Three roles and their grants

grants/ispyb_acquisition.sql

@@ -0,0 +1,47 @@
+-- Create the processing application role.
+CREATE ROLE ispyb_acquisition;
+
+-- You must also create a database user and grant this role to them, e.g.
+-- CREATE USER gda@'%' IDENTIFIED BY 'the_gda_password';
+-- GRANT ispyb_acquisition to gda@'%';
+
+-- Grants for ispyb_acquisition
+GRANT SELECT ON `AdminVar` TO 'ispyb_acquisition';
+
+GRANT EXECUTE ON PROCEDURE retrieve_test TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_container_ls_position TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_container_info TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_container_on_gonio TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE update_container_ls_position TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE update_container_status TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_containers_on_beamline_with_status TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE finish_container TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_container_ls_queue TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_container_queue_timestamp TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_container_queue_most_recent_completed_timestamp TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_container_subsamples TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE insert_container_error TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE clear_container_error TO 'ispyb_acquisition';
+
+GRANT EXECUTE ON PROCEDURE retrieve_session_id TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_dc_infos_for_subsample TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE upsert_dc_group TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE upsert_dc_main TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE update_dc_experiment TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE update_dc_machine TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE upsert_sample_image_analysis TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE upsert_dcg_grid TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE update_dc_position TO 'ispyb_acquisition';
+
+GRANT EXECUTE ON PROCEDURE `update_dc_experiment_v2` TO 'ispyb_acquisition';
+
+GRANT EXECUTE ON PROCEDURE `upsert_dc_main_v2` TO 'ispyb_acquisition';
+
+GRANT EXECUTE ON PROCEDURE `upsert_dc_main_v3` TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE `upsert_dc_group_v2` TO 'ispyb_acquisition';
+
+GRANT EXECUTE ON PROCEDURE `retrieve_container_subsamples_v2` TO 'ispyb_acquisition';
+
+GRANT EXECUTE ON PROCEDURE upsert_dc_group_v3 TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_dc_group TO 'ispyb_acquisition';
+GRANT EXECUTE ON PROCEDURE retrieve_dc_group_v2 TO 'ispyb_acquisition';

grants/ispyb_processing.sql

@@ -0,0 +1,112 @@
+-- Create the processing application role.
+CREATE ROLE ispyb_processing;
+
+-- You must also create a database user and grant this role to them, e.g.
+-- CREATE USER zocalo@'%' IDENTIFIED BY 'the_zocalo_password';
+-- GRANT ispyb_processing to zocalo@'%';
+
+-- Grants for ispyb_processing
+GRANT SELECT ON AdminVar TO 'ispyb_processing'; -- Hack TO allow ispyb_processing to connect through MaxScale
+GRANT INSERT ON ImageQualityIndicators TO 'ispyb_processing'; -- Needed for bulk insertion of aggregated IQIs
+GRANT EXECUTE ON FUNCTION retrieve_visit_id TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION retrieve_datacollection_id TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `retrieve_dc_main` TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION upsert_sample TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION upsert_dcgroup TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION upsert_dc TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION upsert_image TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION upsert_program_run TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION upsert_processing TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION upsert_integration TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION insert_scaling TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION upsert_mrrun TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION upsert_mrrun_blob TO 'ispyb_processing';
+GRANT EXECUTE ON FUNCTION retrieve_proposal_title TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE upsert_dc_group_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_dc_group_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_dc_group_v3 TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE retrieve_current_sessions TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_current_cm_sessions TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_active_plates TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_current_sessions_for_person TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_sessions_for_beamline_and_run TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `retrieve_sessions_for_person_login` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `retrieve_persons_for_proposal` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_most_recent_session TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_containers_submitted_non_ls TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE `insert_screening` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE insert_screening_input TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `insert_screening_output` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `insert_screening_output_v2` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `insert_screening_output_lattice` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `insert_screening_strategy` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `insert_screening_strategy_wedge` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `insert_screening_strategy_sub_wedge` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `update_container_assign` TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE `retrieve_reprocessing_by_dc` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `update_reprocessing_status` TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE `upsert_processing_program` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `upsert_processing_program_attachment` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `upsert_processing` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `insert_processing_scaling` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `upsert_processing_integration` TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE `insert_quality_indicators` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_mrrun TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_mrrun_blob TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE upsert_quality_indicators TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_processing_programs_for_job_id TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_processing_program_attachments_for_dc_group_and_program TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_processing_program_attachments_for_program_id TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE upsert_motion_correction_drift TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE `upsert_processing_job` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `upsert_processing_job_parameter` TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE `upsert_processing_job_image_sweep` TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE upsert_movie TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE upsert_dewar TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE upsert_session_for_proposal_code_number TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_robot_action TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_fluo_mapping TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_fluo_mapping_roi TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_xfe_fluo_spectrum TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_energy_scan TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_dc_file_attachment TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_dewars_for_proposal_code_number TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE upsert_person TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_proposal_has_person TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_session_has_person TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE upsert_dc TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_grid_info_for_dcg TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE upsert_xray_centring_result TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE update_container_unassign_all_for_beamline TO 'ispyb_processing';
+
+GRANT EXECUTE ON PROCEDURE upsert_sample TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE upsert_dewar_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_session_id_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_proposal_title TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_processing_programs_for_job_id_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_processing_program_attachments_for_program_id_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_processing_program_attachments_for_dc_group_program_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_processing_job_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_processing_job_parameters_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_processing_job_image_sweeps_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_processing_job_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_grid_info_for_dcg_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_dewars_for_proposal_code_number_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_dc_main_v2 TO 'ispyb_processing';
+GRANT EXECUTE ON PROCEDURE retrieve_dc TO 'ispyb_processing';

