You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Summary
If a user referenced an object multiple times in a spec (e.g. schema ownership) then pgbedrock will just make the change at each spot (e.g. change ownership to role1 and then later change ownership to role2). While this isn't strictly wrong, it makes it too easy to make a mistake. Before running any of our analyzers we should verify that no object appears multiple times in the following cases:
schema is not under owns for multiple roles or is in the has_personal_schema for a role and in the owns for another role
verify that a role isn't defined multiple times
within one role, no object occurs in both the read and write sections. This isn't really wrong since pgbedrock grants read as well if you desire write, but it'd be good to clarify this behavior to users by ensuring they can only put things in the expected way; if they could put things in write and either put things in read or not then they may assume that that means that read can not occur when write is granted.
I don't think there are any other areas at present where an object occurring multiple times would cause unexpected behavior, though it'd be worth doing a bit more deliberating on this to see if I've missed anything.
Key Actions
In the spec_inspector.py referenced in the Provide multi-database support issue verify that each schema only shows up in one owns or has_personal_schema spot and never more than one spot.
In that same spec_inspector.py, verify that no object occurs in both the read and write sections.
Run the above verification before any submodule's analyzer functionality happens
Make sure there aren't other areas where duplicate object references could cause unexpected behavior. If table and sequence ownership has been provided (via the Support table and sequence ownership issue), then those would definitely be something we'd want to verify have no duplicates as well.
The text was updated successfully, but these errors were encountered:
Summary
If a user referenced an object multiple times in a spec (e.g. schema ownership) then pgbedrock will just make the change at each spot (e.g. change ownership to role1 and then later change ownership to role2). While this isn't strictly wrong, it makes it too easy to make a mistake. Before running any of our analyzers we should verify that no object appears multiple times in the following cases:
owns
for multiple roles or is in the has_personal_schema for a role and in theowns
for another roleread
andwrite
sections. This isn't really wrong since pgbedrock grantsread
as well if you desirewrite
, but it'd be good to clarify this behavior to users by ensuring they can only put things in the expected way; if they could put things inwrite
and either put things inread
or not then they may assume that that means thatread
can not occur whenwrite
is granted.I don't think there are any other areas at present where an object occurring multiple times would cause unexpected behavior, though it'd be worth doing a bit more deliberating on this to see if I've missed anything.
Key Actions
spec_inspector.py
referenced in the Provide multi-database support issue verify that each schema only shows up in oneowns
or has_personal_schema spot and never more than one spot.spec_inspector.py
, verify that no object occurs in both theread
andwrite
sections.The text was updated successfully, but these errors were encountered: