Class: Omen::Refusal

Inherits:

Object

Object
Omen::Refusal

show all

Defined in:: app/models/omen/refusal.rb

Overview

What a Postgres role may not read: the tables it holds no SELECT on, and the columns of the rest that a column-level grant left out. Each is asked of a role the database has to have, so a name it does not know refuses nothing here -- the statement is what says the app is misconfigured, in the one message that case is owed.

Constant Summary collapse

COLUMNS = Every column of the app the role is refused. Asked of the column rather than of the table, since a grant naming columns leaves the table itself ungranted and every one of these true.

<<~SQL
  SELECT c.relname, a.attname FROM pg_roles r, pg_class c
    JOIN pg_namespace n ON n.oid = c.relnamespace
    JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped
   WHERE r.rolname = ? AND n.nspname = 'public' AND c.relkind = 'r'
     AND NOT has_column_privilege(r.oid, c.oid, a.attnum, 'SELECT')
SQL

TABLES = Every table of it none of whose columns the role may read, this gem's own included.

<<~SQL
  SELECT c.relname FROM pg_roles r, pg_class c
    JOIN pg_namespace n ON n.oid = c.relnamespace
   WHERE r.rolname = ? AND n.nspname = 'public' AND c.relkind = 'r'
     AND NOT EXISTS (SELECT 1 FROM pg_attribute a
                      WHERE a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped
                        AND has_column_privilege(r.oid, c.oid, a.attnum, 'SELECT'))
SQL

Instance Method Summary collapse

#columns ⇒ Array<Array<String>>
The table and column of each one it may not read.
#initialize(role) ⇒ Refusal constructor
A new instance of Refusal.
#tables ⇒ Array<String>
The tables it may not read.

Constructor Details

#initialize(role) ⇒ `Refusal`

Returns a new instance of Refusal.

Parameters:

role (String) —
the Postgres role a statement will run as.



27
28
29

# File 'app/models/omen/refusal.rb', line 27

def initialize(role)
  @role = role
end

Instance Method Details

#columns ⇒ `Array<Array<String>>`

Returns the table and column of each one it may not read.

Returns:

(Array<Array<String>>) —
the table and column of each one it may not read.

35	# File 'app/models/omen/refusal.rb', line 35 def columns = asked COLUMNS

#tables ⇒ `Array<String>`

Returns the tables it may not read.