a87403338d
All checks were successful
Build and deploy / Validate source (push) Successful in 5s
Build and deploy / Integration suite on a real stack (push) Successful in 1m17s
Build and deploy / Secret scan and release gate (push) Successful in 5s
Build and deploy / Publish images and notify Portainer (push) Successful in 1m37s
One OPERATOR_EMAIL and OPERATOR_PASSWORD served the whole factory, so every card movement recorded the same name and the movement history could not answer who did what. Traceability was one of the things the project set out to provide. Accounts live in dtf_local.operators, authenticated with the same scrypt hashing as customer accounts and with comparable work whether or not the account exists, so absence is not observable by timing. Administration is a CLI in the API container, like the schema migration: list, add, password, disable, enable. Passwords are read from the terminal rather than an argument so they stay out of shell history and the process list, and disabling deletes that operator's open sessions instead of leaving them valid for the rest of the eight-hour window. Migration is the part that could hurt: an empty table means 503 and a factory locked out of its Kanban. OPERATOR_EMAIL and OPERATOR_PASSWORD seed the first account, and only when that email is absent, so a password changed through the CLI survives a redeploy carrying a stale environment variable. The first attempt at this silently did nothing, because db-init receives its own small environment and had neither variable; both compose files now pass them to it. Verified against a running stack: bootstrap seeds the existing credential, that credential still logs in unchanged, a second operator authenticates separately, wrong passwords and unknown accounts are rejected alike, and disabling revokes an open session immediately. Roles are left out on purpose. The separation of duties the meeting described governs rework authorisation, which this system does not implement, so a role model would have no consumer to serve. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
59 lines
2.8 KiB
Python
59 lines
2.8 KiB
Python
"""One-shot schema/role setup. Only this job receives database admin credentials."""
|
|
import os
|
|
from pathlib import Path
|
|
from urllib.parse import urlparse
|
|
import psycopg
|
|
from psycopg import sql
|
|
from .secrets import load as load_secret_files
|
|
from .operators import seed_from_environment
|
|
|
|
|
|
def admin_connect():
|
|
if os.environ.get('DATABASE_ADMIN_HOST'):
|
|
return psycopg.connect(
|
|
host=os.environ['DATABASE_ADMIN_HOST'],
|
|
dbname=os.environ['DATABASE_ADMIN_NAME'],
|
|
user=os.environ['DATABASE_ADMIN_USER'],
|
|
password=os.environ['DATABASE_ADMIN_PASSWORD'],
|
|
)
|
|
return psycopg.connect(os.environ['DATABASE_ADMIN_URL'])
|
|
|
|
|
|
def admin_password():
|
|
if os.environ.get('DATABASE_ADMIN_HOST'):
|
|
return os.environ.get('DATABASE_ADMIN_PASSWORD')
|
|
url = os.environ.get('DATABASE_ADMIN_URL', '')
|
|
return urlparse(url).password
|
|
|
|
|
|
def main():
|
|
load_secret_files()
|
|
role = os.environ['APP_DB_USER']
|
|
password = os.environ['APP_DB_PASSWORD']
|
|
if password == admin_password():
|
|
raise RuntimeError('Application and database administrator passwords must differ')
|
|
with admin_connect() as c:
|
|
admin, database = c.execute('SELECT current_user,current_database()').fetchone()
|
|
if role == admin:
|
|
raise RuntimeError('Application and database administrator must differ')
|
|
if not c.execute('SELECT 1 FROM pg_roles WHERE rolname=%s', (role,)).fetchone():
|
|
c.execute(sql.SQL('CREATE ROLE {} LOGIN').format(sql.Identifier(role)))
|
|
c.execute(sql.SQL('ALTER ROLE {} NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD {}').format(
|
|
sql.Identifier(role), sql.Literal(password)))
|
|
c.execute(Path(__file__).with_name('schema.sql').read_text())
|
|
c.execute(sql.SQL('REVOKE CREATE ON SCHEMA public FROM PUBLIC'))
|
|
c.execute(sql.SQL('GRANT CONNECT ON DATABASE {} TO {}').format(sql.Identifier(database),sql.Identifier(role)))
|
|
c.execute(sql.SQL('GRANT USAGE ON SCHEMA dtf_local TO {}').format(sql.Identifier(role)))
|
|
c.execute(sql.SQL('GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA dtf_local TO {}').format(sql.Identifier(role)))
|
|
c.execute(sql.SQL('GRANT USAGE,SELECT ON ALL SEQUENCES IN SCHEMA dtf_local TO {}').format(sql.Identifier(role)))
|
|
# Turn the configured credential into a real account so an existing
|
|
# deployment keeps logging in exactly as before. Inserts only when that
|
|
# email is absent, so a password changed with local.operators is never
|
|
# reverted by a stale environment variable on the next deploy.
|
|
seeded = seed_from_environment(c)
|
|
print('Local schema migrated; runtime role has DML only.')
|
|
if seeded:
|
|
print(f'Seeded operator account {seeded} from OPERATOR_EMAIL.')
|
|
|
|
if __name__ == '__main__': main()
|