From 7f9a74811950d1849e3d8a5e015b2333aaaa2ea0 Mon Sep 17 00:00:00 2001 From: Raul Marin Date: Thu, 24 Oct 2019 11:33:07 +0200 Subject: [PATCH] Make CDB_OAuth independent of the PG version --- Makefile | 6 +-- test/CDB_OAuth.sql | 48 +++++++++++++------- test/CDB_OAuth_expect | 30 ++++++------- test/CDB_OAuth_expect.pg11 | 90 -------------------------------------- test/CDB_OAuth_expect.pg12 | 90 -------------------------------------- 5 files changed, 49 insertions(+), 215 deletions(-) delete mode 100644 test/CDB_OAuth_expect.pg11 delete mode 100644 test/CDB_OAuth_expect.pg12 diff --git a/Makefile b/Makefile index 6660b46..db588aa 100644 --- a/Makefile +++ b/Makefile @@ -182,11 +182,7 @@ legacy_regress: $(REGRESS_OLD) Makefile $(SED) -e 's/@@VERSION@@/$(EXTVERSION)/' -e 's/@extschema@/cartodb/g' -e "s/@postgisschema@/public/g" >> $${of}; \ exp=expected/test/$${tn}.out; \ echo '\set ECHO none' > $${exp}; \ - if [[ -f "test/$${tn}_expect.pg$(PG_VERSION)" ]]; then \ - cat test/$${tn}_expect.pg$(PG_VERSION) >> $${exp}; \ - else \ - cat test/$${tn}_expect >> $${exp}; \ - fi \ + cat test/$${tn}_expect >> $${exp}; \ done test_organization: diff --git a/test/CDB_OAuth.sql b/test/CDB_OAuth.sql index c3c14e6..3a32b3b 100644 --- a/test/CDB_OAuth.sql +++ b/test/CDB_OAuth.sql @@ -1,6 +1,23 @@ -- Create user and enable OAuth event trigger \set QUIET on SET client_min_messages TO error; + +-- The permission error changed between pre PG11 and post 11 (before everythin "relation", now it's "view", "table" and so on +CREATE OR REPLACE FUNCTION catch_permission_error(query text) +RETURNS bool +AS $$ +BEGIN + EXECUTE query; + RETURN FALSE; +EXCEPTION + WHEN insufficient_privilege THEN + RETURN TRUE; + WHEN OTHERS THEN + RAISE WARNING 'Exception %', sqlstate; + RETURN FALSE; +END +$$ LANGUAGE 'plpgsql'; + DROP ROLE IF EXISTS "creator_role"; CREATE ROLE "creator_role" LOGIN; DROP ROLE IF EXISTS "ownership_role"; @@ -30,11 +47,11 @@ SELECT * FROM test_selectinto; SET SESSION AUTHORIZATION "ownership_role"; \set QUIET off -SELECT * FROM test; -SELECT * FROM test_tablesas; -SELECT * FROM test_view; -SELECT * FROM test_mview; -SELECT * FROM test_selectinto; +SELECT 'denied_table', catch_permission_error($$SELECT * FROM test;$$); +SELECT 'denied_tableas', catch_permission_error($$SELECT * FROM test_tablesas;$$); +SELECT 'denied_view', catch_permission_error($$SELECT * FROM test_view;$$); +SELECT 'denied_mview', catch_permission_error($$SELECT * FROM test_mview;$$); +SELECT 'denied_selectinto', catch_permission_error($$SELECT * FROM test_selectinto;$$); \set QUIET on SET SESSION AUTHORIZATION "creator_role"; @@ -71,11 +88,11 @@ SELECT * FROM test2_selectinto; SET SESSION AUTHORIZATION "ownership_role"; \set QUIET off -SELECT * FROM test2; -SELECT * FROM test2_tablesas; -SELECT * FROM test2_view; -SELECT * FROM test2_mview; -SELECT * FROM test2_selectinto; +SELECT 'denied_table2', catch_permission_error($$SELECT * FROM test2;$$); +SELECT 'denied_tableas2', catch_permission_error($$SELECT * FROM