Stan Runge
9d08e6af23
All checks were successful
Deploy production / deploy (push) Successful in 2m33s
30 lines
1.4 KiB
SQL
30 lines
1.4 KiB
SQL
CREATE TABLE "meta"."edit_log" (
|
|
"id" bigint PRIMARY KEY GENERATED ALWAYS AS IDENTITY (sequence name "meta"."edit_log_id_seq" INCREMENT BY 1 MINVALUE 1 MAXVALUE 9223372036854775807 START WITH 1 CACHE 1),
|
|
"at" timestamp with time zone DEFAULT now() NOT NULL,
|
|
"user_id" text,
|
|
"user_email" text,
|
|
"schema_name" text NOT NULL,
|
|
"table_name" text NOT NULL,
|
|
"action" text NOT NULL,
|
|
"pk" jsonb,
|
|
"before" jsonb,
|
|
"after" jsonb,
|
|
CONSTRAINT "edit_log_action_check" CHECK (action IN ('insert','update','delete','import','add_column'))
|
|
);
|
|
--> statement-breakpoint
|
|
CREATE INDEX "edit_log_table_at_index" ON "meta"."edit_log" ("schema_name","table_name","at");--> statement-breakpoint
|
|
-- Hand-written below this line (not generated by drizzle-kit).
|
|
-- The app role appends to and reads the log; nobody updates or deletes through the app.
|
|
-- personal_ro gets no access: before/after values can hold private (health) data.
|
|
-- Grants only run on prod (as `personal`); the dev DB is owned by personal_dev.
|
|
DO $$
|
|
BEGIN
|
|
IF current_user = 'personal' AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'personal_app') THEN
|
|
GRANT SELECT, INSERT ON meta.edit_log TO personal_app;
|
|
GRANT USAGE ON SEQUENCE meta.edit_log_id_seq TO personal_app;
|
|
END IF;
|
|
IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'personal_ro') THEN
|
|
REVOKE ALL ON meta.edit_log FROM personal_ro;
|
|
END IF;
|
|
END $$;
|