feat: Grant access to schema for role (#36)

README.md

@@ -194,6 +194,17 @@ new Schema(this, "Schema", {
 })
 ```
 
+One may need a role permitted for using schema:
+
+```ts
+new Schema(this, "Schema", {
+  provider: provider,
+  schemaName: "myschema",
+  databaseName: database.databaseName,
+  role: role,
+})
+```
+
 ## Sql
 
 You can insert arbitrary SQL into your database with the `Sql` construct:

src/handler.ts

@@ -58,6 +58,13 @@ interface DatabaseUpdateProps extends DatabaseProps {
   MasterOwner: string
 }
 
+interface SchemaProps {
+  /**
+   * Optional role is granted permissions.
+   */
+  RoleName?: string
+}
+
 const maxAttempts = 20
 
 const jumpTable: JumpTable = {
@@ -73,14 +80,34 @@ const jumpTable: JumpTable = {
     },
   },
   schema: {
-    Create: async (resourceId: string) => {
-      return format("create schema if not exists %I", resourceId)
+    Create: async (resourceId: string, props: SchemaProps) => {
+      const sql: string[] = [format("create schema if not exists %I", resourceId)]
+      if (props.RoleName) {
+        grantRoleForSchema(resourceId, props.RoleName).forEach((stmt) => sql.push(stmt))
+      }
+      return sql
     },
-    Update: async (resourceId: string, oldResourceId: string) => {
-      return format("alter schema %I rename to %I", oldResourceId, resourceId)
+    Update: async (resourceId: string, oldResourceId: string, props: SchemaProps) => {
+      const sql: string[] = []
+      // TODO: revoke old role-name if props.RoleName was removed or changed
+      if (props.RoleName) {
+        revokeRoleFromSchema(oldResourceId, props.RoleName).forEach((stmt) =>
+          sql.push(stmt)
+        )
+      }
+      sql.push(format("alter schema %I rename to %I", oldResourceId, resourceId))
+      if (props.RoleName) {
+        grantRoleForSchema(resourceId, props.RoleName).forEach((stmt) => sql.push(stmt))
+      }
+      return sql
     },
-    Delete: (resourceId: string) => {
-      return format("drop schema if exists %I cascade", resourceId)
+    Delete: (resourceId: string, props: SchemaProps) => {
+      const sql: string[] = []
+      if (props.RoleName) {
+        revokeRoleFromSchema(resourceId, props.RoleName).forEach((stmt) => sql.push(stmt))
+      }
+      sql.push(format("drop schema if exists %I cascade", resourceId))
+      return sql
     },
   },
   role: {
@@ -230,6 +257,15 @@ END$$;`,
   },
 }
 
+const grantRoleForSchema = (schema: string, roleName: string) => [
+  format("GRANT USAGE ON SCHEMA %I TO %I", schema, roleName),
+  format("GRANT CREATE ON SCHEMA %I TO %I", schema, roleName),
+]
+const revokeRoleFromSchema = (schema: string, roleName: string) => [
+  format("REVOKE CREATE ON SCHEMA %I FROM %I", schema, roleName),
+  format("REVOKE ALL ON SCHEMA %I FROM %I", schema, roleName),
+]
+
 const log =
   process.env.LOGGER === "true"
     ? console.debug

src/schema.ts

@@ -3,6 +3,7 @@ import { Construct } from "constructs"
 import { IDatabase } from "./database"
 import { RdsSqlResource } from "./enum"
 import { Provider } from "./provider"
+import { Role } from "./role"
 
 export interface SchemaProps {
   /**
@@ -21,6 +22,11 @@ export interface SchemaProps {
    * Schema name.
