Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RowLevelSecurity Policy Table access could be handled more cleverly #161

Open
RogerTangos opened this issue Jun 7, 2016 · 0 comments
Open

Comments

@RogerTangos
Copy link
Contributor

Access to the RowLevelSecurity policy table (defined in settings.py) is managed by the RowLevelSecurity table. For ever user, signals.py and rlsmanager.py write three entries the RLS Policy Table. These allow them to select, update, and insert rows where they are the grantor.

Migration 0017_security_policy_table.py and create_security_policy_table.py handle this for existing users.

A much more elegant way to implement this is to delete the add_existing_users_to_security_policy_table method in create_security_policy_table.py, remove add_user_to_policy_table in signals.py the method in signals.py, and had the migration insert these three lines into the RLS Policy Table.

insert into dh_public.policy (policy, policy_type, grantee, repo_base, repo, table_name) 
    values('grantor=current_user', 'select', 'all', 'postgres', 'policy', 'dh_public', 'dh_public')
​
insert into dh_public.policy (policy, policy_type, grantee, repo_base, repo, table_name) 
    values('grantor=current_user', 'insert', 'all', 'postgres', 'policy', 'dh_public', 'dh_public')
​
insert into dh_public.policy (policy, policy_type, grantee, repo_base, repo, table_name) 
    values('grantor=current_user', 'update', 'all', 'postgres', 'policy', 'dh_public', 'dh_public')

This is a good and small ticket for someone wanting to learn a bit about Django migrations operations and Row Level Security.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant