diff --git a/merlin-server/sql/merlin/default_user_roles.sql b/merlin-server/sql/merlin/default_user_roles.sql new file mode 100644 index 0000000000..213bd2fc90 --- /dev/null +++ b/merlin-server/sql/merlin/default_user_roles.sql @@ -0,0 +1,64 @@ +-- Default Roles: +insert into metadata.user_roles(role) values ('aerie_admin'), ('user'), ('viewer'); + +-- Permissions For Default Roles: +-- 'aerie_admin' permissions aren't specified since 'aerie_admin' is always considered to have "NO_CHECK" permissions +update metadata.user_role_permission +set action_permissions = '{}', + function_permissions = '{}' +where role = 'admin'; + +update metadata.user_role_permission +set action_permissions = '{ + "check_constraints": "PLAN_OWNER_COLLABORATOR", + "create_expansion_rule": "NO_CHECK", + "create_expansion_set": "NO_CHECK", + "expand_all_activities": "NO_CHECK", + "insert_ext_dataset": "PLAN_OWNER", + "resource_samples": "NO_CHECK", + "schedule":"PLAN_OWNER_COLLABORATOR", + "sequence_seq_json_bulk": "NO_CHECK", + "simulate":"PLAN_OWNER_COLLABORATOR" + }', + function_permissions = '{ + "apply_preset": "PLAN_OWNER_COLLABORATOR", + "begin_merge": "PLAN_OWNER_TARGET", + "branch_plan": "NO_CHECK", + "cancel_merge": "PLAN_OWNER_TARGET", + "commit_merge": "PLAN_OWNER_TARGET", + "create_merge_rq": "PLAN_OWNER_SOURCE", + "create_snapshot": "PLAN_OWNER_COLLABORATOR", + "delete_activity_reanchor": "PLAN_OWNER_COLLABORATOR", + "delete_activity_reanchor_bulk": "PLAN_OWNER_COLLABORATOR", + "delete_activity_reanchor_plan": "PLAN_OWNER_COLLABORATOR", + "delete_activity_reanchor_plan_bulk": "PLAN_OWNER_COLLABORATOR", + "delete_activity_subtree": "PLAN_OWNER_COLLABORATOR", + "delete_activity_subtree_bulk": "PLAN_OWNER_COLLABORATOR", + "deny_merge": "PLAN_OWNER_TARGET", + "get_conflicting_activities": "NO_CHECK", + "get_non_conflicting_activities": "NO_CHECK", + "get_plan_history": "NO_CHECK", + "restore_activity_changelog": "PLAN_OWNER_COLLABORATOR", + "restore_snapshot": "PLAN_OWNER_COLLABORATOR", + "set_resolution": "PLAN_OWNER_TARGET", + "set_resolution_bulk": "PLAN_OWNER_TARGET", + "withdraw_merge_rq": "PLAN_OWNER_SOURCE" + }' +where role = 'user'; + +update metadata.user_role_permission +set action_permissions = '{ + "sequence_seq_json_bulk": "NO_CHECK", + "resource_samples": "NO_CHECK" + }', + function_permissions = '{ + "get_conflicting_activities": "NO_CHECK", + "get_non_conflicting_activities": "NO_CHECK", + "get_plan_history": "NO_CHECK" + }' +where role = 'viewer'; + +-- Default Users: +insert into metadata.users(username, default_role) + values ('Mission Model', 'viewer'), + ('Aerie Legacy', 'viewer'); diff --git a/merlin-server/sql/merlin/init.sql b/merlin-server/sql/merlin/init.sql index bd2a17fc57..be3c06a929 100644 --- a/merlin-server/sql/merlin/init.sql +++ b/merlin-server/sql/merlin/init.sql @@ -107,4 +107,7 @@ begin; \ir functions/hasura/plan_branching_functions.sql \ir functions/hasura/plan_merge_functions.sql + -- Preload Data + \ir default_user_roles.sql; + end; diff --git a/merlin-server/sql/merlin/tables/metadata/user_role_permission.sql b/merlin-server/sql/merlin/tables/metadata/user_role_permission.sql index 5f7e1f2083..9a634b0cc5 100644 --- a/merlin-server/sql/merlin/tables/metadata/user_role_permission.sql +++ b/merlin-server/sql/merlin/tables/metadata/user_role_permission.sql @@ -18,54 +18,3 @@ comment on column metadata.user_role_permission.action_permissions