Skip to content

Commit ed31cde

Browse files
bitnerbitner
committed
stage migrations
1 parent 15b1425 commit ed31cde

File tree

6 files changed

+4681
-4
lines changed

6 files changed

+4681
-4
lines changed

‎src/pgstac/migrations/pgstac.0.8.5-0.8.6.sql‎

Lines changed: 284 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,284 @@
1+
SET client_min_messages TO WARNING;
2+
SET SEARCH_PATH to pgstac, public;
3+
RESET ROLE;
4+
DO $$
5+
DECLARE
6+
BEGIN
7+
IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname='postgis') THEN
8+
CREATE EXTENSION IF NOT EXISTS postgis;
9+
END IF;
10+
IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname='btree_gist') THEN
11+
CREATE EXTENSION IF NOT EXISTS btree_gist;
12+
END IF;
13+
END;
14+
$$ LANGUAGE PLPGSQL;
15+
16+
DO $$
17+
BEGIN
18+
CREATE ROLE pgstac_admin;
19+
EXCEPTION WHEN duplicate_object THEN
20+
RAISE NOTICE '%, skipping', SQLERRM USING ERRCODE = SQLSTATE;
21+
END
22+
$$;
23+
24+
DO $$
25+
BEGIN
26+
CREATE ROLE pgstac_read;
27+
EXCEPTION WHEN duplicate_object THEN
28+
RAISE NOTICE '%, skipping', SQLERRM USING ERRCODE = SQLSTATE;
29+
END
30+
$$;
31+
32+
DO $$
33+
BEGIN
34+
CREATE ROLE pgstac_ingest;
35+
EXCEPTION WHEN duplicate_object THEN
36+
RAISE NOTICE '%, skipping', SQLERRM USING ERRCODE = SQLSTATE;
37+
END
38+
$$;
39+
40+
41+
GRANT pgstac_admin TO current_user;
42+
43+
-- Function to make sure pgstac_admin is the owner of items
44+
CREATE OR REPLACE FUNCTION pgstac_admin_owns() RETURNS VOID AS $$
45+
DECLARE
46+
f RECORD;
47+
BEGIN
48+
FOR f IN (
49+
SELECT
50+
concat(
51+
oid::regproc::text,
52+
'(',
53+
coalesce(pg_get_function_identity_arguments(oid),''),
54+
')'
55+
) AS name,
56+
CASE prokind WHEN 'f' THEN 'FUNCTION' WHEN 'p' THEN 'PROCEDURE' WHEN 'a' THEN 'AGGREGATE' END as typ
57+
FROM pg_proc
58+
WHERE
59+
pronamespace=to_regnamespace('pgstac')
60+
AND proowner != to_regrole('pgstac_admin')
61+
AND proname NOT LIKE 'pg_stat%'
62+
)
63+
LOOP
64+
BEGIN
65+
EXECUTE format('ALTER %s %s OWNER TO pgstac_admin;', f.typ, f.name);
66+
EXCEPTION WHEN others THEN
67+
RAISE NOTICE '%, skipping', SQLERRM USING ERRCODE = SQLSTATE;
68+
END;
69+
END LOOP;
70+
FOR f IN (
71+
SELECT
72+
oid::regclass::text as name,
73+
CASE relkind
74+
WHEN 'i' THEN 'INDEX'
75+
WHEN 'I' THEN 'INDEX'
76+
WHEN 'p' THEN 'TABLE'
77+
WHEN 'r' THEN 'TABLE'
78+
WHEN 'v' THEN 'VIEW'
79+
WHEN 'S' THEN 'SEQUENCE'
80+
ELSE NULL
81+
END as typ
82+
FROM pg_class
83+
WHERE relnamespace=to_regnamespace('pgstac') and relowner != to_regrole('pgstac_admin') AND relkind IN ('r','p','v','S') AND relname NOT LIKE 'pg_stat'
84+
)
85+
LOOP
86+
BEGIN
87+
EXECUTE format('ALTER %s %s OWNER TO pgstac_admin;', f.typ, f.name);
