'NodeJs - Typeorm - Postgresql : RLS migration
I have a NodeJs server using Typeorm to access PostgreSQL DB. I have a folder where I keep all my db migrations when adding or altering entities. Until now I added the RLS policies to each migrations.
Here is a typical example of one migration :
class addCompetition1624484295177 implements MigrationInterface {
name = 'addCompetition1624484295177'
public async up(queryRunner: QueryRunner): Promise<void> {
await queryRunner.query(`CREATE TABLE "competition" ("id" SERIAL NOT NULL, "posId" integer NOT NULL, "service" character varying NOT NULL, "competitionUuid" character varying NOT NULL, CONSTRAINT "UQ_fc4be8ac6b618b647adae03a54e" UNIQUE ("posId", "service", "competitionUuid"), CONSTRAINT "PK_a52a6248db574777b226e9445bc" PRIMARY KEY ("id"))`);
await queryRunner.query(`ALTER TABLE "competition" ADD CONSTRAINT "FK_d2e14cfd1958a1feb5f5d73892c" FOREIGN KEY ("posId") REFERENCES "pos"("id") ON DELETE CASCADE ON UPDATE NO ACTION`);
await queryRunner.query(`GRANT ALL on competition to customer;`);
await queryRunner.query(
`CREATE POLICY "competition_rls_policy" ON "competition" FOR ALL TO PUBLIC USING ("posId" in (select "posId" from user_poss_pos WHERE "userId" = current_setting('current_user.id')::INTEGER));`,
);
await queryRunner.query(`ALTER TABLE "competition" ENABLE ROW LEVEL SECURITY;`);
}
public async down(queryRunner: QueryRunner): Promise<void> {
await queryRunner.query(`REVOKE ALL on competition from customer;`);
await queryRunner.query(`ALTER TABLE "competition" DROP CONSTRAINT "FK_d2e14cfd1958a1feb5f5d73892c"`);
await queryRunner.query(`DROP TABLE "competition"`);
}
}
customer is the PostgreSQL role that is used to apply RLS policies.
The issue we are facing is that for integrated tests, we use "synchronise" instead of running each migration one after the other (I have now hundreds of migrations). Therefore we need to execute apart the RLS policy to be iso production for the test.
What is the best strategy :
- Run all migrations for each test ? (Causing speed issue as it has to be done after each test)
- Keeping a seperate sql file with all RLS migration needed ? (and each test will execute the SQL instruction on that file)
- Do not execute RLS within the initial DB migrations file and keep rls SQL instruction for each entity seperate and are run as seperate script (for both test and production)
Thanks a lot,
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
