mirror of
https://origin.cursor.com/mrdevmx/panels.git
synced 2026-10-09 18:23:22 +00:00
b87b0205a8
- Fase 0: scripts de aprovisionamiento (db/provision/) para roles, dos bases de datos separadas (panels_platform / panels_product con esquemas iam+core) y ACLs de Redis por modulo, con verificacion automatizada de aislamiento (verify-isolation.sh) y setup local reproducible (dev-local.sh). - Fase 1: changelogs de Liquibase reescritos para Postgres (db/platform, db/iam, db/core reemplazan db/app + los changesets SQLite de platform). Baseline como estado final (no replay literal), tipos traducidos (IDENTITY, TIMESTAMPTZ/DATE, NUMERIC, BOOLEAN, CITEXT), contexts dev vs. schema/catalogos, RLS por tenant_id como defensa en profundidad, uploaded_by/created_by como snapshot desnormalizado (sin FK hacia iam). - Migraciones ya no corren en el arranque de la API: paso explicito de deploy via db/update.sh con credenciales _owner. Verificado end-to-end contra Postgres 16 + Redis local. Co-authored-by: alberto.martinez <alberto.martinez@mrdev.mx>
54 lines
2.6 KiB
SQL
54 lines
2.6 KiB
SQL
-- PANELS · Postgres · Fase 0 (esquemas y privilegios dentro de panels_product)
|
|
--
|
|
-- Correr conectado A LA BASE panels_product, como superuser/admin:
|
|
-- psql "$SUPERUSER_URL/panels_product" -f 04-product-database.sql
|
|
--
|
|
-- Crea los esquemas iam/core, cada uno con su propio dueño (_owner, usado
|
|
-- por Liquibase) y su propio rol de runtime (_app, solo DML). Se revoca
|
|
-- explícitamente cualquier acceso cruzado entre iam y core: son dos
|
|
-- módulos del monolito modular que NO deben poder leerse entre sí por SQL.
|
|
|
|
REVOKE ALL ON SCHEMA public FROM PUBLIC;
|
|
|
|
CREATE SCHEMA IF NOT EXISTS iam AUTHORIZATION panels_iam_owner;
|
|
CREATE SCHEMA IF NOT EXISTS core AUTHORIZATION panels_core_owner;
|
|
|
|
-- citext (comparación case-insensitive real para curp/rfc, reemplaza el
|
|
-- COLLATE NOCASE de SQLite) se instala DENTRO del esquema core (no en
|
|
-- public, que queda sin USAGE para nadie salvo el propio superuser) --
|
|
-- así el tipo es resoluble por panels_core_owner/panels_core_app con su
|
|
-- search_path=core, sin tener que abrirles el esquema public.
|
|
CREATE EXTENSION IF NOT EXISTS citext SCHEMA core;
|
|
|
|
-- ===== iam =====
|
|
GRANT USAGE ON SCHEMA iam TO panels_iam_app;
|
|
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE panels_iam_owner IN SCHEMA iam
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO panels_iam_app;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE panels_iam_owner IN SCHEMA iam
|
|
GRANT USAGE, SELECT ON SEQUENCES TO panels_iam_app;
|
|
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA iam TO panels_iam_app;
|
|
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA iam TO panels_iam_app;
|
|
|
|
ALTER ROLE panels_iam_owner IN DATABASE panels_product SET search_path = iam;
|
|
ALTER ROLE panels_iam_app IN DATABASE panels_product SET search_path = iam;
|
|
|
|
-- ===== core =====
|
|
GRANT USAGE ON SCHEMA core TO panels_core_app;
|
|
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE panels_core_owner IN SCHEMA core
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO panels_core_app;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE panels_core_owner IN SCHEMA core
|
|
GRANT USAGE, SELECT ON SEQUENCES TO panels_core_app;
|
|
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA core TO panels_core_app;
|
|
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA core TO panels_core_app;
|
|
|
|
ALTER ROLE panels_core_owner IN DATABASE panels_product SET search_path = core;
|
|
ALTER ROLE panels_core_app IN DATABASE panels_product SET search_path = core;
|
|
|
|
-- ===== Aislamiento cruzado explícito (defensa en profundidad) =====
|
|
-- Nadie del lado "core" puede tocar "iam" y viceversa, ni por accidente.
|
|
REVOKE ALL ON SCHEMA iam FROM panels_core_app, panels_core_owner, PUBLIC;
|
|
REVOKE ALL ON SCHEMA core FROM panels_iam_app, panels_iam_owner, PUBLIC;
|