    */
   readonly schemaName: string
+
+  /**
+   * Optional role to be granted for managing tables in schema
+   */
+  readonly role?: Role
 }
 
 export class Schema extends CustomResource {
@@ -34,10 +40,12 @@ export class Schema extends CustomResource {
         ResourceId: props.schemaName,
         SecretArn: props.provider.secret.secretArn,
         DatabaseName: props.database ? props.database.databaseName : undefined,
+        RoleName: props.role ? props.role.roleName : undefined,
       },
     })
     this.node.addDependency(props.provider)
     this.schemaName = props.schemaName
     if (props.database) this.node.addDependency(props.database)
+    if (props.role) this.node.addDependency(props.role)
   }
 }

test/handler.test.ts

@@ -11,6 +11,7 @@ import {
   databaseExists,
   databaseOwnerIs,
   rowCount,
+  roleGrantedForSchema,
 } from "./util"
 import { handler } from "../src/handler"
 
@@ -67,6 +68,7 @@ test("schema", async () => {
   const create = createRequest("schema", oldSchemaName)
   await handler(create)
   expect(SecretsManagerClientMock).toHaveBeenCalledTimes(1)
+
   const client = await newClient()
   try {
     expect(await schemaExists(client, oldSchemaName)).toEqual(true)
@@ -76,9 +78,39 @@ test("schema", async () => {
     expect(await schemaExists(client, newSchemaName)).toEqual(true)
 
     // CloudFormation will send a delete afterward, so test that too
-    const remove = deleteRequest("schema", oldSchemaName)
+    const remove = deleteRequest("schema", newSchemaName)
     await handler(remove)
-    expect(await schemaExists(client, oldSchemaName)).toEqual(false)
+    expect(await schemaExists(client, newSchemaName)).toEqual(false)
+
+    // create role for testing
+    const roleName = "schematest"
+    const createRole = createRequest("role", roleName, {
+      PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+      DatabaseName: "postgres",
+    })
+    await handler(createRole)
+
+    const createWithRole = createRequest("schema", oldSchemaName, {
+      RoleName: roleName,
+    })
+    await handler(createWithRole)
+    expect(await roleGrantedForSchema(client, oldSchemaName, roleName)).toEqual(true)
+    const updateWithRole = updateRequest("schema", oldSchemaName, newSchemaName, {
+      RoleName: roleName,
+    })
+    await handler(updateWithRole)
+    expect(await roleGrantedForSchema(client, oldSchemaName, roleName)).toEqual(false)
+    expect(await roleGrantedForSchema(client, newSchemaName, roleName)).toEqual(true)
+    const removeWithRole = deleteRequest("schema", newSchemaName, {
+      RoleName: roleName,
+    })
+    await handler(removeWithRole)
+    expect(await roleGrantedForSchema(client, newSchemaName, roleName)).toEqual(false)
+
+    const removeRole = deleteRequest("role", roleName, {
+      DatabaseName: "postgres",
+    })
+    await handler(removeRole)
   } finally {
     await client.end()
   }

test/util.ts

@@ -90,6 +90,23 @@ export const schemaExists = async (client: Client, schema: string): Promise<bool
   return schemas.find((s) => s === schema) !== undefined
 }
 
+export const roleGrantedForSchema = async (
+  client: Client,
+  schema: string,
+  role: string
+): Promise<boolean> => {
+  const sql = `select nspname as schema_name, r.rolname as role_name,\
+                      pg_catalog.has_schema_privilege(r.rolname, nspname, 'CREATE') as create_grant,\
+                      pg_catalog.has_schema_privilege(r.rolname, nspname, 'USAGE') as usage_grant\
+                      from pg_namespace pn,pg_catalog.pg_roles r \
+                      where array_to_string(nspacl,',') like '%'||r.rolname||'%' and nspowner > 1 \
+                      and nspname = '${schema}' and r.rolname = '${role}'`
+  const { rows } = await client.query(sql)
+  return (
+    rows.length === 1 && rows[0].create_grant === true && rows[0].usage_grant === true
+  )
+}
+
 const getSchemas = async (client: Client): Promise<string[]> => {
   const { rows } = await client.query(
     "select schema_name from information_schema.schemata"