From 5744921065dde034a083f743c95a773d2352da33 Mon Sep 17 00:00:00 2001
From: Mario de Frutos Dieguez <mario@defrutos.org>
Date: Tue, 2 Jul 2019 18:20:26 +0200
Subject: [PATCH] OAuth functions

- Create/drop reassign event trigger and the function with the logic
- Function that reassings owner to ownership role if defined
---
 scripts-available/CDB_OAuth.sql | 53 +++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 scripts-available/CDB_OAuth.sql

diff --git a/scripts-available/CDB_OAuth.sql b/scripts-available/CDB_OAuth.sql
new file mode 100644
index 0000000..971bcf0
--- /dev/null
+++ b/scripts-available/CDB_OAuth.sql
@@ -0,0 +1,53 @@
+-- Function that reassign the owner of a table to their ownership_role
+CREATE OR REPLACE FUNCTION @extschema.CDB_OAuthReassignTableOwnerOnCreation()
+  RETURNS event_trigger
+  SECURITY DEFINER
+  AS $$
+DECLARE
+    obj record;
+    owner_role text;
+    creator_role text;
+BEGIN
+    FOR obj IN SELECT * FROM pg_event_trigger_ddl_commands()
+    LOOP
+      RAISE DEBUG '% ddl object: % % % %',
+                  tg_tag,
+                  obj.command_tag,
+                  obj.object_type,
+                  obj.schema_name,
+                  obj.object_identity;
+      SELECT rolname FROM pg_class JOIN pg_roles ON relowner = pg_roles.oid WHERE pg_class.oid = obj.objid INTO creator_role;
+      SELECT value->>'ownership_role_name' from cdb_conf where key = (SELECT 'api_keys_' || rolname FROM pg_class JOIN pg_roles ON relowner = pg_roles.oid WHERE pg_class.oid = obj.objid) INTO owner_role;
+      IF owner_role IS NULL THEN
+        CONTINUE;
+      ELSE
+        EXECUTE 'ALTER ' || obj.object_type || ' ' || obj.object_identity || ' OWNER TO ' || QUOTE_IDENT(owner_role);
+        EXECUTE 'GRANT ALL ON ' || obj.object_identity || ' TO ' || QUOTE_IDENT(creator_role);
+        RAISE DEBUG 'Changing ownership from % to %', creator_role, owner_role;
+      END IF;
+    END LOOP;
+END;
+$$ LANGUAGE plpgsql VOLATILE PARALLEL UNSAFE;
+
+-- Creates the trigger on DDL events in order to reassign the owner
+CREATE OR REPLACE FUNCTION @extschema@.CDB_EnableOAuthReassignTablesTrigger()
+RETURNS void
+AS $$
+  BEGIN
+    DROP EVENT TRIGGER IF EXISTS oauth_reassign_tables_trigger;
+
+    CREATE EVENT TRIGGER oauth_reassign_tables_trigger
+    ON ddl_command_end
+    WHEN TAG IN ('CREATE TABLE', 'CREATE TABLE AS', 'SELECT INTO', 'CREATE VIEW', 'CREATE FOREIGN TABLE', 'CREATE MATERIALIZED VIEW')
+    EXECUTE PROCEDURE @extschema@.CDB_OAuthReassignTableOwnerOnCreation();
+  END;
+$$ LANGUAGE plpgsql VOLATILE PARALLEL UNSAFE;
+
+-- Deletes the trigger on DDL events in order to reassign the owner
+CREATE OR REPLACE FUNCTION @extschema@.CDB_DisableOAuthReassignTablesTrigger()
+RETURNS void
+AS $$
+  BEGIN
+    DROP EVENT TRIGGER IF EXISTS oauth_reassign_tables_trigger;
+  END;
+$$ LANGUAGE plpgsql VOLATILE PARALLEL UNSAFE;