Merge remote-tracking branch 'github/pull/704'

[chef.git] / cookbooks / postgresql / resources / user.rb

diff --git a/cookbooks/postgresql/resources/user.rb b/cookbooks/postgresql/resources/user.rb
index 0bfc80536c9c14293c57520fb106941afa60ff8f..6d0e07e4794299fcd627f40f8d6d48012824251c 100644 (file)
--- a/cookbooks/postgresql/resources/user.rb
+++ b/cookbooks/postgresql/resources/user.rb
@@ -1,8 +1,8 @@
 #
 #

-# Cookbook Name:: postgresql
+# Cookbook:: postgresql

 # Resource:: postgresql_user
 #
 # Resource:: postgresql_user
 #

-# Copyright 2012, OpenStreetMap Foundation
+# Copyright:: 2012, OpenStreetMap Foundation

 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.


@@ -19,15 +19,18 @@
 
 require "shellwords"
 
 
 require "shellwords"
 

+unified_mode true
+

 default_action :create
 
 default_action :create
 

-property :user, :kind_of => String, :name_attribute => true
+property :user, :kind_of => String, :name_property => true

 property :cluster, :kind_of => String, :required => true
 property :password, :kind_of => String
 property :cluster, :kind_of => String, :required => true
 property :password, :kind_of => String

-property :superuser, :default => false
-property :createdb, :default => false
-property :createrole, :default => false
-property :replication, :default => false
+property :superuser, :kind_of => [TrueClass, FalseClass], :default => false
+property :createdb, :kind_of => [TrueClass, FalseClass], :default => false
+property :createrole, :kind_of => [TrueClass, FalseClass], :default => false
+property :replication, :kind_of => [TrueClass, FalseClass], :default => false
+property :roles, :kind_of => [String, Array]

 
 action :create do
   password = new_resource.password ? "ENCRYPTED PASSWORD '#{new_resource.password.shellescape}'" : ""
 
 action :create do
   password = new_resource.password ? "ENCRYPTED PASSWORD '#{new_resource.password.shellescape}'" : ""


@@ -40,6 +43,12 @@ action :create do
     converge_by "create role #{new_resource.user}" do
       cluster.execute(:command => "CREATE ROLE \"#{new_resource.user}\" LOGIN #{password} #{superuser} #{createdb} #{createrole}")
     end
     converge_by "create role #{new_resource.user}" do
       cluster.execute(:command => "CREATE ROLE \"#{new_resource.user}\" LOGIN #{password} #{superuser} #{createdb} #{createrole}")
     end

+
+    Array(new_resource.roles).each do |role|
+      converge_by "grant #{role} to #{new_resource.user}" do
+        cluster.execute(:command => "GRANT \"#{role}\" TO \"#{new_resource.user}\"")
+      end
+    end

   else
     current_user = cluster.users[new_resource.user]
 
   else
     current_user = cluster.users[new_resource.user]
 


@@ -68,6 +77,24 @@ action :create do
         end
       end
     end
         end
       end
     end

+
+    roles = Array(new_resource.roles)
+
+    roles.each do |role|
+      next if current_user[:roles].include?(role)
+
+      converge_by "grant #{role} to #{new_resource.user}" do
+        cluster.execute(:command => "GRANT \"#{role}\" TO \"#{new_resource.user}\"")
+      end
+    end
+
+    current_user[:roles].each do |role|
+      next if roles.include?(role)
+
+      converge_by "revoke #{role} from #{new_resource.user}" do
+        cluster.execute(:command => "REVOKE \"#{role}\" FROM \"#{new_resource.user}\"")
+      end
+    end

   end
 end
 
   end
 end