@@ -26,13 +26,6 @@ const convertGtfsToSql = async function* (files, opt = {}) {
2626 statsByAgencyIdAndRouteIdAndStopAndHour : 'none' ,
2727 statsActiveTripsByHour : 'none' ,
2828 schema : 'public' ,
29- postgraphile : false ,
30- postgraphilePassword : process . env . POSTGRAPHILE_PGPASSWORD || null ,
31- postgrest : false ,
32- postgrestPassword : process . env . POSTGREST_PASSWORD || null ,
33- // see https://github.com/pgexperts/pg_plan_filter
34- // see also https://www.postgresql.org/docs/14/using-explain.html
35- postgrestQueryCostLimit : null , // or float
3629 importMetadata : false ,
3730 ...opt ,
3831 }
@@ -47,16 +40,6 @@ const convertGtfsToSql = async function* (files, opt = {}) {
4740 statsByAgencyIdAndRouteIdAndStopAndHour,
4841 statsActiveTripsByHour,
4942 } = opt
50- let postgraphilePassword = opt . postgraphilePassword
51- if ( opt . postgraphile && postgraphilePassword === null ) {
52- postgraphilePassword = randomBytes ( 10 ) . toString ( 'hex' )
53- console . error ( `PostGraphile PostgreSQL user's password:` , postgraphilePassword )
54- }
55- let postgrestPassword = opt . postgrestPassword
56- if ( opt . postgrest && postgrestPassword === null ) {
57- postgrestPassword = randomBytes ( 10 ) . toString ( 'hex' )
58- console . error ( `PostrREST PostgreSQL user's password:` , postgrestPassword )
59- }
6043
6144 if ( ignoreUnsupportedFiles ) {
6245 files = files . filter ( f => ! ! formatters [ f . name ] )
@@ -255,104 +238,6 @@ LANGUAGE sql;
255238 }
256239
257240 yield `\
258-
259- ${ opt . postgraphile ? `\
260- -- seal imported data
261- -- todo:
262- -- > Be careful with public schema.It already has a lot of default privileges that you maybe don't want... See documentation[1].
263- -- > [1]: postgresql.org/docs/11/ddl-schemas.html#DDL-SCHEMAS-PRIV
264- DO $$
265- BEGIN
266- -- https://stackoverflow.com/questions/8092086/create-postgresql-role-user-if-it-doesnt-exist#8099557
267- IF EXISTS (
268- SELECT FROM pg_catalog.pg_roles
269- WHERE rolname = 'postgraphile'
270- ) THEN
271- RAISE NOTICE 'Role "postgraphile" already exists, skipping creation.';
272- ELSE
273- CREATE ROLE postgraphile LOGIN PASSWORD '${ opt . postgraphilePassword } '; -- todo: escape properly
274- END IF;
275- END
276- $$;
277- DO $$
278- DECLARE
279- db TEXT := current_database();
280- BEGIN
281- -- todo: grant just on $opt.schema instead?
282- EXECUTE format('GRANT ALL PRIVILEGES ON DATABASE %I TO %I', db, 'postgraphile');
283- END
284- $$;
285- GRANT USAGE ON SCHEMA "${ opt . schema } " TO postgraphile;
286- -- https://stackoverflow.com/questions/760210/how-do-you-create-a-read-only-user-in-postgresql#comment50679407_762649
287- REVOKE CREATE ON SCHEMA "${ opt . schema } " FROM PUBLIC;
288- GRANT SELECT ON ALL TABLES IN SCHEMA "${ opt . schema } " TO postgraphile;
289- -- ALTER DEFAULT PRIVILEGES IN SCHEMA "${ opt . schema } " GRANT SELECT ON TABLES TO postgraphile;
290- -- todo: set search_path? https://stackoverflow.com/questions/760210/how-do-you-create-a-read-only-user-in-postgresql#comment33535263_762649
291- ` : '' }
292-
293- ${ opt . postgrest ? `\
294- ${ opt . schema !== 'public' ? `\
295- -- pattern from https://stackoverflow.com/a/8099557
296- DO
297- $$
298- BEGIN
299- -- Roles are shared across databases, so we have remove previously configured privileges.
300- -- This might of course interfere with other programs running on the DBMS!
301- -- todo: find a cleaner solution
302- IF EXISTS (
303- SELECT FROM pg_catalog.pg_roles
304- WHERE rolname = 'web_anon'
305- ) THEN
306- RAISE WARNING 'Role web_anon already exists. Reassigning owned DB objects to current_user().';
307- REASSIGN OWNED BY web_anon TO SESSION_USER;
308- ELSE
309- BEGIN
310- CREATE ROLE web_anon NOLOGIN NOINHERIT;
311- EXCEPTION
312- WHEN duplicate_object THEN
313- RAISE NOTICE 'Role web_anon was just created by a concurrent transaction.';
314- END;
315- END IF;
316- IF EXISTS (
317- SELECT FROM pg_catalog.pg_roles
318- WHERE rolname = 'postgrest'
319- ) THEN
320- RAISE WARNING 'Role postgrest already exists. Reassigning owned DB objects to current_user().';
321- REASSIGN OWNED BY postgrest TO SESSION_USER;
322- ELSE
323- BEGIN
324- CREATE ROLE postgrest LOGIN NOINHERIT NOCREATEDB NOCREATEROLE NOSUPERUSER PASSWORD '${ postgrestPassword } ';
325- EXCEPTION
326- WHEN duplicate_object THEN
327- RAISE NOTICE 'Role postgrest was just created by a concurrent transaction.';
328- END;
329- END IF;
330- END
331- $$;
332-
333-
334- -- https://postgrest.org/en/stable/tutorials/tut0.html#step-4-create-database-for-api
335- -- https://postgrest.org/en/stable/explanations/db_authz.html
336- -- todo: is this secure?
337- GRANT USAGE ON SCHEMA "${ opt . schema } " TO web_anon;
338- GRANT SELECT ON ALL TABLES IN SCHEMA "${ opt . schema } " TO web_anon;
339- GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${ opt . schema } " TO web_anon;
340- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA "${ opt . schema } " TO web_anon;
341-
342- GRANT web_anon TO postgrest;
343-
344- ${ opt . postgrestQueryCostLimit !== null ? `
345- -- If pg_plan_filter is installed, limit the cost of queries made by PostgREST users.
346- ALTER USER web_anon SET plan_filter.statement_cost_limit = ${ opt . postgrestQueryCostLimit } ;
347- ` : '' }
348-
349- COMMENT ON SCHEMA "${ opt . schema } " IS
350- $$GTFS REST API
351- This REST API is created by running [PostgREST](https://postgrest.org/) on top of a [PostgreSQL](https://www.postgresql.org) DB generated using [${ pkg . name } v${ pkg . version } ](${ pkg . homepage || pkg . repository } ).
352- $$;
353- ` : '' }
354- ` : '' }
355-
356241COMMIT;`
357242}
358243
0 commit comments