[type/__postgres_role] ALTER ROLE when parameters change

This commit is contained in:
Dennis Camera 2020-12-15 21:05:55 +01:00
parent 932e2496ed
commit c36df82882
2 changed files with 91 additions and 16 deletions

View file

@ -1,6 +1,7 @@
#!/bin/sh -e #!/bin/sh -e
# #
# 2011 Steven Armstrong (steven-cdist at armstrong.cc) # 2011 Steven Armstrong (steven-cdist at armstrong.cc)
# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
# #
# This file is part of cdist. # This file is part of cdist.
# #
@ -31,11 +32,48 @@ in
;; ;;
esac esac
rolename=${__object_id:?} rolename=${__object_id:?}
if test -n "$(su - "${postgres_user}" -c "psql postgres -twAc \"SELECT 1 FROM pg_roles WHERE rolname='${rolename}'\"")" role_properties=$(
cmd=$(printf "psql -F '\034' -R '\036' -wAc \"SELECT * FROM pg_roles WHERE rolname='%s'\"" "${rolename}")
su -l "${postgres_user}" -c "${cmd}" \
| awk '
BEGIN { RS = "\036"; FS = "\034" }
/^\([0-9]+ rows?\)/ { exit }
NR == 1 { for (i = 1; i <= NF; i++) cols[i] = $i; next }
NR == 2 { for (i = 1; i <= NF; i++) printf "%s=%s\n", cols[i], $i }
'
)
if test -n "${role_properties}"
then then
# Check if the user's properties match the parameters
for prop in login createdb createrole superuser
do
bool_should=$(test -f "${__object:?}/parameter/${prop}" && echo 't' || echo 'f')
bool_is=$(
printf '%s\n' "${role_properties}" |
awk -F '=' -v key="${prop}" '
BEGIN {
if (key == "login")
key = "canlogin"
else if (key == "superuser")
key = "super"
key = "rol" key
}
$1 == key {
sub(/^[^=]*=/, "")
print
}
'
)
test "${bool_is}" = "${bool_should}" || {
echo 'different'
exit 0
}
done
echo 'present' echo 'present'
else else
echo 'absent' echo 'absent'

View file

@ -1,6 +1,7 @@
#!/bin/sh -e #!/bin/sh -e
# #
# 2011 Steven Armstrong (steven-cdist at armstrong.cc) # 2011 Steven Armstrong (steven-cdist at armstrong.cc)
# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
# #
# This file is part of cdist. # This file is part of cdist.
# #
@ -18,6 +19,15 @@
# along with cdist. If not, see <http://www.gnu.org/licenses/>. # along with cdist. If not, see <http://www.gnu.org/licenses/>.
# #
quote() {
if test $# -gt 0
then
printf '%s' "$*"
else
cat -
fi | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/'/"
}
case $(cat "${__global:?}/explorer/os") case $(cat "${__global:?}/explorer/os")
in in
(netbsd) (netbsd)
@ -44,28 +54,55 @@ fi
case ${state_should} case ${state_should}
in in
(present) (present)
if test -f "${__object:?}/parameter/password" if test -s "${__object:?}/parameter/password"
then then
password=$(cat "${__object:?}/parameter/password") quoted_password=$(
delim='$$'
while grep -q -F "${delim}" "${__object:?}/parameter/password"
do
delim="\$$(LC_ALL=C tr -cd '[:alpha:]' </dev/urandom | dd bs=1 count=4 2>/dev/null)$"
done
raw_passwd=$(cat "${__object:?}/parameter/password"; printf .)
# shellcheck disable=SC2016
printf '%s%s%s' "${delim}" "${raw_passwd%?.}" "${delim}"
)
fi fi
booleans= booleans=
for boolean in login createdb createrole superuser for boolean in login createdb createrole superuser
do do
if test ! -f "${__object:?}/parameter/${boolean}" booleans="${booleans}${booleans:+ }$(
if test -f "${__object:?}/parameter/${boolean}"
then then
boolean="no${boolean}" echo "${boolean}"
fi else
booleans="${booleans} $(echo ${boolean} | tr '[:lower:]' '[:upper:]')" echo "no${boolean}"
fi \
| tr '[:lower:]' '[:upper:]')"
done done
[ -n "${password}" ] && password="PASSWORD '${password}'" case ${state_is}
cat << EOF in
su - '${postgres_user}' -c "psql postgres -wc 'CREATE ROLE \\"${rolename}\\" WITH ${password} ${booleans};'" (absent)
EOF query=$(printf 'CREATE ROLE "%s" WITH %s PASSWORD %s;' \
"${rolename}" "${booleans}" "${quoted_password:-NULL}")
;;
(different)
query=$(printf 'ALTER ROLE "%s" WITH %s PASSWORD %s;' \
"${rolename}" "${booleans}" "${quoted_password:-NULL}")
;;
(*)
exit 1 # TODO: error msg
;;
esac
psql_cmd=$(printf 'psql postgres -wc %s' "$(quote "${query}")" | quote)
printf "su -l '%s' -c %s\\n" "${postgres_user}" "${psql_cmd}"
;; ;;
(absent) (absent)
cat << EOF printf "su -l '%s' -c 'dropuser '\\\\'%s\\\\'\\n" \
su - '${postgres_user}' -c "dropuser '${rolename}'" "${postgres_user}" \
EOF "$(quote "${rolename}")"
;; ;;
esac esac