feat: beef up testing

Author: westonplatter

README.md

@@ -14,7 +14,8 @@ This repository serves as a child module for managing Postgres Logical Databases
 
 ### Prerequisites
 
-1. Postgres user with `LOGIN` privileges
+1. Postgres user with `LOGIN` privileges.
+2. Postgres user should have appropriate privileges for the specifiic operations you're doing. For example, if you want to create a role, your postgres user should have the `CREATEROLE` privilege.
 
 ### Example
 

main.tf

@@ -13,12 +13,12 @@ locals {
     }
   )]
 
-  _database_grants    = [for role in local._roles_with_passwords : role.database_grants if try(role.database_grants, null) != null]
-  database_grants_map = { for grant in local._database_grants : format("%s-%s", grant.role, grant.database) => grant }
-
   _default_privileges    = flatten([for role in local._roles_with_passwords : role.default_privileges if try(role.default_privileges, null) != null])
   default_privileges_map = { for grant in local._default_privileges : format("%s-%s-%s-%s", grant.role, grant.database, grant.schema, grant.object_type) => grant }
 
+  _database_grants    = [for role in local._roles_with_passwords : role.database_grants if try(role.database_grants, null) != null]
+  database_grants_map = { for grant in local._database_grants : format("%s-%s", grant.role, grant.database) => grant }
+
   _schema_grants    = [for role in local._roles_with_passwords : role.schema_grants if try(role.schema_grants, null) != null]
   schema_grants_map = { for grant in local._schema_grants : format("%s-%s-%s", grant.role, grant.schema, grant.database) => grant }
 
@@ -79,6 +79,9 @@ resource "postgresql_role" "role" {
 }
 
 resource "postgresql_default_privileges" "privileges" {
+  # Postgres documentation specific to default privileges
+  # https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html
+
   for_each = local.default_privileges_map
 
   role        = each.value.role
@@ -91,7 +94,6 @@ resource "postgresql_default_privileges" "privileges" {
   depends_on = [postgresql_database.logical_dbs, postgresql_role.role]
 }
 
-
 resource "postgresql_grant" "database_access" {
   for_each = local.database_grants_map
 

tests/main.tftest.hcl

@@ -15,13 +15,146 @@ variables {
             name = "app_user"
             password = "app_user_password"
         }
+        default_privileges = [
+          {
+            role = "app_user"
+            database = "app"
+            owner = "app_user"
+            schema = "public"
+            object_type = "schema"
+            privileges = ["ALL"]
+          },
+          {
+            role = "app_user"
+            database = "app"
+            owner = "app_user"
+            schema = "public"
+            object_type = "table"
+            objects = []
+            privileges = ["ALL"]
+          },
+          {
+            role = "app_user"
+            database = "app"
+            owner = "app_user"
+            schema = "public"
+            object_type = "sequence"
+            objects = []
+            privileges = ["ALL"]
+          }
+        ]
+        database_grants = {
+            role = "app_user"
+            database = "app2"
+            object_type = "database"
+            privileges = ["CONNECT"]
+        }
+        schema_grants = {
+          role        = "app_user"
+          database    = "app2"
+          schema      = "public"
+          object_type = "schema"
+          objects     = ["public"]
+          privileges  = ["USAGE"]
+        }
+        sequence_grants = {
+            role        = "app_user"
+            database    = "app2"
+            schema      = "public"
+            object_type = "sequence"
+            objects     = [] # all sequences
+            privileges  = ["USAGE", "SELECT"]
+        }
+        table_grants = {
+            role        = "app_user"
+            database    = "app2"
+            schema      = "public"
+            object_type = "table"
+            objects     = [] # all tables
+            privileges  = ["SELECT"]
+        }
     }, {
         role = {
             name = "app_user2"
         }
     }]
 }
 
+# -----------------------------------------------------------------------------
+# --- validate local values 
+# -----------------------------------------------------------------------------
+
+run "validate_local_default_privileges" {
+  command = apply
+
+  providers = {
+    postgresql = postgresql.mock
+  }
+
+  assert {
+    condition = local.default_privileges_map["app_user-app-public-schema"].role == "app_user"
+    error_message = "Check intermediate local values"
+  }
+}
+
+
+run "validate_local_database_grants" {
+  command = apply
+
+  providers = {
+    postgresql = postgresql.mock
+  }
+
+  assert {
+    condition = local.database_grants_map["app_user-app2"].role == "app_user"
+    error_message = "Check intermediate local values"
+  }
+}
+
+run "validate_local_schema_grants" {
+  command = apply
+
+  providers = {
+    postgresql = postgresql.mock
+  }
+
+  assert {
+    condition = local.schema_grants_map["app_user-public-app2"].role == "app_user"
+    error_message = "Check intermediate local values"
+  }
+}
+
+run "validate_local_sequence_grants" {
+  command = apply
+
+  providers = {
+    postgresql = postgresql.mock
+  }
+
+  assert {
+    condition = local.sequence_grants_map["app_user-public-app2"].role == "app_user"
+    error_message = "Check intermediate local values"
+  }
+}
+
+run "validate_local_table_grants" {
+  command = apply
+
+  providers = {
+    postgresql = postgresql.mock
+  }
+
+  assert {
+    condition = local.table_grants_map["app_user-public-app2"].role == "app_user"
+    error_message = "Check intermediate local values"
+  }
+}
+
+
+# -----------------------------------------------------------------------------
+# --- validate resources
+# -----------------------------------------------------------------------------
+
 run "validate_databases" {
   command = apply
 
@@ -75,4 +208,69 @@ run "validate_roles_with_random_password" {
     condition = alltrue([for c in ["!", "#", "$", "%", "^", "&", "*", "(", ")", "<", ">", "-", "_"] : length(split(c, postgresql_role.role["app_user2"].password)) == 1])
     error_message = "Password contains forbidden special characters"
   }
-}
+}
+
+
+run "validate_default_privileges" {
+  command = apply
+
+  providers = {
+    postgresql = postgresql.mock
+  }
+  assert {
+    condition = postgresql_default_privileges.privileges["app_user-app-public-schema"].object_type == "schema"
+    error_message = "Check intermediate local values"
+  }
+}
+
+run "validate_database_grants" {
+  command = apply
+
+  providers = {
+    postgresql = postgresql.mock
+  }
+
+  assert {
+    condition = postgresql_grant.database_access["app_user-app2"].privileges == toset(["CONNECT"])
+    error_message = "Check intermediate local values"
+  }
+}
+
+run "validate_schema_grants" {
+  command = apply
+
+  providers = {
+    postgresql = postgresql.mock
+  }
+
+  assert {
+    condition = postgresql_grant.schema_access["app_user-public-app2"].privileges == toset(["USAGE"])
+    error_message = "Check intermediate local values"
+  }
+}
+
+run "validate_sequence_grants" {
+  command = apply
+
+  providers = {
+    postgresql = postgresql.mock
+  }
+
+  assert {
+    condition = postgresql_grant.sequence_access["app_user-public-app2"].privileges == toset(["USAGE", "SELECT"])
+    error_message = "Check intermediate local values"
+  }
+}
+
+run "validate_table_grants" {
+  command = apply
+
+  providers = {
+    postgresql = postgresql.mock
+  }
+
+  assert {
+    condition = postgresql_grant.table_access["app_user-public-app2"].privileges == toset(["SELECT"])
+    error_message = "Check intermediate local values"
+  }
+}