger" TO ql3_approval_manager`,
|
|
`GRANT EXECUTE ON FUNCTION "ql3"."lock_approval_policy_fence"(varchar, varchar, varchar, integer, integer) TO ql3_approval_manager`,
|
|
`ALTER TABLE "ql3"."plugin_package_identity_keyset_ledger" DROP CONSTRAINT ql3_plugin_package_identity_keyset_authority_check`,
|
|
`ALTER TABLE "ql3"."plugin_package_identity_keyset_ledger" ADD CONSTRAINT ql3_plugin_package_identity_keyset_authority_check CHECK (authority IN ('plugin-package-management', 'worker-credential-management', 'automation-management', 'approval-management'))`,
|
|
`
|
|
DO $ql3$
|
|
BEGIN
|
|
UPDATE "ql3"."schema_capabilities"
|
|
SET contract_version = 53,
|
|
migration_id = 'pg-0054-approval-management-boundary',
|
|
capabilities = '${CAPABILITIES_V53}'::jsonb,
|
|
updated_at_ms = floor(extract(epoch FROM transaction_timestamp()) * 1000)::bigint
|
|
WHERE contract_name = 'control-core'
|
|
AND contract_version = 52
|
|
AND migration_id = 'pg-0053-plugin-package-workflow-run-list-index'
|
|
AND capabilities = '${CAPABILITIES_V52}'::jsonb;
|
|
IF NOT FOUND THEN
|
|
RAISE EXCEPTION 'control-core capability is not at version 52'
|
|
USING ERRCODE = 'check_violation';
|
|
END IF;
|
|
END
|
|
$ql3$
|
|
`.trim(),
|
|
],
|
|
});
|