Jesse_Chen
20 lines
1.0 KiB
SQL
20 lines
1.0 KiB
SQL
select 'create role anon nologin nosuperuser nocreatedb nocreaterole noinherit'
|
|
where not exists (select 1 from pg_roles where rolname = 'anon') \gexec
|
|
select 'create role authenticated nologin nosuperuser nocreatedb nocreaterole noinherit'
|
|
where not exists (select 1 from pg_roles where rolname = 'authenticated') \gexec
|
|
select 'create role service_role nologin nosuperuser nocreatedb nocreaterole noinherit bypassrls'
|
|
where not exists (select 1 from pg_roles where rolname = 'service_role') \gexec
|
|
|
|
alter role service_role bypassrls;
|
|
|
|
\getenv service_runtime_password SERVICE_RUNTIME_PASSWORD
|
|
select format(
|
|
'create role service_runtime with login nosuperuser nocreatedb nocreaterole noinherit password %L',
|
|
:'service_runtime_password'
|
|
) where not exists (select 1 from pg_roles where rolname = 'service_runtime') \gexec
|
|
select format('grant connect on database %I to service_runtime', current_database()) \gexec
|
|
|
|
grant authenticated to app_runtime;
|
|
grant service_role to service_runtime;
|
|
revoke service_role from admin_runtime;
|