88+
EXCEPTION WHEN others THEN
89+
RAISE NOTICE '%, skipping', SQLERRM USING ERRCODE = SQLSTATE;
90+
END;
91+
END LOOP;
92+
RETURN;
93+
END;
94+
$$ LANGUAGE PLPGSQL;
95+
SELECT pgstac_admin_owns();
96+
97+
CREATE SCHEMA IF NOT EXISTS pgstac AUTHORIZATION pgstac_admin;
98+
99+
GRANT ALL ON ALL FUNCTIONS IN SCHEMA pgstac to pgstac_admin;
100+
GRANT ALL ON ALL TABLES IN SCHEMA pgstac to pgstac_admin;
101+
GRANT ALL ON ALL SEQUENCES IN SCHEMA pgstac to pgstac_admin;
102+
103+
ALTER ROLE pgstac_admin SET SEARCH_PATH TO pgstac, public;
104+
ALTER ROLE pgstac_read SET SEARCH_PATH TO pgstac, public;
105+
ALTER ROLE pgstac_ingest SET SEARCH_PATH TO pgstac, public;
106+
107+
GRANT USAGE ON SCHEMA pgstac to pgstac_read;
108+
ALTER DEFAULT PRIVILEGES IN SCHEMA pgstac GRANT SELECT ON TABLES TO pgstac_read;
109+
ALTER DEFAULT PRIVILEGES IN SCHEMA pgstac GRANT USAGE ON TYPES TO pgstac_read;
110+
ALTER DEFAULT PRIVILEGES IN SCHEMA pgstac GRANT ALL ON SEQUENCES TO pgstac_read;
111+
112+
GRANT pgstac_read TO pgstac_ingest;
113+
GRANT ALL ON SCHEMA pgstac TO pgstac_ingest;
114+
ALTER DEFAULT PRIVILEGES IN SCHEMA pgstac GRANT ALL ON TABLES TO pgstac_ingest;
115+
ALTER DEFAULT PRIVILEGES IN SCHEMA pgstac GRANT ALL ON FUNCTIONS TO pgstac_ingest;
116+
117+
SET ROLE pgstac_admin;
118+
ALTER DEFAULT PRIVILEGES FOR ROLE pgstac_admin IN SCHEMA pgstac GRANT SELECT ON TABLES TO pgstac_read;
119+
ALTER DEFAULT PRIVILEGES FOR ROLE pgstac_admin IN SCHEMA pgstac GRANT USAGE ON TYPES TO pgstac_read;
120+
ALTER DEFAULT PRIVILEGES FOR ROLE pgstac_admin IN SCHEMA pgstac GRANT ALL ON SEQUENCES TO pgstac_read;
121+
ALTER DEFAULT PRIVILEGES FOR ROLE pgstac_admin IN SCHEMA pgstac GRANT ALL ON TABLES TO pgstac_ingest;
122+
ALTER DEFAULT PRIVILEGES FOR ROLE pgstac_admin IN SCHEMA pgstac GRANT ALL ON FUNCTIONS TO pgstac_ingest;
123+
RESET ROLE;
124+
125+
SET ROLE pgstac_ingest;
126+
ALTER DEFAULT PRIVILEGES FOR ROLE pgstac_ingest IN SCHEMA pgstac GRANT SELECT ON TABLES TO pgstac_read;
127+
ALTER DEFAULT PRIVILEGES FOR ROLE pgstac_ingest IN SCHEMA pgstac GRANT USAGE ON TYPES TO pgstac_read;
128+
ALTER DEFAULT PRIVILEGES FOR ROLE pgstac_ingest IN SCHEMA pgstac GRANT ALL ON SEQUENCES TO pgstac_read;
129+
ALTER DEFAULT PRIVILEGES FOR ROLE pgstac_ingest IN SCHEMA pgstac GRANT ALL ON TABLES TO pgstac_ingest;
130+
ALTER DEFAULT PRIVILEGES FOR ROLE pgstac_ingest IN SCHEMA pgstac GRANT ALL ON FUNCTIONS TO pgstac_ingest;
131+
RESET ROLE;
132+
133+
SET SEARCH_PATH TO pgstac, public;
134+
SET ROLE pgstac_admin;
135+
136+
DO $$
137+
BEGIN
138+
DROP FUNCTION IF EXISTS analyze_items;
139+
EXCEPTION WHEN others THEN
140+
RAISE NOTICE '%, skipping', SQLERRM USING ERRCODE = SQLSTATE;
141+
