Add new databases new users new roles with selective permission

scripts/postgres_data/create_sql/createDB.sql

@@ -0,0 +1,8 @@
+-- database to store metadata about datasets
+CREATE DATABASE datasetDB;
+-- database to store metadata about file registry from datasets
+CREATE DATABASE fileDB;
+-- database to store metadata about tool registry
+CREATE DATABASE toolDB;
+-- database to store metadata about user usage and query
+CREATE DATABASE userDB;

scripts/postgres_data/create_sql/datasetDBconfig.sql

@@ -0,0 +1,41 @@
+-- ---------------------------
+-- DATABASE 1 – Dataset / FAIR, connect to datasetDB first
+-- ---------------------------
+\c datasetDB
+
+-- Create roles
+CREATE ROLE datasetDB_read;
+CREATE ROLE datasetDB_readwrite;
+CREATE ROLE datasetDB_admin;
+
+GRANT CONNECT ON DATABASE datasetDB TO datasetDB_read, datasetDB_readwrite, datasetDB_admin;
+
+-- READ
+GRANT USAGE ON SCHEMA public TO datasetDB_read;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO datasetDB_read;
+
+-- READWRITE
+GRANT USAGE, CREATE ON SCHEMA public TO datasetDB_readwrite;
+GRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA public TO datasetDB_readwrite;
+
+-- ADMIN
+GRANT ALL PRIVILEGES ON DATABASE datasetDB TO datasetDB_admin;
+GRANT ALL PRIVILEGES ON SCHEMA public TO datasetDB_admin;
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO datasetDB_admin;
+
+-- Future tables inherit permissions
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT SELECT ON TABLES TO datasetDB_read;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT SELECT, INSERT, UPDATE ON TABLES TO datasetDB_readwrite;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT ALL ON TABLES TO datasetDB_admin;
+
+-- Read
+GRANT datasetDB_read TO reggie, jusong, ritwik;
+-- Read/Write, script cannot delete important
+GRANT datasetDB_readwrite TO script;
+-- Admin
+GRANT datasetDB_admin TO tobias, josip, michal, ping, vincent;

scripts/postgres_data/create_sql/fileDBconfig.sql

@@ -0,0 +1,43 @@
+-- ---------------------------
+-- DATABASE 2 – File Registry, connect to fileDB first
+-- ---------------------------
+\c fileDB
+
+-- Create roles
+CREATE ROLE fileDB_read;
+CREATE ROLE fileDB_readwrite;
+CREATE ROLE fileDB_admin;
+
+GRANT CONNECT ON DATABASE fileDB TO fileDB_read, fileDB_readwrite, fileDB_admin;
+
+-- READ
+GRANT USAGE ON SCHEMA public TO fileDB_read;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO fileDB_read;
+
+-- READWRITE
+GRANT USAGE, CREATE ON SCHEMA public TO fileDB_readwrite;
+GRANT SELECT, INSERT, UPDATE ON ALL TABLES TO fileDB_readwrite;
+
+-- ADMIN
+GRANT ALL PRIVILEGES ON DATABASE fileDB TO fileDB_admin;
+GRANT ALL PRIVILEGES ON SCHEMA public TO fileDB_admin;
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO fileDB_admin;
+
+-- Future tables
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT SELECT ON TABLES TO fileDB_read;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT SELECT, INSERT, UPDATE ON TABLES TO fileDB_readwrite;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT ALL ON TABLES TO fileDB_admin;
+
+-- Read
+GRANT fileDB_read TO tobias, josip, ping, vincent, ritwik;
+
+-- Read/Write, script cannot delete important
+GRANT fileDB_readwrite TO script;
+
+-- Admin
+GRANT fileDB_admin TO michal, reggie, jusong, eko;

