refacto: pg_morbac -> pgmorbac

This commit is contained in:
2026-02-22 22:24:47 +01:00
parent 2202676f54
commit 32a6a8dd17
23 changed files with 71 additions and 71 deletions
Vendored
BIN
View File
Binary file not shown.
+2 -2
View File
@@ -1,6 +1,6 @@
# Generated files # Generated files
pg_morbac.sql pgmorbac.sql
pg_morbac--*.sql pgmorbac--*.sql
# Test database dumps # Test database dumps
*.dump *.dump
+1 -1
View File
@@ -41,4 +41,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Complete documentation - Complete documentation
- Build and installation automation (Makefile, install.sh) - Build and installation automation (Makefile, install.sh)
[1.0.0]: https://github.com/yourusername/pg_morbac/releases/tag/v1.0.0 [1.0.0]: https://github.com/yourusername/pgmorbac/releases/tag/v1.0.0
+4 -4
View File
@@ -1,6 +1,6 @@
# Contributing to pg_morbac # Contributing to pgmorbac
Thank you for your interest in contributing to pg_morbac! Thank you for your interest in contributing to pgmorbac!
## How to Contribute ## How to Contribute
@@ -62,8 +62,8 @@ brew install postgresql # macOS
# or use your package manager # or use your package manager
# Clone your fork # Clone your fork
git clone https://github.com/your-username/pg_morbac.git git clone https://github.com/your-username/pgmorbac.git
cd pg_morbac cd pgmorbac
# Install the extension # Install the extension
make install make install
+1 -1
View File
@@ -1,6 +1,6 @@
MIT License MIT License
Copyright (c) 2026 pg_morbac contributors Copyright (c) 2026 pgmorbac contributors
Permission is hereby granted, free of charge, to any person obtaining a copy Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal of this software and associated documentation files (the "Software"), to deal
+3 -3
View File
@@ -1,7 +1,7 @@
# Makefile for pg_morbac PostgreSQL Extension # Makefile for pgmorbac PostgreSQL Extension
# Multi-OrBAC: Organization-Based Access Control # Multi-OrBAC: Organization-Based Access Control
PROJECT_FILENAME = pg_morbac PROJECT_FILENAME = pgmorbac
# Read version from control file using centralized script # Read version from control file using centralized script
PROJECT_VERSION = $(shell ./tools/get_version.sh $(PROJECT_FILENAME).control) PROJECT_VERSION = $(shell ./tools/get_version.sh $(PROJECT_FILENAME).control)
@@ -97,7 +97,7 @@ docker-check: docker-install
# Show help # Show help
.PHONY: help .PHONY: help
help: help:
@echo "pg_morbac Makefile - Build and manage the PostgreSQL extension" @echo "pgmorbac Makefile - Build and manage the PostgreSQL extension"
@echo "" @echo ""
@echo "Makefile targets:" @echo "Makefile targets:"
@echo " make build - Build $(OUTPUT_DEV_FILENAME) from src/" @echo " make build - Build $(OUTPUT_DEV_FILENAME) from src/"
+17 -17
View File
@@ -1,4 +1,4 @@
# pg_morbac # pgmorbac
**Multi-Organization Based Access Control for PostgreSQL** **Multi-Organization Based Access Control for PostgreSQL**
@@ -33,15 +33,15 @@ A PostgreSQL extension implementing the Multi-OrBAC access control model - enabl
```bash ```bash
# Clone repository # Clone repository
git clone https://github.com/yourusername/pg_morbac.git git clone https://github.com/yourusername/pgmorbac.git
cd pg_morbac cd pgmorbac
# Build and install extension # Build and install extension
make build # Build versioned file from src/ make build # Build versioned file from src/
sudo make install # Install to PostgreSQL sudo make install # Install to PostgreSQL
# Enable in your database # Enable in your database
psql -d mydb -c "CREATE EXTENSION pg_morbac;" psql -d mydb -c "CREATE EXTENSION pgmorbac;"
``` ```
### Alternative: Using install script ### Alternative: Using install script
@@ -58,14 +58,14 @@ sudo ./tools/install.sh
```bash ```bash
# Build versioned file from source # Build versioned file from source
make build # Concatenates src/ files into pg_morbac--1.0.0.sql make build # Concatenates src/ files into pgmorbac--1.0.0.sql
# Copy files to PostgreSQL extension directory # Copy files to PostgreSQL extension directory
sudo cp pg_morbac.control $(pg_config --sharedir)/extension/ sudo cp pgmorbac.control $(pg_config --sharedir)/extension/
sudo cp pg_morbac--1.0.0.sql $(pg_config --sharedir)/extension/ sudo cp pgmorbac--1.0.0.sql $(pg_config --sharedir)/extension/
# Enable in PostgreSQL # Enable in PostgreSQL
psql -d mydb -c "CREATE EXTENSION pg_morbac;" psql -d mydb -c "CREATE EXTENSION pgmorbac;"
``` ```
## Quick Start ## Quick Start
@@ -169,13 +169,13 @@ LIMIT 10;
# Development workflow # Development workflow
# 1. Edit source files in src/ directory # 1. Edit source files in src/ directory
# 2. Build and test # 2. Build and test
make build # Build versioned pg_morbac--X.Y.Z.sql from src/ make build # Build versioned pgmorbac--X.Y.Z.sql from src/
make test # Build and run test suite make test # Build and run test suite
# Manual testing # Manual testing
make build make build
createdb morbac_test createdb morbac_test
psql -d morbac_test -f pg_morbac.sql psql -d morbac_test -f pgmorbac.sql
# ... test manually ... # ... test manually ...
dropdb morbac_test dropdb morbac_test
``` ```
@@ -216,8 +216,8 @@ This project is licensed under the MIT License - see the [LICENSE](LICENSE) file
See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
```bash ```bash
git clone https://github.com/yourusername/pg_morbac.git git clone https://github.com/yourusername/pgmorbac.git
cd pg_morbac cd pgmorbac
# Edit source files in src/ # Edit source files in src/
vim src/authorization.sql vim src/authorization.sql
@@ -226,9 +226,9 @@ vim src/authorization.sql
make test # Run test suite make test # Run test suite
# When ready to release # When ready to release
# 1. Update version in pg_morbac.control # 1. Update version in pgmorbac.control
# 2. Build versioned file # 2. Build versioned file
make build # Creates pg_morbac--X.Y.Z.sql make build # Creates pgmorbac--X.Y.Z.sql
# 3. Tag in git # 3. Tag in git
git tag v1.0.1 git tag v1.0.1
git push --tags git push --tags
@@ -237,13 +237,13 @@ git push --tags
## Support ## Support
- Read the [documentation](docs/DOCUMENTATION.md) - Read the [documentation](docs/DOCUMENTATION.md)
- Report bugs via [GitHub Issues](https://github.com/yourusername/pg_morbac/issues) - Report bugs via [GitHub Issues](https://github.com/yourusername/pgmorbac/issues)
- Ask questions in [Discussions](https://github.com/yourusername/pg_morbac/discussions) - Ask questions in [Discussions](https://github.com/yourusername/pgmorbac/discussions)
- Security issues: see [SECURITY.md](SECURITY.md) - Security issues: see [SECURITY.md](SECURITY.md)
## Comparison with Traditional RBAC ## Comparison with Traditional RBAC
| Feature | Traditional RBAC | Traditional OrBAC | pg_morbac (Multi-OrBAC) | | Feature | Traditional RBAC | Traditional OrBAC | pgmorbac (Multi-OrBAC) |
|---------|-----------------|-------------------|-------------------------| |---------|-----------------|-------------------|-------------------------|
| Multi-tenancy | No | Single organization | Multi-organization | | Multi-tenancy | No | Single organization | Multi-organization |
| Prohibitions | No | Yes | Yes | | Prohibitions | No | Yes | Yes |
+6 -6
View File
@@ -8,7 +8,7 @@
## Security Model ## Security Model
pg_morbac implements the Multi-OrBAC access control model with the following security principles: pgmorbac implements the Multi-OrBAC access control model with the following security principles:
### Default Deny ### Default Deny
- No permission = access denied - No permission = access denied
