Function greenFieldSchemaSetup

src/gcp/cloudsql/permissionsSetup.ts:201–253

(
  instanceId: string,
  databaseId: string,
  schema: string,
  options: Options,
)

}

export async function greenFieldSchemaSetup(
  instanceId: string,
  databaseId: string,
  schema: string,
  options: Options,
) {
  // Detect the minimal necessary revokes to avoid errors for users who used the old sql permissions setup.
  const revokes = [];
  if (
    await checkSQLRoleIsGranted(
      options,
      instanceId,
      databaseId,
      "cloudsqlsuperuser",
      firebaseowner(databaseId, schema),
    )
  ) {
    logger.warn(
      "Detected cloudsqlsuperuser was previously given to firebase owner, revoking to improve database security.",
    );
    revokes.push(`REVOKE "cloudsqlsuperuser" FROM "${firebaseowner(databaseId, schema)}"`);
  }

  const user = (await getIAMUser(options)).user;
  const projectNumber = await needProjectNumber(options);
  const { user: fdcP4SAUser } = toDatabaseUser(getDataConnectP4SA(projectNumber));

  const sqlRoleSetupCmds = concat(
    // For backward compatibality we sometimes need to revoke some roles.
    revokes,

    // We shoud make sure schema exists since this setup runs prior to executing the diffs.
    [`CREATE SCHEMA IF NOT EXISTS "${schema}"`],

    // Create and setup the owner role permissions.
    ownerRolePermissions(databaseId, FIREBASE_SUPER_USER, schema),

    // Create and setup writer role permissions.
    writerRolePermissions(databaseId, FIREBASE_SUPER_USER, schema),

    // Create and setup reader role permissions.
    readerRolePermissions(databaseId, FIREBASE_SUPER_USER, schema),

    // Grant firebaseowner role to the current IAM user.
    `GRANT "${firebaseowner(databaseId, schema)}" TO "${user}"`,
    // Grant firebaswriter to the FDC P4SA user
    `GRANT "${firebasewriter(databaseId, schema)}" TO "${fdcP4SAUser}"`,

    defaultPermissions(databaseId, schema, firebaseowner(databaseId, schema)),
  );

  return sqlRoleSetupCmds;
}

export async function getSchemaMetadata(
  instanceId: string,