is '' comment on column metadata.user_role_permission.function_permissions is '' 'The permissions the role has on Hasura Functions.'; --- Permissions For Default Roles: --- 'aerie_admin' permissions aren't specified since 'aerie_admin' is always considered to have "NO_CHECK" permissions -insert into metadata.user_role_permission(role, action_permissions, function_permissions) -values - ('aerie_admin', '{}', '{}'), - ('user', - '{ - "check_constraints": "PLAN_OWNER_COLLABORATOR", - "create_expansion_rule": "NO_CHECK", - "create_expansion_set": "NO_CHECK", - "expand_all_activities": "NO_CHECK", - "insert_ext_dataset": "PLAN_OWNER", - "resource_samples": "NO_CHECK", - "schedule":"PLAN_OWNER_COLLABORATOR", - "sequence_seq_json_bulk": "NO_CHECK", - "simulate":"PLAN_OWNER_COLLABORATOR" - }', - '{ - "apply_preset": "PLAN_OWNER_COLLABORATOR", - "begin_merge": "PLAN_OWNER_TARGET", - "branch_plan": "NO_CHECK", - "cancel_merge": "PLAN_OWNER_TARGET", - "commit_merge": "PLAN_OWNER_TARGET", - "create_merge_rq": "PLAN_OWNER_SOURCE", - "create_snapshot": "PLAN_OWNER_COLLABORATOR", - "delete_activity_reanchor": "PLAN_OWNER_COLLABORATOR", - "delete_activity_reanchor_bulk": "PLAN_OWNER_COLLABORATOR", - "delete_activity_reanchor_plan": "PLAN_OWNER_COLLABORATOR", - "delete_activity_reanchor_plan_bulk": "PLAN_OWNER_COLLABORATOR", - "delete_activity_subtree": "PLAN_OWNER_COLLABORATOR", - "delete_activity_subtree_bulk": "PLAN_OWNER_COLLABORATOR", - "deny_merge": "PLAN_OWNER_TARGET", - "get_conflicting_activities": "NO_CHECK", - "get_non_conflicting_activities": "NO_CHECK", - "get_plan_history": "NO_CHECK", - "restore_activity_changelog": "PLAN_OWNER_COLLABORATOR", - "restore_snapshot": "PLAN_OWNER_COLLABORATOR", - "set_resolution": "PLAN_OWNER_TARGET", - "set_resolution_bulk": "PLAN_OWNER_TARGET", - "withdraw_merge_rq": "PLAN_OWNER_SOURCE" - }' ), - ('viewer', - '{ - "sequence_seq_json_bulk": "NO_CHECK", - "resource_samples": "NO_CHECK" - }', - '{ - "get_conflicting_activities": "NO_CHECK", - "get_non_conflicting_activities": "NO_CHECK", - "get_plan_history": "NO_CHECK" - }'); diff --git a/merlin-server/sql/merlin/tables/metadata/user_roles.sql b/merlin-server/sql/merlin/tables/metadata/user_roles.sql index 1789c72bce..dc27702435 100644 --- a/merlin-server/sql/merlin/tables/metadata/user_roles.sql +++ b/merlin-server/sql/merlin/tables/metadata/user_roles.sql @@ -3,7 +3,6 @@ create table metadata.user_roles( role text primary key, description text null ); -insert into metadata.user_roles(role) values ('aerie_admin'), ('user'), ('viewer'); comment on table metadata.user_roles is e'' 'A list of all the allowed Hasura roles, with an optional description per role'; diff --git a/merlin-server/sql/merlin/tables/metadata/users.sql b/merlin-server/sql/merlin/tables/metadata/users.sql index 06e3dccd38..1ab737cc4d 100644 --- a/merlin-server/sql/merlin/tables/metadata/users.sql +++ b/merlin-server/sql/merlin/tables/metadata/users.sql @@ -4,11 +4,6 @@ create table metadata.users( on update cascade on delete restrict ); --- Insert the default roles into the table, then change the generated status to "Always" --- This can be changed back if we need to add more default users in the future -insert into metadata.users(username, default_role) - values ('Mission Model', 'viewer'), - ('Aerie Legacy', 'viewer'); comment on table metadata.users is e'' 'All users recognized by this deployment.';