25 lines
1.1 KiB
SQL
25 lines
1.1 KiB
SQL
-- T-009 cluster roles. Runtime login roles are deployment-specific members of
|
|
-- these NOLOGIN roles; passwords and login principals never belong in Git.
|
|
|
|
DO $roles$
|
|
DECLARE
|
|
role_record pg_roles%ROWTYPE;
|
|
BEGIN
|
|
SELECT * INTO role_record FROM pg_roles WHERE rolname = 'bell_app';
|
|
IF NOT FOUND THEN
|
|
CREATE ROLE bell_app NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
|
|
ELSIF role_record.rolsuper OR role_record.rolcreatedb OR role_record.rolcreaterole
|
|
OR role_record.rolreplication OR role_record.rolcanlogin THEN
|
|
RAISE EXCEPTION 'existing bell_app role has unsafe attributes';
|
|
END IF;
|
|
|
|
SELECT * INTO role_record FROM pg_roles WHERE rolname = 'sense_app';
|
|
IF NOT FOUND THEN
|
|
CREATE ROLE sense_app NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
|
|
ELSIF role_record.rolsuper OR role_record.rolcreatedb OR role_record.rolcreaterole
|
|
OR role_record.rolreplication OR role_record.rolcanlogin THEN
|
|
RAISE EXCEPTION 'existing sense_app role has unsafe attributes';
|
|
END IF;
|
|
END
|
|
$roles$;
|