scripts/postgres_data/create_sql/toolDBconfig.sql

@@ -0,0 +1,42 @@
+-- ---------------------------
+-- DATABASE 3 – Tool Registry, connect to toolDB first
+-- ---------------------------
+/c toolDB
+-- Create roles
+CREATE ROLE toolDB__read;
+CREATE ROLE toolDB__readwrite;
+CREATE ROLE toolDB__admin;
+
+GRANT CONNECT ON DATABASE toolDB TO toolDB_read, toolDB_readwrite, toolDB_admin;
+
+-- READ
+GRANT USAGE ON SCHEMA public TO toolDB_read;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO toolDB_read;
+
+-- READWRITE
+GRANT USAGE, CREATE ON SCHEMA public TO toolDB_readwrite;
+GRANT SELECT, INSERT, UPDATE ON ALL TABLES TO toolDB_readwrite;
+
+-- ADMIN
+GRANT ALL PRIVILEGES ON DATABASE toolDB TO toolDB_admin;
+GRANT ALL PRIVILEGES ON SCHEMA public TO toolDB_admin;
+GRANT ALL PRIVILEGES ON ALL TABLES TO toolDB_admin;
+
+-- Future tables
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT SELECT ON TABLES TO toolDB_read;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT SELECT, INSERT, UPDATE ON TABLES TO toolDB_readwrite;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT ALL ON TABLES TO toolDB_admin;
+
+-- Read
+GRANT toolDB__read TO tobias, josip, ping, vincent, ritwik;
+
+-- Read/Write, script cannot delete important
+GRANT toolDB__readwrite TO script;
+
+-- Admin
+GRANT toolDB__admin TO michal, jusong, reggie, eko;

scripts/postgres_data/create_sql/user.sql

@@ -0,0 +1,15 @@
+---------------------------------------------------------
+-- CREATE GOLOBAL USERS
+
+CREATE ROLE reggie LOGIN PASSWORD 'reggie';
+CREATE ROLE jusong LOGIN PASSWORD 'jusong';
+CREATE ROLE ritwik LOGIN PASSWORD 'ritwik';
+CREATE ROLE tobias LOGIN PASSWORD 'tobias';
+CREATE ROLE josip LOGIN PASSWORD 'josip';
+CREATE ROLE michal LOGIN PASSWORD 'michal';
+CREATE ROLE ping LOGIN PASSWORD 'ping';
+CREATE ROLE vincent LOGIN PASSWORD 'vincent';
+CREATE ROLE eko LOGIN PASSWORD 'eko';
+
+-- System service accounts
+CREATE ROLE script LOGIN PASSWORD 'script';

scripts/postgres_data/create_sql/userDBconfig.sql

@@ -0,0 +1,44 @@
+
+-- ---------------------------
+-- DATABASE 4 – User History, connect to userDB first
+-- ---------------------------
+/c userDB
+
+-- Create roles
+CREATE ROLE userDB_read;
+CREATE ROLE userDB_readwrite;
+CREATE ROLE userDB_admin;
+
+GRANT CONNECT ON DATABASE userDB TO userDB_read, userDB_readwrite, userDB_admin;
+
+-- READ
+GRANT USAGE ON SCHEMA public TO userDB_read;
+GRANT SELECT ON ALL TABLES TO userDB_read;
+
+-- READWRITE
+GRANT USAGE, CREATE ON SCHEMA public TO userDB_readwrite;
+GRANT SELECT, INSERT, UPDATE ON ALL TABLES TO userDB_readwrite;
+
+-- ADMIN
+GRANT ALL PRIVILEGES ON DATABASE userDB TO userDB_admin;
+GRANT ALL PRIVILEGES ON SCHEMA public TO userDB_admin;
+GRANT ALL PRIVILEGES ON ALL TABLES TO userDB_admin;
+
+-- Future tables
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT SELECT ON TABLES TO userDB_read;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT SELECT, INSERT, UPDATE ON TABLES TO userDB_readwrite;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+GRANT ALL ON TABLES TO userDB_admin;
+
+-- Read
+GRANT userDB_read TO jusong, reggie, josip, tobias;
+
+-- Read/Write, script cannot delete important
+GRANT userDB_readwrite TO script;
+
+-- Admin
+GRANT userDB_admin TO michal, vincent, ritwik, ping;