[postgres] give ingest access to the encryption_keys table

postgresql/initdb.d/01_main.sql

@@ -29,7 +29,8 @@ VALUES (0, now(), 'Created with version'),
        (12, now(), 'Add key hash'),
        (13, now(), 'Create API user'),
        (14, now(), 'Create Auth user'),
-       (15, now(), 'Give API user insert priviledge in logs table');
+       (15, now(), 'Give API user insert priviledge in logs table'),
+       (16, now(), 'Give ingest user select priviledge in encryption_keys table');
 
 -- Datasets are used to group files, and permissions are set on the dataset
 -- level

postgresql/initdb.d/04_grants.sql

@@ -43,6 +43,7 @@ GRANT USAGE, SELECT ON SEQUENCE sda.checksums_id_seq TO ingest;
 GRANT INSERT ON sda.file_event_log TO ingest;
 GRANT SELECT ON sda.file_event_log TO ingest;
 GRANT USAGE, SELECT ON SEQUENCE sda.file_event_log_id_seq TO ingest;
+GRANT SELECT ON sda.encryption_keys TO ingest;
 
 -- legacy schema
 GRANT USAGE ON SCHEMA local_ega TO ingest;

postgresql/migratedb.d/16.sql

@@ -0,0 +1,21 @@
+
+DO
+$$
+DECLARE
+-- The version we know how to do migration from, at the end of a successful migration
+-- we will no longer be at this version.
+  sourcever INTEGER := 15;
+  changes VARCHAR := 'Give ingest user select priviledge in encryption_keys table';
+BEGIN
+  IF (select max(version) from sda.dbschema_version) = sourcever then
+    RAISE NOTICE 'Doing migration from schema version % to %', sourcever, sourcever+1;
+    RAISE NOTICE 'Changes: %', changes;
+    INSERT INTO sda.dbschema_version VALUES(sourcever+1, now(), changes);
+
+    GRANT SELECT ON sda.encryption_keys TO ingest;
+
+  ELSE
+    RAISE NOTICE 'Schema migration from % to % does not apply now, skipping', sourcever, sourcever+1;
+  END IF;
+END
+$$