safe-migrate 0.8.0

Check PostgreSQL migrations against a synchronized database baseline
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

use crate::_internal::analysis::mutations::Mutation;
use crate::_internal::analysis::state::MutationResult;
use crate::_internal::report::violations::{ObjectKind, OperationKind, Violation, ViolationTier};
use crate::_internal::rules::{Rule, RuleContext};

pub struct RestrictivePolicyRule;

impl Rule for RestrictivePolicyRule {
    fn id(&self) -> &'static str {
        "restrictive-policy"
    }
    fn default_tier(&self) -> ViolationTier {
        ViolationTier::Tier2
    }
    fn recipe(&self) -> &'static str {
        "Adding a RESTRICTIVE policy narrows access for all users. This can silently make rows invisible that were previously accessible."
    }

    fn evaluate(&self, context: &RuleContext<'_>) -> Vec<Violation> {
        if *context.result() == MutationResult::Skipped {
            return vec![];
        }
        let mut violations = Vec::new();

        if let Mutation::CreatePolicy(policy) = context.mutation()
            && !policy.permissive
        {
            violations.push(Violation {
                source_range: None,
                rule_id: self.id(),
                operation_kind: OperationKind::CreatePolicy,
                object_kind: ObjectKind::Policy,
                object_name: format!("{} on {}", policy.name, policy.table),
                tier: self.default_tier(),
                reason: format!(
                    "Adding RESTRICTIVE policy {} on {}",
                    policy.name, policy.table
                ),
                recipe: self.recipe(),
                dedup_key: None,
                sql: None,
                fk_dependency_related: false,
            });
        }

        violations
    }
}