test2_tablesas;$$); +SELECT 'denied_view2', catch_permission_error($$SELECT * FROM test2_view;$$); +SELECT 'denied_mview2', catch_permission_error($$SELECT * FROM test2_mview;$$); +SELECT 'denied_selectinto2', catch_permission_error($$SELECT * FROM test2_selectinto;$$); \set QUIET on SET SESSION AUTHORIZATION "creator_role"; @@ -112,11 +129,11 @@ SELECT * FROM test3_selectinto; SET SESSION AUTHORIZATION "ownership_role"; \set QUIET off -SELECT * FROM test3; -SELECT * FROM test3_tablesas; -SELECT * FROM test3_view; -SELECT * FROM test3_mview; -SELECT * FROM test3_selectinto; +SELECT 'denied_table3', catch_permission_error($$SELECT * FROM test3;$$); +SELECT 'denied_tableas3', catch_permission_error($$SELECT * FROM test3_tablesas;$$); +SELECT 'denied_view3', catch_permission_error($$SELECT * FROM test3_view;$$); +SELECT 'denied_mview3', catch_permission_error($$SELECT * FROM test3_mview;$$); +SELECT 'denied_selectinto3', catch_permission_error($$SELECT * FROM test3_selectinto;$$); \set QUIET on SET SESSION AUTHORIZATION "creator_role"; @@ -174,4 +191,5 @@ DROP ROLE "ownership_role"; REVOKE ALL ON SCHEMA cartodb FROM "creator_role"; DROP ROLE "creator_role"; DELETE FROM cdb_conf WHERE key = 'api_keys_creator_role'; +DROP FUNCTION catch_permission_error(text); \set QUIET off diff --git a/test/CDB_OAuth_expect b/test/CDB_OAuth_expect index f536c43..1a334c0 100644 --- a/test/CDB_OAuth_expect +++ b/test/CDB_OAuth_expect @@ -10,11 +10,11 @@ SELECT 1 1 1 1 -ERROR: permission denied for relation test -ERROR: permission denied for relation test_tablesas -ERROR: permission denied for relation test_view -ERROR: permission denied for relation test_mview -ERROR: permission denied for relation test_selectinto +denied_table|t +denied_tableas|t +denied_view|t +denied_mview|t +denied_selectinto|t DROP TABLE DROP VIEW DROP MATERIALIZED VIEW @@ -33,11 +33,11 @@ SELECT 1 1 1 1 -ERROR: permission denied for relation test2 -ERROR: permission denied for relation test2_tablesas -ERROR: permission denied for relation test2_view -ERROR: permission denied for relation test2_mview -ERROR: permission denied for relation test2_selectinto +denied_table2|t +denied_tableas2|t +denied_view2|t +denied_mview2|t +denied_selectinto2|t DROP TABLE DROP VIEW DROP MATERIALIZED VIEW @@ -55,11 +55,11 @@ SELECT 1 1 1 1 -ERROR: permission denied for relation test3 -ERROR: permission denied for relation test3_tablesas -ERROR: permission denied for relation test3_view -ERROR: permission denied for relation test3_mview -ERROR: permission denied for relation test3_selectinto +denied_table3|t +denied_tableas3|t +denied_view3|t +denied_mview3|t +denied_selectinto3|t DROP TABLE DROP VIEW DROP MATERIALIZED VIEW diff --git a/test/CDB_OAuth_expect.pg11 b/test/CDB_OAuth_expect.pg11 deleted file mode 100644 index 73767d2..0000000 --- a/test/CDB_OAuth_expect.pg11 +++ /dev/null @@ -1,90 +0,0 @@ - -CREATE TABLE -INSERT 0 1 -SELECT 1 -CREATE VIEW -SELECT 1 -SELECT 1 -1 -1 -1 -1 -1 -ERROR: permission denied for table test -ERROR: permission