@@ -36,7 +36,7 @@ pg_morbac implements the Multi-OrBAC access control model with the following sec
## Reporting a Vulnerability ## Reporting a Vulnerability
If you discover a security vulnerability in pg_morbac, please report it responsibly: If you discover a security vulnerability in pgmorbac, please report it responsibly:
### DO NOT ### DO NOT
- Open a public GitHub issue for security vulnerabilities - Open a public GitHub issue for security vulnerabilities
@@ -67,7 +67,7 @@ If you discover a security vulnerability in pg_morbac, please report it responsi
## Security Best Practices ## Security Best Practices
When using pg_morbac: When using pgmorbac:
### 1. Protect Authorization Headers ### 1. Protect Authorization Headers
```sql ```sql
@@ -80,7 +80,7 @@ When using pg_morbac:
-- Always enable RLS on application tables -- Always enable RLS on application tables
ALTER TABLE app.documents ENABLE ROW LEVEL SECURITY; ALTER TABLE app.documents ENABLE ROW LEVEL SECURITY;
-- Use pg_morbac for authorization -- Use pgmorbac for authorization
CREATE POLICY doc_access ON app.documents CREATE POLICY doc_access ON app.documents
FOR ALL USING (morbac.rls_check('read', 'documents')); FOR ALL USING (morbac.rls_check('read', 'documents'));
``` ```
@@ -120,7 +120,7 @@ LIMIT 100;
### 5. Regular Updates ### 5. Regular Updates
- Keep PostgreSQL updated - Keep PostgreSQL updated
- Monitor for pg_morbac security advisories - Monitor for pgmorbac security advisories
- Review and test policies regularly - Review and test policies regularly
### 6. Principle of Least Privilege ### 6. Principle of Least Privilege
@@ -138,4 +138,4 @@ LIMIT 100;
## Acknowledgments ## Acknowledgments
We appreciate responsible disclosure and will acknowledge security researchers who help improve pg_morbac security. We appreciate responsible disclosure and will acknowledge security researchers who help improve pgmorbac security.
+7 -7
View File
@@ -3,21 +3,21 @@
## Project Structure ## Project Structure
``` ```
pg_morbac/ pgmorbac/
├── src/ # Modular SQL source files ├── src/ # Modular SQL source files
├── tests/ # Test files ├── tests/ # Test files
├── tools/ # Build and test scripts ├── tools/ # Build and test scripts
├── docs/ # Documentation ├── docs/ # Documentation
├── pg_morbac.control # Version source of truth ├── pgmorbac.control # Version source of truth
├── pg_morbac.sql # Generated (git-ignored) ├── pgmorbac.sql # Generated (git-ignored)
└── Makefile # Build automation └── Makefile # Build automation
``` ```
## Version Management ## Version Management
Version is defined in `pg_morbac.control` under `default_version`. Version is defined in `pgmorbac.control` under `default_version`.
Edit source files in `src/` and commit them. Never edit or commit `pg_morbac.sql` (generated by build script). Edit source files in `src/` and commit them. Never edit or commit `pgmorbac.sql` (generated by build script).
## Development Workflow ## Development Workflow
@@ -49,14 +49,14 @@ The build script concatenates `src/` files in dependency order (header first, fo
```bash ```bash
make build make build
createdb mytest createdb mytest
psql -d mytest -f pg_morbac.sql psql -d mytest -f pgmorbac.sql
psql -d mytest psql -d mytest
dropdb mytest dropdb mytest
``` ```
## Release Process ## Release Process
1. Update version in `pg_morbac.control` 1. Update version in `pgmorbac.control`
2. Update `CHANGELOG.md` 2. Update `CHANGELOG.md`
3. Run `make build` and `make test` 3. Run `make build` and `make test`
4. Commit and tag: 4. Commit and tag:
+3 -3
View File
@@ -1,4 +1,4 @@
# pg_morbac Documentation # pgmorbac Documentation
Complete technical documentation for the Multi-OrBAC PostgreSQL extension. Complete technical documentation for the Multi-OrBAC PostgreSQL extension.
