Skip to content

Commit a152124

Browse files
OleksiiKH0240OleksiiKH0240
committed
[drizzle-kit] updated test
1 parent 8a9b298 commit a152124

1 file changed

Lines changed: 132 additions & 36 deletions

File tree

‎drizzle-kit/tests/postgres/pg-policy.test.ts‎

Lines changed: 132 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1528,45 +1528,141 @@ test('alter policy in the table: using', async (t) => {
15281528
});
15291529

15301530
// https://github.com/drizzle-team/drizzle-orm/issues/4198
1531-
test.skip('alter policy ...', async () => {
1532-
// TODO: finish the test
1531+
test('create/alter policy for select, insert, update, delete', async () => {
15331532
const authenticatedRole = pgRole('authenticated');
1534-
const policyForSelect = pgPolicy('Access pipeline tasks based on permissions and ownership', {
1535-
as: 'permissive',
1536-
to: authenticatedRole,
1537-
for: 'select',
1538-
using: sql`
1539-
(
1540-
(SELECT auth.uid()) = "assignedUserId" OR
1541-
(SELECT auth.uid())::uuid = ANY("assignedUserIdsTeam") OR
1542-
(SELECT auth.uid()) = "createdByUserId"
1543-
)
1544-
OR
1545-
(
1546-
"driverNameForExtraInfo" = 'sales' AND
1547-
has_permission((SELECT auth.uid()), 'select::pipeline::sales2')
1548-
)
1549-
`,
1533+
1534+
const schema1 = {
1535+
authenticatedRole,
1536+
users: pgTable('users', {
1537+
id: integer('id').primaryKey(),
1538+
}, (t) => [
1539+
pgPolicy('policy 1', {
1540+
as: 'permissive',
1541+
to: authenticatedRole,
1542+
for: 'select',
1543+
using: sql`
1544+
(
1545+
(SELECT current_setting('auth.uid', true)) = 'some-user-id'
1546+
)
1547+
`,
1548+
}),
1549+
pgPolicy('policy 2', {
1550+
as: 'permissive',
1551+
to: authenticatedRole,
1552+
for: 'insert',
1553+
withCheck: sql`((SELECT current_setting('auth.uid', true)) = 'some-user-id')`,
1554+
}),
1555+
pgPolicy('policy 3', {
1556+
as: 'permissive',
1557+
to: authenticatedRole,
1558+
for: 'update',
1559+
using: sql`((SELECT current_setting('auth.uid', true)) = 'some-user-id')`,
1560+
withCheck: sql`((SELECT current_setting('auth.uid', true)) = 'some-user-id')`,
1561+
}),
1562+
pgPolicy('policy 4', {
1563+
as: 'permissive',
1564+
to: authenticatedRole,
1565+
for: 'delete',
1566+
using: sql`((SELECT current_setting('auth.uid', true)) = 'some-user-id')`,
1567+
}),
1568+
]),
1569+
};
1570+
1571+
const { sqlStatements: st1, next: n1 } = await diff({}, schema1, []);
1572+
1573+
await db.query(`SET auth.uid = 'some-user-id';`);
1574+
const { sqlStatements: pst1 } = await push({
1575+
db,
1576+
to: schema1,
1577+
entities: { roles: { include: [authenticatedRole.name] } },
15501578
});
1551-
const policyForInsert = pgPolicy('Only owners and team can insert task data', {
1552-
as: 'permissive',
1553-
to: authenticatedRole,
1554-
for: 'insert',
1555-
withCheck: sql`(SELECT auth.uid()) = "assignedUserId" OR (SELECT auth.uid())::uuid = ANY("assignedUserIdsTeam")`,
1556-
});
1557-
const policyForUpdate = pgPolicy('Only owners and team can update task data', {
1558-
as: 'permissive',
1559-
to: authenticatedRole,
1560-
for: 'update',
1561-
using: sql`(SELECT auth.uid()) = "assignedUserId" OR (SELECT auth.uid())::uuid = ANY("assignedUserIdsTeam")`,
1562-
withCheck: sql`(SELECT auth.uid()) = "assignedUserId" OR (SELECT auth.uid())::uuid = ANY("assignedUserIdsTeam")`,
1563-
});
1564-
const policyForDelete = pgPolicy('Only owners and team can delete task data', {
1565-
as: 'permissive',
1566-
to: authenticatedRole,
1567-
for: 'delete',
1568-
using: sql`(SELECT auth.uid()) = "assignedUserId" OR (SELECT auth.uid())::uuid = ANY("assignedUserIdsTeam")`,
1579+
const expectedSt1 = [
1580+
'CREATE ROLE "authenticated";',
