|
1 | | -grant usage on schema vault to postgres with grant option; |
2 | | -grant select, delete, truncate, references on vault.secrets, vault.decrypted_secrets to postgres with grant option; |
3 | | -grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to postgres with grant option; |
| 1 | +do $$ |
| 2 | +declare |
| 3 | + extversion text := (select extversion from pg_extension where extname = 'supabase_vault'); |
| 4 | +begin |
| 5 | + set local search_path = ''; |
4 | 6 |
|
5 | | --- service_role used to be able to manage secrets in Vault <=0.2.8 because it had privileges to pgsodium functions |
6 | | -grant usage on schema vault to service_role; |
7 | | -grant select, delete on vault.secrets, vault.decrypted_secrets to service_role; |
8 | | -grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to service_role; |
| 7 | + if extversion != '0.2.8' then |
| 8 | + grant usage on schema vault to postgres with grant option; |
| 9 | + grant select, delete, truncate, references on vault.secrets, vault.decrypted_secrets to postgres with grant option; |
| 10 | + grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to postgres with grant option; |
| 11 | + |
| 12 | + -- service_role used to be able to manage secrets in Vault <=0.2.8 because it had privileges to pgsodium functions |
| 13 | + grant usage on schema vault to service_role; |
| 14 | + grant select, delete on vault.secrets, vault.decrypted_secrets to service_role; |
| 15 | + grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to service_role; |
| 16 | + end if; |
| 17 | +end $$; |
0 commit comments