@@ -17,7 +17,7 @@ Complete technical documentation for the Multi-OrBAC PostgreSQL extension.
### Design Principles ### Design Principles
pg_morbac is built on these principles: pgmorbac is built on these principles:
1. **Pure PostgreSQL**: No external dependencies 1. **Pure PostgreSQL**: No external dependencies
2. **Schema Isolation**: All objects in `morbac` schema 2. **Schema Isolation**: All objects in `morbac` schema
@@ -834,7 +834,7 @@ SELECT EXISTS(
### Comparison: Multi-OrBAC vs Traditional RBAC ### Comparison: Multi-OrBAC vs Traditional RBAC
| Aspect | Traditional RBAC | Multi-OrBAC (pg_morbac) | | Aspect | Traditional RBAC | Multi-OrBAC (pgmorbac) |
|--------|-----------------|-------------------------| |--------|-----------------|-------------------------|
| **Multi-tenancy** | Single tenant or complex workarounds | Native multi-organization | | **Multi-tenancy** | Single tenant or complex workarounds | Native multi-organization |
| **Prohibition** | No standard support | First-class, always wins | | **Prohibition** | No standard support | First-class, always wins |
+3 -3
View File
@@ -1,10 +1,10 @@
# Performance Optimization Guide # Performance Optimization Guide
This guide explains the performance optimizations built into pg_morbac and how to use them effectively. This guide explains the performance optimizations built into pgmorbac and how to use them effectively.
## Performance Architecture ## Performance Architecture
pg_morbac includes several layers of optimization: pgmorbac includes several layers of optimization:
1. **Materialized Views**: Precomputed hierarchy transitive closures 1. **Materialized Views**: Precomputed hierarchy transitive closures
2. **Authorization Cache**: Configurable TTL cache for authorization decisions (default: 5 minutes) 2. **Authorization Cache**: Configurable TTL cache for authorization decisions (default: 5 minutes)
@@ -414,7 +414,7 @@ $$;
## Conclusion ## Conclusion
With these optimizations, pg_morbac can handle: With these optimizations, pgmorbac can handle:
- **>1000 authorization checks/second** (cached) - **>1000 authorization checks/second** (cached)
- **>100 authorization checks/second** (uncached) - **>100 authorization checks/second** (uncached)
- **Complex hierarchies** (10+ levels deep) - **Complex hierarchies** (10+ levels deep)
+1 -1
View File
@@ -2,6 +2,6 @@
# Multi-OrBAC access control model for PostgreSQL # Multi-OrBAC access control model for PostgreSQL
comment = 'Multi-OrBAC: Organization-Based Access Control with multi-organization support' comment = 'Multi-OrBAC: Organization-Based Access Control with multi-organization support'
default_version = '1.0.0' default_version = '1.0.0'
module_pathname = '$libdir/pg_morbac' module_pathname = '$libdir/pgmorbac'
relocatable = false relocatable = false
schema = morbac schema = morbac
+1 -1
View File
@@ -15,7 +15,7 @@ CREATE TABLE morbac.audit_log (
old_data JSONB, old_data JSONB,
new_data JSONB, new_data JSONB,
changed_fields TEXT[], changed_fields TEXT[],
session_user TEXT DEFAULT SESSION_USER, session_username TEXT DEFAULT SESSION_USER,
client_addr INET DEFAULT INET_CLIENT_ADDR(), client_addr INET DEFAULT INET_CLIENT_ADDR(),
application_name TEXT DEFAULT CURRENT_SETTING('application_name', true), application_name TEXT DEFAULT CURRENT_SETTING('application_name', true),
metadata JSONB DEFAULT '{}'::jsonb metadata JSONB DEFAULT '{}'::jsonb
+1 -1
View File
@@ -1,7 +1,7 @@
-- ============================================================================= -- =============================================================================
-- CONFIGURATION -- CONFIGURATION
-- ============================================================================= -- =============================================================================
-- Centralized configuration for pg_morbac extension -- Centralized configuration for pgmorbac extension