1581+
'CREATE TABLE "users" (\n\t"id" integer PRIMARY KEY\n);\n',
1582+
'ALTER TABLE "users" ENABLE ROW LEVEL SECURITY;',
1583+
'CREATE POLICY "policy 1" ON "users" AS PERMISSIVE FOR SELECT TO "authenticated" USING (\n'
1584+
+ '(\n'
1585+
+ "\t(SELECT current_setting('auth.uid', true)) = 'some-user-id'\n"
1586+
+ ')\n'
1587+
+ ');',
1588+
`CREATE POLICY "policy 2" ON "users" AS PERMISSIVE FOR INSERT TO "authenticated" WITH CHECK (((SELECT current_setting('auth.uid', true)) = 'some-user-id'));`,
1589+
`CREATE POLICY "policy 3" ON "users" AS PERMISSIVE FOR UPDATE TO "authenticated" USING (((SELECT current_setting('auth.uid', true)) = 'some-user-id')) WITH CHECK (((SELECT current_setting('auth.uid', true)) = 'some-user-id'));`,
1590+
`CREATE POLICY "policy 4" ON "users" AS PERMISSIVE FOR DELETE TO "authenticated" USING (((SELECT current_setting('auth.uid', true)) = 'some-user-id'));`,
1591+
];
1592+
expect(st1).toStrictEqual(expectedSt1);
1593+
expect(pst1).toStrictEqual(expectedSt1);
1594+
1595+
const schema2 = {
1596+
authenticatedRole,
1597+
users: pgTable('users', {
1598+
id: integer('id').primaryKey(),
1599+
}, (t) => [
1600+
pgPolicy('policy 1', {
1601+
as: 'permissive',
1602+
to: authenticatedRole,
1603+
for: 'select',
1604+
using: sql`
1605+
(
1606+
(SELECT current_setting('auth.uid', true)) = 'some-user-id1'
1607+
)
1608+
`,
1609+
}),
1610+
pgPolicy('policy 2', {
1611+
as: 'permissive',
1612+
to: authenticatedRole,
1613+
for: 'insert',
1614+
withCheck: sql`((SELECT current_setting('auth.uid', true)) = 'some-user-id1')`,
1615+
}),
1616+
pgPolicy('policy 3', {
1617+
as: 'permissive',
1618+
to: authenticatedRole,
1619+
for: 'update',
1620+
using: sql`((SELECT current_setting('auth.uid', true)) = 'some-user-id1')`,
1621+
withCheck: sql`((SELECT current_setting('auth.uid', true)) = 'some-user-id1')`,
1622+
}),
1623+
pgPolicy('policy 4', {
1624+
as: 'permissive',
1625+
to: authenticatedRole,
1626+
for: 'delete',
1627+
using: sql`((SELECT current_setting('auth.uid', true)) = 'some-user-id1')`,
1628+
}),
1629+
]),
1630+
};
1631+
1632+
const { sqlStatements: st2, next: n2 } = await diff(n1, schema2, []);
1633+
console.log(st2);
1634+
1635+
const { sqlStatements: pst2 } = await push({
1636+
db,
1637+
to: schema2,
1638+
entities: { roles: { include: [authenticatedRole.name] } },
15691639
});
1640+
1641+
const expectedSt2 = [
1642+
'ALTER POLICY "policy 1" ON "users" TO "authenticated" USING (\n'
1643+
+ '(\n'
1644+
+ "\t(SELECT current_setting('auth.uid', true)) = 'some-user-id1'\n"
1645+
+ ')\n'
1646+
+ ');',
1647+
`ALTER POLICY "policy 2" ON "users" TO "authenticated" WITH CHECK (((SELECT current_setting('auth.uid', true)) = 'some-user-id1'));`,
1648+
`ALTER POLICY "policy 3" ON "users" TO "authenticated" USING (((SELECT current_setting('auth.uid', true)) = 'some-user-id1')) WITH CHECK (((SELECT current_setting('auth.uid', true)) = 'some-user-id1'));`,
1649+
`ALTER POLICY "policy 4" ON "users" TO "authenticated" USING (((SELECT current_setting('auth.uid', true)) = 'some-user-id1'));`,
1650+
];
1651+
expect(st2).toStrictEqual(expectedSt2);
1652+
expect(pst2).toStrictEqual(expectedSt2);
1653+
1654+
const { sqlStatements: st3 } = await diff(n2, schema2, []);
1655+
1656+
const { sqlStatements: pst3 } = await push({
1657+
db,
1658+
to: schema2,
1659+
entities: { roles: { include: [authenticatedRole.name] } },
1660+
});
1661+
1662+
expect(st3).toStrictEqual([]);
1663+
expect(pst3).toStrictEqual([]);
1664+
1665+
await db.query(`RESET auth.uid;`);
15701666
});
15711667

15721668
// https://github.com/drizzle-team/drizzle-orm/issues/4198

0 commit comments

Comments
 (0)