END
142+
$$;
143+
DO $$
144+
BEGIN
145+
DROP FUNCTION IF EXISTS validate_constraints;
146+
EXCEPTION WHEN others THEN
147+
RAISE NOTICE '%, skipping', SQLERRM USING ERRCODE = SQLSTATE;
148+
END
149+
$$;
150+
151+
-- Install these idempotently as migrations do not put them before trying to modify the collections table
152+
153+
154+
CREATE OR REPLACE FUNCTION collection_geom(content jsonb)
155+
RETURNS geometry AS $$
156+
WITH box AS (SELECT content->'extent'->'spatial'->'bbox'->0 as box)
157+
SELECT
158+
st_makeenvelope(
159+
(box->>0)::float,
160+
(box->>1)::float,
161+
(box->>2)::float,
162+
(box->>3)::float,
163+
4326
164+
)
165+
FROM box;
166+
$$ LANGUAGE SQL IMMUTABLE STRICT;
167+
168+
CREATE OR REPLACE FUNCTION collection_datetime(content jsonb)
169+
RETURNS timestamptz AS $$
170+
SELECT
171+
CASE
172+
WHEN
173+
(content->'extent'->'temporal'->'interval'->0->>0) IS NULL
174+
THEN '-infinity'::timestamptz
175+
ELSE
176+
(content->'extent'->'temporal'->'interval'->0->>0)::timestamptz
177+
END
178+
;
179+
$$ LANGUAGE SQL IMMUTABLE STRICT;
180+
181+
CREATE OR REPLACE FUNCTION collection_enddatetime(content jsonb)
182+
RETURNS timestamptz AS $$
183+
SELECT
184+
CASE
185+
WHEN
186+
(content->'extent'->'temporal'->'interval'->0->>1) IS NULL
187+
THEN 'infinity'::timestamptz
188+
ELSE
189+
(content->'extent'->'temporal'->'interval'->0->>1)::timestamptz
190+
END
191+
;
192+
$$ LANGUAGE SQL IMMUTABLE STRICT;
193+
-- BEGIN migra calculated SQL
194+
-- END migra calculated SQL
195+
DO $$
196+
BEGIN
197+
INSERT INTO queryables (name, definition, property_wrapper, property_index_type) VALUES
198+
('id', '{"title": "Item ID","description": "Item identifier","$ref": "https://schemas.stacspec.org/v1.0.0/item-spec/json-schema/item.json#/definitions/core/allOf/2/properties/id"}', null, null);
199+
EXCEPTION WHEN unique_violation THEN
200+
RAISE NOTICE '%', SQLERRM USING ERRCODE = SQLSTATE;
201+
END
202+
$$;
203+
204+
DO $$
205+
BEGIN
206+
INSERT INTO queryables (name, definition, property_wrapper, property_index_type) VALUES
207+
('geometry', '{"title": "Item Geometry","description": "Item Geometry","$ref": "https://geojson.org/schema/Feature.json"}', null, null);
208+
EXCEPTION WHEN unique_violation THEN
209+
RAISE NOTICE '%', SQLERRM USING ERRCODE = SQLSTATE;
210+
END
211+
$$;
212+
213+
DO $$
214+
BEGIN
215+
INSERT INTO queryables (name, definition, property_wrapper, property_index_type) VALUES
216+
('datetime','{"description": "Datetime","type": "string","title": "Acquired","format": "date-time","pattern": "(\\+00:00|Z)$"}', null, null);
217+
EXCEPTION WHEN unique_violation THEN
218+
RAISE NOTICE '%', SQLERRM USING ERRCODE = SQLSTATE;
219+