-- Edit these values to customize behavior -- Edit these values to customize behavior
CREATE TABLE morbac.config ( CREATE TABLE morbac.config (
+2 -2
View File
@@ -1,5 +1,5 @@
-- ============================================================================= -- =============================================================================
-- pg_morbac Extension -- pgmorbac Extension
-- ============================================================================= -- =============================================================================
-- Multi-OrBAC: Organization-Based Access Control with Multi-Organization Support -- Multi-OrBAC: Organization-Based Access Control with Multi-Organization Support
-- Based on the CNRS research paper on Multi-OrBAC model -- Based on the CNRS research paper on Multi-OrBAC model
@@ -14,4 +14,4 @@
-- ============================================================================= -- =============================================================================
-- Create the morbac schema -- Create the morbac schema
CREATE SCHEMA IF NOT EXISTS morbac; CREATE SCHEMA morbac;
+2 -2
View File
@@ -6,11 +6,11 @@
-- ============================================================================= -- =============================================================================
-- Clean up any previous test -- Clean up any previous test
DROP EXTENSION IF EXISTS pg_morbac CASCADE; DROP EXTENSION IF EXISTS pgmorbac CASCADE;
DROP SCHEMA IF EXISTS morbac CASCADE; DROP SCHEMA IF EXISTS morbac CASCADE;
-- Install the extension -- Install the extension
CREATE EXTENSION pg_morbac; CREATE EXTENSION pgmorbac;
-- Verify schema and tables exist -- Verify schema and tables exist
\echo '=== Schema and Tables Created ===' \echo '=== Schema and Tables Created ==='
+1 -1
View File
@@ -6,7 +6,7 @@
set -e # Exit immediately if a command exits with a non-zero status set -e # Exit immediately if a command exits with a non-zero status
SRC_DIR="${1:-src}" SRC_DIR="${1:-src}"
OUTPUT="${2:-pg_morbac.sql}" OUTPUT="${2:-pgmorbac.sql}"
if [ ! -d "$SRC_DIR" ]; then if [ ! -d "$SRC_DIR" ]; then
echo "Error: source directory not found: $SRC_DIR" >&2 echo "Error: source directory not found: $SRC_DIR" >&2
+7 -7
View File
@@ -6,7 +6,7 @@
set -e # Exit immediately if a command exits with a non-zero status set -e # Exit immediately if a command exits with a non-zero status
CONTAINER="${1:-postgres}" CONTAINER="${1:-postgres}"
PROJECT_FILENAME="${2:-pg_morbac}" PROJECT_FILENAME="${2:-pgmorbac}"
PROJECT_VERSION="${3}" PROJECT_VERSION="${3}"
if [ -z "$PROJECT_VERSION" ]; then if [ -z "$PROJECT_VERSION" ]; then
@@ -38,15 +38,15 @@ if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER}$"; then
exit 1 exit 1
fi fi
docker exec "$CONTAINER" mkdir -p /tmp/pg_morbac docker exec "$CONTAINER" mkdir -p /tmp/pgmorbac
docker cp "$CONTROL_FILE" "$CONTAINER:/tmp/pg_morbac/" docker cp "$CONTROL_FILE" "$CONTAINER:/tmp/pgmorbac/"
docker cp "$SQL_FILE" "$CONTAINER:/tmp/pg_morbac/" docker cp "$SQL_FILE" "$CONTAINER:/tmp/pgmorbac/"
docker exec "$CONTAINER" sh -c " docker exec "$CONTAINER" sh -c "
EXTDIR=\$(pg_config --sharedir)/extension EXTDIR=\$(pg_config --sharedir)/extension
cp /tmp/pg_morbac/${CONTROL_FILE} \$EXTDIR/ cp /tmp/pgmorbac/${CONTROL_FILE} \$EXTDIR/
cp /tmp/pg_morbac/${SQL_FILE} \$EXTDIR/ cp /tmp/pgmorbac/${SQL_FILE} \$EXTDIR/
rm -rf /tmp/pg_morbac rm -rf /tmp/pgmorbac
" "
echo "Installed ${PROJECT_FILENAME} v${PROJECT_VERSION} to container ${CONTAINER}" echo "Installed ${PROJECT_FILENAME} v${PROJECT_VERSION} to container ${CONTAINER}"
+5 -5
View File
@@ -32,13 +32,13 @@ docker exec "$CONTAINER" psql -U "$PG_USER" -c "DROP DATABASE IF EXISTS $DB" -q
docker exec "$CONTAINER" psql -U "$PG_USER" -c "CREATE DATABASE $DB" -q docker exec "$CONTAINER" psql -U "$PG_USER" -c "CREATE DATABASE $DB" -q
echo "Copying test files to container..." echo "Copying test files to container..."
