airajena commented on code in PR #102:
URL:
https://github.com/apache/fineract-business-intelligence/pull/102#discussion_r4380532438
##########
docker/postgres-warehouse/initdb/002_create_warehouse_roles.sh:
##########
@@ -35,35 +41,64 @@ END
GRANT CONNECT ON DATABASE ${POSTGRES_DB} TO ${WAREHOUSE_LOADER_USER};
GRANT CONNECT ON DATABASE ${POSTGRES_DB} TO ${WAREHOUSE_READER_USER};
+GRANT CONNECT ON DATABASE ${POSTGRES_DB} TO ${WAREHOUSE_ENGINE_USER};
ALTER SCHEMA raw_views OWNER TO ${WAREHOUSE_LOADER_USER};
ALTER SCHEMA staging OWNER TO ${WAREHOUSE_LOADER_USER};
ALTER SCHEMA intermediate OWNER TO ${WAREHOUSE_LOADER_USER};
ALTER SCHEMA analytics OWNER TO ${WAREHOUSE_LOADER_USER};
GRANT USAGE ON SCHEMA raw TO ${WAREHOUSE_LOADER_USER};
+GRANT USAGE ON SCHEMA raw_shadow TO ${WAREHOUSE_LOADER_USER};
GRANT USAGE ON SCHEMA meta TO ${WAREHOUSE_LOADER_USER};
GRANT USAGE, CREATE ON SCHEMA raw_views TO ${WAREHOUSE_LOADER_USER};
GRANT USAGE, CREATE ON SCHEMA staging TO ${WAREHOUSE_LOADER_USER};
GRANT USAGE, CREATE ON SCHEMA intermediate TO ${WAREHOUSE_LOADER_USER};
GRANT USAGE, CREATE ON SCHEMA analytics TO ${WAREHOUSE_LOADER_USER};
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA raw TO
${WAREHOUSE_LOADER_USER};
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA raw_shadow TO
${WAREHOUSE_LOADER_USER};
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA meta TO
${WAREHOUSE_LOADER_USER};
Review Comment:
Fixed along the lines you suggested:
1. No direct writes: the loader has no INSERT/UPDATE/DELETE on
ingestion_ownership, cutover_approval, reconciliation_run or the audit table.
Changes go through transition_ownership, ensure_ownership_rows, approve_cutover
and run_shadow_reconciliation.
2. Admin-gated changes: the guard trigger allows assigning a table that has
never been owned. Unassigning, re-assigning a previously owned table (so
KAFKA→NONE→PYTHON) and the force path need pg_has_role(session_user,
'fbi_platform_admin', 'MEMBER'). The fbi.force_approved_by setting no longer
bypasses anything.
3. Reconciliation: shadow runs are computed and recorded by the database,
with the tolerance and settle window coming from settings. The cutover check
also requires the run to be taken after the current shadow started.
4. Audit: written by an AFTER UPDATE trigger, so a direct admin update is
audited too.
5. Registry: a source that still owns tables can't be deleted, so
delete-and-re-register can't reset ownership.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
