initial stab at an user update role and test

Makefile

@@ -1,7 +1,17 @@
-include docker.mk
+include test/test.mk
 
 PG_DUMP ?= pg_dump
 PSQL ?= psql
+SCHEMA_FILES := \
+	schema/sql/schema.sql \
+	schema/sql/access.sql \
+	schema/sql/api.sql \
+	schema/sql/metrics.sql \
+	schema/sql/nss.sql \
+	schema/sql/reserved.sql \
+	schema/sql/stats.sql \
+	schema/ext/json-schema/postgres-json-schema--0.1.0.sql \
+	out/json-schemas.sql
 
 .PHONY: help
 help:
@@ -15,44 +25,20 @@ help:
 	@echo ""
 	@$(MAKE) -s docker-help
 
-out/json-schemas.sql: schema/sql/json-schemas.sql
-	mkdir -p $(@D)
-	./scripts/build schema < "$<" > "$@"
-
 .PHONY: build
 build: out/json-schemas.sql
 
-schema/ext/json-schema/%:
-	git submodule update --init --recursive $(@D)
-
-test/sql/plpgunit/%:
-	git submodule update --init --recursive $(@D)
-
 .PHONY: fetch
 fetch: schema/ext/json-schema/ test/sql/plpgunit/
 
 .PHONY: fetch-latest
 fetch-latest:
 	git submodule foreach 'git checkout master && git pull'
 
-SCHEMA_FILES := \
-	schema/sql/schema.sql \
-	schema/sql/access.sql \
-	schema/sql/api.sql \
-	schema/sql/metrics.sql \
-	schema/sql/nss.sql \
-	schema/sql/reserved.sql \
-	schema/sql/stats.sql \
-	schema/ext/json-schema/postgres-json-schema--0.1.0.sql \
-	out/json-schemas.sql
-
 .PHONY: install
 install: $(SCHEMA_FILES)
 	$(PSQL) -v ON_ERROR_STOP=1 $(foreach file,$(SCHEMA_FILES),-f $(file));
 
-schema-dump.psql:
-	$(PG_DUMP) -s > $@
-
 .PHONY: test
 test: \
 	docker-test-build \
@@ -70,3 +56,16 @@ test-shell: \
 .PHONY: clean
 clean:
 	rm -rf out
+
+out/json-schemas.sql: schema/sql/json-schemas.sql
+	mkdir -p $(@D)
+	./scripts/build schema < "$<" > "$@"
+
+out/schema-dump.psql:
+	$(PG_DUMP) -s > $@
+
+schema/ext/json-schema/%:
+	git submodule update --init --recursive $(@D)
+
+test/sql/plpgunit/%:
+	git submodule update --init --recursive $(@D)

schema/sql/api.sql

@@ -31,6 +31,17 @@ grant usage on sequence "user_id" to "api-user-create";
 grant "api-user-create" to "api";
 grant "api-anon" to "api-user-create";
 
+create role "api-user-update";
+comment on role "api-user-update" is
+    $$Intended for use with user self-management systems$$;
+grant usage on sequence "user_id" to "api-user-create";
+grant select,insert,update,delete on table
+    public."hosts",
+    public."passwd",
+    public."ssh_public_key",
+    public."openpgp_public_key"
+to "api-user-update";
+
 create schema v1;
 grant create,usage on schema v1 to api;
 grant usage on schema v1 to "api-anon";

test/bats/test.bats

@@ -3,7 +3,7 @@ load test_helper
 
 @test "Can connect to userdb PostgreSQL" {
 	sleep 1
-	run pg_isready -U postgres -h userdb;
+	run pg_isready -U postgres -h userdb-postgres;
 	[ "$status" -eq 0 ]
 	echo "$output" | grep "accepting connections"
 }
@@ -93,3 +93,37 @@ load test_helper
 	run curl http://userdb-postgrest:3000/passwd?name=eq.testuser43
 	echo "$output" | grep "testuser43"
 }
+
+@test "Can update user with a valid update permissioned token" {
+
+	run curl http://userdb-postgrest:3000/signup \
+		-H "Content-Type: application/json" \
+		-H "Authorization: Bearer $(jwt_token 'api-user-create')" \
+		-X POST \
+		--data-binary @- <<-EOF
+			{
+				"name": "testuser43",
+				"host": "test.hashbang.sh",
+				"shell": "/bin/zsh",
+				"keys": ["$(cat bats/keys/id_ed25519.pub)"]
+			}
+			EOF
+	[ "$status" -eq 0 ]
+
+	run curl http://userdb-postgrest:3000/passwd?name=eq.testuser43
+	echo "$output" | grep "test.hashbang.sh"
+
+	run curl http://userdb-postgrest:3000/passwd?name=eq.testuser43 \
+		-H "Content-Type: application/json" \
+		-H "Authorization: Bearer $(jwt_token 'api')" \
+		-X PATCH \
+		--data-binary @- <<-EOF
+			{
+				"host": "test2.hashbang.sh",
+			}
+			EOF
+	[ "$status" -eq 0 ]
+
+	run curl http://userdb-postgrest:3000/passwd?name=eq.testuser43
+	echo "$output" | grep "test2.hashbang.sh"
+}

docker.mk → test/test.mk

@@ -1,7 +1,7 @@
 NAMESPACE ?= userdb
 POSTGRES_USER ?= postgres
 POSTGRES_DB ?= postgres
-IMAGE_POSTGRES ?= postgres:latest
+IMAGE_POSTGRES ?= postgres@sha256:3657548977d593c9ab6d70d1ffc43ceb3b5164ae07ac0f542d2ea139664eb6b3
 IMAGE_POSTGREST ?= postgrest/postgrest:v7.0.1@sha256:2a10713acc388f9a64320443e949eb87a0424ab280e68c4ed4a6d0653c001586
 
 .PHONY: docker-help
@@ -21,7 +21,8 @@ docker-start:
 	docker network inspect $(NAMESPACE) \
 	|| docker network create $(NAMESPACE)
 	# Start database
-	docker run \
+	docker inspect -f '{{.State.Running}}' $(NAMESPACE)-postgres 2>/dev/null \
+	|| docker run \
 		--detach=true \
 		--name=$(NAMESPACE)-postgres \
 		--network=$(NAMESPACE) \
@@ -53,7 +54,8 @@ docker-start:
 			$(IMAGE_POSTGRES) psql" \
 		install
 	# Start web API
-	docker run \
+	docker inspect -f '{{.State.Running}}' $(NAMESPACE)-postgrest 2>/dev/null \
+	|| docker run \
 		--rm \
 		--detach=true \
 		--name $(NAMESPACE)-postgrest \
@@ -121,3 +123,4 @@ docker-test-shell: docker-stop docker-start docker-test-build
 .PHONY: docker-test-build
 docker-test-build:
 	docker build -t local/$(NAMESPACE)-test test/
+