view schema/run_tests.sh @ 410:3f803d64a6ee

Do not rely on session_user for authorization Privileges are usually checked based on current_user, which can be changed using SET ROLE, while session_user is based on the actually logged in user and can only be changed by a superuser using SET SESSION AUTHORIZATION. Using session_user for authorization purposes prevents the expected behaviour of SET ROLE. current_user_country() does not need to be SECURITY DEFINER since a while, because there is no RLS policy affected by what is mentioned in the removed comment.
author Tom Gottfried <tom@intevation.de>
date Wed, 15 Aug 2018 16:39:00 +0200
parents f5087cebc740
children 5611cf72cc92
line wrap: on
line source

#!/bin/sh -e

dropdb --if-exists gemma_test

./install-db.sh -d gemma_test
psql -qv ON_ERROR_STOP= -c 'CREATE EXTENSION pgtap' -d gemma_test

# Collect test roles to be dropped
# Concatenate with dummy role to prevent syntax error if there is no test role
TEST_ROLES=$(psql -qtc \
    "SELECT concat_ws(',', 'test', string_agg(rolname, ',')) FROM pg_roles
         WHERE rolname LIKE 'test%'")

# Drop test roles, add test data and run tests
psql -qXv ON_ERROR_STOP= -v -d gemma_test \
    -c 'SET client_min_messages TO WARNING' \
    -c "DROP ROLE IF EXISTS $TEST_ROLES" \
    -f tap_tests_data.sql \
    -c 'SELECT plan(45)' \
    -f auth_tests.sql \
    -f manage_users_tests.sql \
    -c 'SELECT * FROM finish()'