grants/ispyb_web.sql

@@ -0,0 +1,120 @@
+-- Create the web application role.
+CREATE ROLE ispyb_web;
+
+-- You must also create a database user and grant this role to them, e.g.
+-- CREATE USER synchweb@'%' IDENTIFIED BY 'the_synchweb_password';
+-- GRANT ispyb_web to synchweb@'%';
+
+-- The grants for the web application role:
+GRANT SELECT ON * TO 'ispyb_web';
+GRANT SELECT, UPDATE, INSERT ON BLSession TO 'ispyb_web';
+GRANT SELECT, INSERT ON SessionType TO 'ispyb_web';
+GRANT SELECT, INSERT, UPDATE, DELETE ON BeamLineSetup TO 'ispyb_web';
+GRANT UPDATE ON DataCollection TO 'ispyb_web';
+GRANT SELECT, UPDATE ON EnergyScan TO 'ispyb_web';
+GRANT SELECT, UPDATE ON XFEFluorescenceSpectrum TO 'ispyb_web';
+GRANT UPDATE ON DataCollectionGroup TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON DataCollectionComment TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Shipping TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ShippingHasSession TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Dewar TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON DewarTransportHistory TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON DewarLocation TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON `Container` TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ContainerHistory TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ContainerQueue TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ContainerQueueSample TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BLSample TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BLSubSample TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BLSampleGroup TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BLSampleGroup_has_BLSample TO 'ispyb_web';
+GRANT SELECT, INSERT, UPDATE ON Position TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Crystal TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Crystal_has_UUID TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Protein TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Protein_has_PDB TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON PDB TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON PDBEntry TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON DiffractionPlan TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ExperimentKindDetails TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON LabContact TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Person TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Laboratory TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON `Project` TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Project_has_BLSample TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Project_has_DCGroup TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Project_has_EnergyScan TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Project_has_Person TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Project_has_Protein TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Project_has_Session TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Project_has_Shipping TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Project_has_User TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Project_has_XFEFSpectrum TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON PHPSession TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON UserGroup_has_Permission TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Permission TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON UserGroup_has_Person TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON `UserGroup` TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON Component_has_SubType TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BLSampleType_has_Component TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ComponentSubType TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ConcentrationType TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ComponentType TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ComponentLattice TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON AdminActivity TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON AdminVar TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON DewarRegistry TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON DewarReport TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON ContainerRegistry TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ContainerRegistry_has_Proposal TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ContainerReport TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON BF_component TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BF_component_beamline TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BF_fault TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BF_subcomponent TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BF_subcomponent_beamline TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BF_system TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BF_system_beamline TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON CourierTermsAccepted TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON CalendarHash TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON Schedule TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON ScheduleComponent TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON Screen TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ScreenComponent TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ScreenComponentGroup TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ContainerInspection TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON ComponentSubType TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ComponentType TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON Component_has_SubType TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON ConcentrationType TO 'ispyb_web';
+
+GRANT INSERT, UPDATE, DELETE ON BLSampleImageScore TO 'ispyb_web';
+GRANT INSERT, UPDATE, DELETE ON BLSampleImage TO 'ispyb_web';
+
+GRANT SELECT, INSERT, UPDATE ON Log4Stat TO 'ispyb_web';
+GRANT SELECT, INSERT, UPDATE, DELETE ON SW_onceToken TO 'ispyb_web';
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON BLSample_has_DataCollectionPlan TO 'ispyb_web';
+GRANT SELECT, INSERT, UPDATE ON Detector TO 'ispyb_web';
+GRANT SELECT, INSERT, UPDATE, DELETE ON DataCollectionPlan_has_Detector TO 'ispyb_web';
+GRANT SELECT, INSERT, UPDATE, DELETE ON ScanParametersModel TO 'ispyb_web';
+GRANT SELECT, INSERT, UPDATE, DELETE ON ScanParametersService TO 'ispyb_web';
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON XRFFluorescenceMappingROI TO 'ispyb_web';
+GRANT SELECT, INSERT, UPDATE, DELETE ON XRFFluorescenceMapping TO 'ispyb_web';
+
+GRANT SELECT ON Movie TO 'ispyb_web';
+GRANT SELECT ON `CTF` TO 'ispyb_web';
+GRANT SELECT ON `MotionCorrection` TO 'ispyb_web';
+GRANT SELECT ON `MotionCorrectionDrift` TO 'ispyb_web';