docker exec "$CONTAINER" mkdir -p /tmp/pg_morbac_test/tools docker exec "$CONTAINER" mkdir -p /tmp/pgmorbac_test/tools
docker cp "$PROJECT_DIR/tests" "$CONTAINER:/tmp/pg_morbac_test/" docker cp "$PROJECT_DIR/tests" "$CONTAINER:/tmp/pgmorbac_test/"
docker cp "$SCRIPT_DIR/test.sh" "$CONTAINER:/tmp/pg_morbac_test/tools/" docker cp "$SCRIPT_DIR/test.sh" "$CONTAINER:/tmp/pgmorbac_test/tools/"
echo "Running tests..." echo "Running tests..."
docker exec -w /tmp/pg_morbac_test "$CONTAINER" bash tools/test.sh "$DB" "$PG_USER" docker exec -w /tmp/pgmorbac_test "$CONTAINER" bash tools/test.sh "$DB" "$PG_USER"
# Cleanup # Cleanup
docker exec "$CONTAINER" psql -U "$PG_USER" -c "DROP DATABASE $DB" -q docker exec "$CONTAINER" psql -U "$PG_USER" -c "DROP DATABASE $DB" -q
docker exec "$CONTAINER" rm -rf /tmp/pg_morbac_test docker exec "$CONTAINER" rm -rf /tmp/pgmorbac_test
+1 -1
View File
@@ -6,7 +6,7 @@
set -e # Exit immediately if a command exits with a non-zero status set -e # Exit immediately if a command exits with a non-zero status
CONTAINER="${1:-postgres}" CONTAINER="${1:-postgres}"
PROJECT_FILENAME="${2:-pg_morbac}" PROJECT_FILENAME="${2:-pgmorbac}"
if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER}$"; then if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER}$"; then
echo "Error: Docker container not running: $CONTAINER" >&2 echo "Error: Docker container not running: $CONTAINER" >&2
+1 -1
View File
@@ -5,7 +5,7 @@
set -e # Exit immediately if a command exits with a non-zero status set -e # Exit immediately if a command exits with a non-zero status
CONTROL_FILE="${1:-pg_morbac.control}" CONTROL_FILE="${1:-pgmorbac.control}"
if [ ! -f "$CONTROL_FILE" ]; then if [ ! -f "$CONTROL_FILE" ]; then
echo "Error: control file not found: $CONTROL_FILE" >&2 echo "Error: control file not found: $CONTROL_FILE" >&2
+1 -1
View File
@@ -5,7 +5,7 @@
set -e # Exit immediately if a command exits with a non-zero status set -e # Exit immediately if a command exits with a non-zero status
PROJECT_FILENAME="${1:-pg_morbac}" PROJECT_FILENAME="${1:-pgmorbac}"
PROJECT_VERSION="${2}" PROJECT_VERSION="${2}"
if ! command -v pg_config &> /dev/null; then if ! command -v pg_config &> /dev/null; then
+1 -1
View File
@@ -5,7 +5,7 @@
set -e # Exit immediately if a command exits with a non-zero status set -e # Exit immediately if a command exits with a non-zero status
PROJECT_FILENAME="${1:-pg_morbac}" PROJECT_FILENAME="${1:-pgmorbac}"
if ! command -v pg_config &> /dev/null; then if ! command -v pg_config &> /dev/null; then
echo "Error: pg_config not found" >&2 echo "Error: pg_config not found" >&2