marc
ce11d1b593
Documents refresh_hierarchy_cache, is_rule_valid and org_in_scope, and corrects the get_org_scope scope list which still omitted unattributed and all. Replaces em dashes and other typographic unicode with ASCII throughout the schema comments, the test suite and the documentation. Comments and prose are ASCII only.
41 lines
1.7 KiB
PL/PgSQL
41 lines
1.7 KiB
PL/PgSQL
-- Optional whitelist of valid (activity, view) pairs.
|
|
-- If any binding exists for an activity, rules may only use listed views.
|
|
-- Activities with no bindings are unconstrained.
|
|
|
|
CREATE TABLE morbac.activity_view_bindings (
|
|
activity TEXT NOT NULL REFERENCES morbac.activities(name) ON DELETE CASCADE,
|
|
view TEXT NOT NULL REFERENCES morbac.views(name) ON DELETE CASCADE,
|
|
PRIMARY KEY (activity, view)
|
|
);
|
|
|
|
COMMENT ON TABLE morbac.activity_view_bindings IS
|
|
'Optional whitelist of valid (activity, view) pairs. Constrains rule creation on a per-activity basis.';
|
|
|
|
CREATE OR REPLACE FUNCTION morbac.trg_check_activity_view_binding()
|
|
RETURNS TRIGGER
|
|
LANGUAGE plpgsql
|
|
AS $$
|
|
BEGIN
|
|
IF EXISTS (SELECT 1 FROM morbac.activity_view_bindings WHERE activity = NEW.activity)
|
|
AND NOT EXISTS (SELECT 1 FROM morbac.activity_view_bindings WHERE activity = NEW.activity AND view = NEW.view)
|
|
THEN
|
|
RAISE EXCEPTION 'Activity "%" is not allowed on view "%" - add a binding to morbac.activity_view_bindings to permit it',
|
|
NEW.activity, NEW.view;
|
|
END IF;
|
|
RETURN NEW;
|
|
END;
|
|
$$;
|
|
|
|
COMMENT ON FUNCTION morbac.trg_check_activity_view_binding() IS
|
|
'Blocks rule creation when an activity has bindings but the target view is not among them.';
|
|
|
|
DROP TRIGGER IF EXISTS trg_activity_view_binding_check ON morbac.rules;
|
|
CREATE TRIGGER trg_activity_view_binding_check
|
|
BEFORE INSERT OR UPDATE ON morbac.rules
|
|
FOR EACH ROW EXECUTE FUNCTION morbac.trg_check_activity_view_binding();
|
|
|
|
DROP TRIGGER IF EXISTS trg_activity_view_binding_check ON morbac.cross_org_rules;
|
|
CREATE TRIGGER trg_activity_view_binding_check
|
|
BEFORE INSERT OR UPDATE ON morbac.cross_org_rules
|
|
FOR EACH ROW EXECUTE FUNCTION morbac.trg_check_activity_view_binding();
|