linmeng
d44a41408b
Deploy staging to test server / deploy (push) Successful in 3m34s
Add the missing least-privilege grants and RLS policies so self-hosted admin payment and package APIs can use the admin_runtime database role.
29 lines
1.3 KiB
SQL
29 lines
1.3 KiB
SQL
do $$
|
|
begin
|
|
if exists (select 1 from pg_roles where rolname = 'admin_runtime') then
|
|
grant select, insert, update on table public.payment_packages to admin_runtime;
|
|
grant select on table public.payment_orders to admin_runtime;
|
|
grant select on table public.epay_settings to admin_runtime;
|
|
grant execute on function public.admin_save_epay_settings(
|
|
uuid, text, text, text, text, text, text, text, text, text, boolean, boolean
|
|
) to admin_runtime;
|
|
|
|
drop policy if exists payment_packages_admin_select on public.payment_packages;
|
|
create policy payment_packages_admin_select on public.payment_packages
|
|
for select to admin_runtime using (true);
|
|
|
|
drop policy if exists payment_packages_admin_insert on public.payment_packages;
|
|
create policy payment_packages_admin_insert on public.payment_packages
|
|
for insert to admin_runtime with check (true);
|
|
|
|
drop policy if exists payment_packages_admin_update on public.payment_packages;
|
|
create policy payment_packages_admin_update on public.payment_packages
|
|
for update to admin_runtime using (true) with check (true);
|
|
|
|
drop policy if exists payment_orders_admin_select on public.payment_orders;
|
|
create policy payment_orders_admin_select on public.payment_orders
|
|
for select to admin_runtime using (true);
|
|
end if;
|
|
end;
|
|
$$;
|