diff --git a/schema/deploy/policies/certification_url_policies.sql b/schema/deploy/policies/certification_url_policies.sql index 927a43eed1..95c47f44ce 100644 --- a/schema/deploy/policies/certification_url_policies.sql +++ b/schema/deploy/policies/certification_url_policies.sql @@ -18,7 +18,7 @@ $policy$ -- statement for select using & insert with check industry_user_statement := 'application_id in (select ggircs_portal_private.get_valid_applications_for_reporter())'; - certifier_user_statement := 'certifier_email = ((select email_address from ggircs_portal.ciip_user where ciip_user.uuid = (select sub from ggircs_portal.session())))'; + certifier_user_statement := 'lower(certifier_email) = (lower((select email_address from ggircs_portal.ciip_user where ciip_user.uuid = (select sub from ggircs_portal.session()))))'; -- ciip_industry_user RLS perform ggircs_portal_private.upsert_policy('ciip_industry_user_select_certification_url', 'certification_url', 'select', 'ciip_industry_user', industry_user_statement); diff --git a/schema/deploy/policies/certification_url_policies@v1.5.0.sql b/schema/deploy/policies/certification_url_policies@v1.5.0.sql new file mode 100644 index 0000000000..927a43eed1 --- /dev/null +++ b/schema/deploy/policies/certification_url_policies@v1.5.0.sql @@ -0,0 +1,35 @@ +-- Deploy ggircs-portal:policies/certification_url_policies to pg +-- requires: tables/certification_url + +begin; + +do +$policy$ + declare + industry_user_statement text; + certifier_user_statement text; + begin + -- ciip_administrator RLS + perform ggircs_portal_private.upsert_policy('ciip_administrator_select_certification_url', 'certification_url', 'select', 'ciip_administrator', 'true'); + perform ggircs_portal_private.upsert_policy('ciip_administrator_insert_certification_url', 'certification_url', 'insert', 'ciip_administrator', 'true'); + + -- ciip_analyst RLS + perform ggircs_portal_private.upsert_policy('ciip_analyst_select_certification_url', 'certification_url', 'select', 'ciip_analyst', 'true'); + + -- statement for select using & insert with check + industry_user_statement := 'application_id in (select ggircs_portal_private.get_valid_applications_for_reporter())'; + certifier_user_statement := 'certifier_email = ((select email_address from ggircs_portal.ciip_user where ciip_user.uuid = (select sub from ggircs_portal.session())))'; + + -- ciip_industry_user RLS + perform ggircs_portal_private.upsert_policy('ciip_industry_user_select_certification_url', 'certification_url', 'select', 'ciip_industry_user', industry_user_statement); + perform ggircs_portal_private.upsert_policy('ciip_industry_user_insert_certification_url', 'certification_url', 'insert', 'ciip_industry_user', industry_user_statement); + perform ggircs_portal_private.upsert_policy('ciip_industry_user_update_certification_url', 'certification_url', 'update', 'ciip_industry_user', industry_user_statement); + + -- ciip_industry_user (certifier) RLS + perform ggircs_portal_private.upsert_policy('certifier_select_certification_url', 'certification_url', 'select', 'ciip_industry_user', certifier_user_statement); + perform ggircs_portal_private.upsert_policy('certifier_update_certification_url', 'certification_url', 'update', 'ciip_industry_user', certifier_user_statement); + + end +$policy$; + +commit; diff --git a/schema/revert/policies/certification_url_policies.sql b/schema/revert/policies/certification_url_policies.sql index c667575863..927a43eed1 100644 --- a/schema/revert/policies/certification_url_policies.sql +++ b/schema/revert/policies/certification_url_policies.sql @@ -1,21 +1,35 @@ --- Revert ggircs-portal:policies/certification_url_policies from pg +-- Deploy ggircs-portal:policies/certification_url_policies to pg +-- requires: tables/certification_url begin; --- ciip_administrator Policies -drop policy ciip_administrator_select_certification_url on ggircs_portal.certification_url; -drop policy ciip_administrator_insert_certification_url on ggircs_portal.certification_url; +do +$policy$ + declare + industry_user_statement text; + certifier_user_statement text; + begin + -- ciip_administrator RLS + perform ggircs_portal_private.upsert_policy('ciip_administrator_select_certification_url', 'certification_url', 'select', 'ciip_administrator', 'true'); + perform ggircs_portal_private.upsert_policy('ciip_administrator_insert_certification_url', 'certification_url', 'insert', 'ciip_administrator', 'true'); --- ciip_analyst Policies -drop policy ciip_analyst_select_certification_url on ggircs_portal.certification_url; + -- ciip_analyst RLS + perform ggircs_portal_private.upsert_policy('ciip_analyst_select_certification_url', 'certification_url', 'select', 'ciip_analyst', 'true'); --- ciip_industry_user Policies -drop policy ciip_industry_user_select_certification_url on ggircs_portal.certification_url; -drop policy ciip_industry_user_insert_certification_url on ggircs_portal.certification_url; -drop policy ciip_industry_user_update_certification_url on ggircs_portal.certification_url; + -- statement for select using & insert with check + industry_user_statement := 'application_id in (select ggircs_portal_private.get_valid_applications_for_reporter())'; + certifier_user_statement := 'certifier_email = ((select email_address from ggircs_portal.ciip_user where ciip_user.uuid = (select sub from ggircs_portal.session())))'; --- ciip_industry_user (certifier) Policies -drop policy certifier_select_certification_url on ggircs_portal.certification_url; -drop policy certifier_update_certification_url on ggircs_portal.certification_url; + -- ciip_industry_user RLS + perform ggircs_portal_private.upsert_policy('ciip_industry_user_select_certification_url', 'certification_url', 'select', 'ciip_industry_user', industry_user_statement); + perform ggircs_portal_private.upsert_policy('ciip_industry_user_insert_certification_url', 'certification_url', 'insert', 'ciip_industry_user', industry_user_statement); + perform ggircs_portal_private.upsert_policy('ciip_industry_user_update_certification_url', 'certification_url', 'update', 'ciip_industry_user', industry_user_statement); + + -- ciip_industry_user (certifier) RLS + perform ggircs_portal_private.upsert_policy('certifier_select_certification_url', 'certification_url', 'select', 'ciip_industry_user', certifier_user_statement); + perform ggircs_portal_private.upsert_policy('certifier_update_certification_url', 'certification_url', 'update', 'ciip_industry_user', certifier_user_statement); + + end +$policy$; commit; diff --git a/schema/revert/policies/certification_url_policies@v1.5.0.sql b/schema/revert/policies/certification_url_policies@v1.5.0.sql new file mode 100644 index 0000000000..c667575863 --- /dev/null +++ b/schema/revert/policies/certification_url_policies@v1.5.0.sql @@ -0,0 +1,21 @@ +-- Revert ggircs-portal:policies/certification_url_policies from pg + +begin; + +-- ciip_administrator Policies +drop policy ciip_administrator_select_certification_url on ggircs_portal.certification_url; +drop policy ciip_administrator_insert_certification_url on ggircs_portal.certification_url; + +-- ciip_analyst Policies +drop policy ciip_analyst_select_certification_url on ggircs_portal.certification_url; + +-- ciip_industry_user Policies +drop policy ciip_industry_user_select_certification_url on ggircs_portal.certification_url; +drop policy ciip_industry_user_insert_certification_url on ggircs_portal.certification_url; +drop policy ciip_industry_user_update_certification_url on ggircs_portal.certification_url; + +-- ciip_industry_user (certifier) Policies +drop policy certifier_select_certification_url on ggircs_portal.certification_url; +drop policy certifier_update_certification_url on ggircs_portal.certification_url; + +commit; diff --git a/schema/sqitch.plan b/schema/sqitch.plan index a749a74100..4bb51b825c 100644 --- a/schema/sqitch.plan +++ b/schema/sqitch.plan @@ -178,3 +178,4 @@ computed_columns/application_revision_ciip_incentive [computed_columns/applicati computed_columns/ciip_user_has_certification_requests [computed_columns/ciip_user_has_certification_requests@v1.5.0] 2020-08-27T19:17:01Z Dylan Leard,,, # Migration: make certifier email comparison case insensitive database_functions/get_valid_applications_for_certifier [database_functions/get_valid_applications_for_certifier@v1.5.0] 2020-08-27T19:19:07Z Dylan Leard,,, # Migration: make certifier email comparison case insensitive policies/application_policies [policies/application_policies@v1.5.0] 2020-08-27T19:22:26Z Dylan Leard,,, # Migration: make certifier email comparison case insensitive +policies/certification_url_policies [policies/certification_url_policies@v1.5.0] 2020-08-27T19:24:00Z Dylan Leard,,, # Migration: make certifier email comparison case insensitive diff --git a/schema/verify/policies/certification_url_policies@v1.5.0.sql b/schema/verify/policies/certification_url_policies@v1.5.0.sql new file mode 100644 index 0000000000..b335d372d3 --- /dev/null +++ b/schema/verify/policies/certification_url_policies@v1.5.0.sql @@ -0,0 +1,23 @@ +-- Verify ggircs-portal:policies/certification_url_policies on pg + +begin; + +-- ciip_administrator Policies +select ggircs_portal_private.verify_policy('select', 'ciip_administrator_select_certification_url', 'certification_url', 'ciip_administrator'); +select ggircs_portal_private.verify_policy('insert', 'ciip_administrator_insert_certification_url', 'certification_url', 'ciip_administrator'); + +-- ciip_analyst Policies +select ggircs_portal_private.verify_policy('select', 'ciip_analyst_select_certification_url', 'certification_url', 'ciip_analyst'); + +-- ciip_industry_user Policies +select ggircs_portal_private.verify_policy('select', 'ciip_industry_user_select_certification_url', 'certification_url', 'ciip_industry_user'); +select ggircs_portal_private.verify_policy('insert', 'ciip_industry_user_insert_certification_url', 'certification_url', 'ciip_industry_user'); +select ggircs_portal_private.verify_policy('update', 'ciip_industry_user_update_certification_url', 'certification_url', 'ciip_industry_user'); + +-- ciip_industry_user (certifier) Policies +select ggircs_portal_private.verify_policy('select', 'certifier_select_certification_url', 'certification_url', 'ciip_industry_user'); +select ggircs_portal_private.verify_policy('update', 'certifier_update_certification_url', 'certification_url', 'ciip_industry_user'); + +-- ciip_guest Policies + +rollback;