Add code to setup permissions properly

Based on roles and by default closing everything. No need to tweak
things outside of the extension.

client/sql/0.0.1/90_permissions.sql

@@ -0,0 +1,15 @@
+-- Make sure by default there are no permissions for publicuser
+-- NOTE: this happens at extension creation time, as part of an implicit transaction.
+REVOKE ALL PRIVILEGES ON SCHEMA cdb_geocoder_client FROM PUBLIC, publicuser CASCADE;
+
+-- Grant permissions on the schema to publicuser (but just the schema)
+GRANT USAGE ON SCHEMA cdb_geocoder_client TO publicuser;
+
+-- Revoke execute permissions on all functions in the schema by default
+REVOKE EXECUTE ON ALL FUNCTIONS IN SCHEMA cdb_geocoder_client FROM PUBLIC, publicuser;
+
+--------------------------------------------------------------------------------
+
+-- Explicitly grant permissions to public functions
+-- NOTE: All public functions must be listed below, grating permissions to publicuser
+GRANT EXECUTE ON FUNCTION cdb_geocoder_client.geocode_admin0_polygons(country_name text) TO publicuser;

client/sql/00_installation_test.sql

@@ -10,3 +10,8 @@ SELECT cdb_geocoder_client._config_set('db_server_config', '{"connection_str": "
 
 -- Mock the server schema
 CREATE SCHEMA cdb_geocoder_server;
+
+-- Create a test user to check permissions
+DROP ROLE IF EXISTS test_regular_user;
+CREATE ROLE test_regular_user;
+GRANT publicuser TO test_regular_user;

client/sql/90_permissions_test.sql

@@ -0,0 +1,12 @@
+-- Use regular user role
+SET ROLE test_regular_user;
+
+-- Exercise the public function
+-- it is public, it shall work
+SELECT cdb_geocoder_client.geocode_admin0_polygons('Spain');
+
+-- Check the regular user has no permissions on private functions
+SELECT cdb_geocoder_client._geocode_admin0_polygons('evil_user', 666, 'Hell');
+
+-- Check the regular user cannot look into config table
+SELECT * from cdb_geocoder_client._config;