END
220+
$$;
221+
222+
DELETE FROM queryables a USING queryables b
223+
WHERE a.name = b.name AND a.collection_ids IS NOT DISTINCT FROM b.collection_ids AND a.id > b.id;
224+
225+
226+
INSERT INTO pgstac_settings (name, value) VALUES
227+
('context', 'off'),
228+
('context_estimated_count', '100000'),
229+
('context_estimated_cost', '100000'),
230+
('context_stats_ttl', '1 day'),
231+
('default_filter_lang', 'cql2-json'),
232+
('additional_properties', 'true'),
233+
('use_queue', 'false'),
234+
('queue_timeout', '10 minutes'),
235+
('update_collection_extent', 'false'),
236+
('format_cache', 'false'),
237+
('readonly', 'false')
238+
ON CONFLICT DO NOTHING
239+
;
240+
241+
ALTER FUNCTION to_text COST 5000;
242+
ALTER FUNCTION to_float COST 5000;
243+
ALTER FUNCTION to_int COST 5000;
244+
ALTER FUNCTION to_tstz COST 5000;
245+
ALTER FUNCTION to_text_array COST 5000;
246+
247+
ALTER FUNCTION update_partition_stats SECURITY DEFINER;
248+
ALTER FUNCTION partition_after_triggerfunc SECURITY DEFINER;
249+
ALTER FUNCTION drop_table_constraints SECURITY DEFINER;
250+
ALTER FUNCTION create_table_constraints SECURITY DEFINER;
251+
ALTER FUNCTION check_partition SECURITY DEFINER;
252+
ALTER FUNCTION repartition SECURITY DEFINER;
253+
ALTER FUNCTION where_stats SECURITY DEFINER;
254+
ALTER FUNCTION search_query SECURITY DEFINER;
255+
ALTER FUNCTION format_item SECURITY DEFINER;
256+
ALTER FUNCTION maintain_index SECURITY DEFINER;
257+
258+
GRANT USAGE ON SCHEMA pgstac to pgstac_read;
259+
GRANT ALL ON SCHEMA pgstac to pgstac_ingest;
260+
GRANT ALL ON SCHEMA pgstac to pgstac_admin;
261+
262+
-- pgstac_read role limited to using function apis
263+
GRANT EXECUTE ON FUNCTION search TO pgstac_read;
264+
GRANT EXECUTE ON FUNCTION search_query TO pgstac_read;
265+
GRANT EXECUTE ON FUNCTION item_by_id TO pgstac_read;
266+
GRANT EXECUTE ON FUNCTION get_item TO pgstac_read;
267+
GRANT SELECT ON ALL TABLES IN SCHEMA pgstac TO pgstac_read;
268+
269+
270+
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA pgstac to pgstac_ingest;
271+
GRANT ALL ON ALL TABLES IN SCHEMA pgstac to pgstac_ingest;
272+
GRANT USAGE ON ALL SEQUENCES IN SCHEMA pgstac to pgstac_ingest;
273+
274+
REVOKE ALL PRIVILEGES ON PROCEDURE run_queued_queries FROM public;
275+
GRANT ALL ON PROCEDURE run_queued_queries TO pgstac_admin;
276+
277+
REVOKE ALL PRIVILEGES ON FUNCTION run_queued_queries_intransaction FROM public;
278+
GRANT ALL ON FUNCTION run_queued_queries_intransaction TO pgstac_admin;
279+
280+
RESET ROLE;
281+
282+
SET ROLE pgstac_ingest;
283+
SELECT update_partition_stats_q(partition) FROM partitions_view;
284+
SELECT set_version('0.8.6');

0 commit comments

Comments
 (0)