denied for table test_tablesas -ERROR: permission denied for view test_view -ERROR: permission denied for materialized view test_mview -ERROR: permission denied for table test_selectinto -DROP TABLE -DROP VIEW -DROP MATERIALIZED VIEW -DROP TABLE -DROP TABLE -NOTICE: event trigger "oauth_reassign_tables_trigger" does not exist, skipping - -CREATE TABLE -INSERT 0 1 -SELECT 1 -CREATE VIEW -SELECT 1 -SELECT 1 -1 -1 -1 -1 -1 -ERROR: permission denied for table test2 -ERROR: permission denied for table test2_tablesas -ERROR: permission denied for view test2_view -ERROR: permission denied for materialized view test2_mview -ERROR: permission denied for table test2_selectinto -DROP TABLE -DROP VIEW -DROP MATERIALIZED VIEW -DROP TABLE -DROP TABLE - -CREATE TABLE -INSERT 0 1 -SELECT 1 -CREATE VIEW -SELECT 1 -SELECT 1 -1 -1 -1 -1 -1 -ERROR: permission denied for table test3 -ERROR: permission denied for table test3_tablesas -ERROR: permission denied for view test3_view -ERROR: permission denied for materialized view test3_mview -ERROR: permission denied for table test3_selectinto -DROP TABLE -DROP VIEW -DROP MATERIALIZED VIEW -DROP TABLE -DROP TABLE - -CREATE TABLE -INSERT 0 1 -SELECT 1 -CREATE VIEW -SELECT 1 -SELECT 1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -DROP TABLE -DROP VIEW -DROP MATERIALIZED VIEW -DROP TABLE -DROP TABLE - diff --git a/test/CDB_OAuth_expect.pg12 b/test/CDB_OAuth_expect.pg12 deleted file mode 100644 index 73767d2..0000000 --- a/test/CDB_OAuth_expect.pg12 +++ /dev/null @@ -1,90 +0,0 @@ - -CREATE TABLE -INSERT 0 1 -SELECT 1 -CREATE VIEW -SELECT 1 -SELECT 1 -1 -1 -1 -1 -1 -ERROR: permission denied for table test -ERROR: permission denied for table test_tablesas -ERROR: permission denied for view test_view -ERROR: permission denied for materialized view test_mview -ERROR: permission denied for table test_selectinto -DROP TABLE -DROP VIEW -DROP MATERIALIZED VIEW -DROP TABLE -DROP TABLE -NOTICE: event trigger "oauth_reassign_tables_trigger" does not exist, skipping - -CREATE TABLE -INSERT 0 1 -SELECT 1 -CREATE VIEW -SELECT 1 -SELECT 1 -1 -1 -1 -1 -1 -ERROR: permission denied for table test2 -ERROR: permission denied for table test2_tablesas -ERROR: permission denied for view test2_view -ERROR: permission denied for materialized view test2_mview -ERROR: permission denied for table test2_selectinto -DROP TABLE -DROP VIEW -DROP MATERIALIZED VIEW -DROP TABLE -DROP TABLE - -CREATE TABLE -INSERT 0 1 -SELECT 1 -CREATE VIEW -SELECT 1 -SELECT 1 -1 -1 -1 -1 -1 -ERROR: permission denied for table test3 -ERROR: permission denied for table test3_tablesas -ERROR: permission denied for view test3_view -ERROR: permission denied for materialized view test3_mview -ERROR: permission denied for table test3_selectinto -DROP TABLE -DROP VIEW -DROP MATERIALIZED VIEW -DROP TABLE -DROP TABLE - -CREATE TABLE -INSERT 0 1 -SELECT 1 -CREATE VIEW -SELECT 1 -SELECT 1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -DROP TABLE -DROP VIEW -DROP MATERIALIZED VIEW -DROP TABLE -DROP TABLE -