Update PostGIS base Docker image for Azure mock database: 12-3.1 -> 15-3.5

In PostgreSQL 15, full schema privileges must be separately granted to users
performing database migrations.

Make the JORE4 administrator role the owner of the public schema for all
databases. In PostgreSQL 12, this was the default.

Author: jarkkoka

azuredbmock/00-initialize.sql

@@ -9,6 +9,10 @@ CREATE USER xxx_db_hasura_username_xxx PASSWORD 'xxx_db_hasura_password_xxx';
 CREATE USER xxx_db_tiamat_username_xxx PASSWORD 'xxx_db_tiamat_password_xxx';
 CREATE USER xxx_db_timetables_api_username_xxx PASSWORD 'xxx_db_timetables_api_password_xxx';
 
+-- make the JORE4 admin user the owner of the public schema of the network and
+-- routes (default) database
+ALTER SCHEMA public OWNER TO CURRENT_USER;
+
 -- Create the extensions used, see https://hasura.io/docs/latest/graphql/core/deployment/postgres-requirements.html
 -- Create the extensions in the public schema, since we'd need to give additional privileges ("use schema") to any
 -- user who wishes to use these in the future. Also, Hasura would require additional setup to be able to use the
@@ -20,10 +24,28 @@ CREATE EXTENSION IF NOT EXISTS btree_gist;
 -- allow hasura to create new schemas
 GRANT CREATE ON DATABASE xxx_db_hasura_name_xxx TO xxx_db_hasura_username_xxx;
 
+-- grant select permissions on information_schema and pg_catalog to the hasura
+-- user
+GRANT SELECT ON ALL TABLES IN SCHEMA information_schema TO xxx_db_hasura_username_xxx;
+GRANT SELECT ON ALL TABLES IN SCHEMA pg_catalog TO xxx_db_hasura_username_xxx;
+
+-- grant required privileges in the public schema to the hasura user
+GRANT ALL ON SCHEMA public TO xxx_db_hasura_username_xxx;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO xxx_db_hasura_username_xxx;
+GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO xxx_db_hasura_username_xxx;
+
 -- create database for auth and give ALL privileges to auth db user
 CREATE DATABASE xxx_db_auth_name_xxx;
 GRANT ALL ON DATABASE xxx_db_auth_name_xxx TO xxx_db_auth_username_xxx;
 
+\connect xxx_db_auth_name_xxx;
+
+-- make the JORE4 admin user the owner of the public schema of the auth database
+ALTER SCHEMA public OWNER TO CURRENT_USER;
+
+-- grant full schema access to the public schema to the auth user
+GRANT ALL ON SCHEMA public TO xxx_db_auth_username_xxx;
+
 -- Make hasura role a member of jore3importer role because both roles must have
 -- ownership of tables and sequences since both are responsible for populating
 -- and truncating tables. In particular, sequence reset requires an ownership
@@ -34,6 +56,15 @@ GRANT xxx_db_jore3importer_username_xxx TO xxx_db_hasura_username_xxx;
 CREATE DATABASE xxx_db_jore3importer_name_xxx;
 GRANT ALL ON DATABASE xxx_db_jore3importer_name_xxx TO xxx_db_jore3importer_username_xxx;
 
+\connect xxx_db_jore3importer_name_xxx;
+
+-- make the JORE4 admin user the owner of the public schema of the jore3importer
+-- database
+ALTER SCHEMA public OWNER TO CURRENT_USER;
+
+-- grant usage access to the public schema to the jore3importer user
+GRANT USAGE ON SCHEMA public TO xxx_db_jore3importer_username_xxx;
+
 -- create database for timetables and allow hasura to create new schemas in it
 CREATE DATABASE xxx_db_timetables_name_xxx;
 GRANT CREATE ON DATABASE xxx_db_timetables_name_xxx TO xxx_db_hasura_username_xxx;
@@ -44,25 +75,53 @@ ALTER DATABASE xxx_db_timetables_name_xxx SET intervalstyle = 'iso_8601';
 -- switch database context to timetables db to be able to add extensions there
 \connect xxx_db_timetables_name_xxx;
 
+-- make the JORE4 admin user the owner of the public schema of the timetables
+-- database
+ALTER SCHEMA public OWNER TO CURRENT_USER;
+
 CREATE EXTENSION IF NOT EXISTS pgcrypto;
 CREATE EXTENSION IF NOT EXISTS btree_gist;
 
+-- grant select permissions on information_schema and pg_catalog to the hasura
+-- user
+GRANT SELECT ON ALL TABLES IN SCHEMA information_schema TO xxx_db_hasura_username_xxx;
+GRANT SELECT ON ALL TABLES IN SCHEMA pg_catalog TO xxx_db_hasura_username_xxx;
+
+-- grant required privileges in the public schema to the hasura user
+GRANT ALL ON SCHEMA public TO xxx_db_hasura_username_xxx;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO xxx_db_hasura_username_xxx;
+GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO xxx_db_hasura_username_xxx;
+
+-- grant usage to the public schema to the timetables-api user
+GRANT USAGE ON SCHEMA public TO xxx_db_timetables_api_username_xxx;
+
 -- create database for stop registry and give ALL privileges to Tiamat in it
 CREATE DATABASE xxx_db_tiamat_name_xxx;
 GRANT ALL ON DATABASE xxx_db_tiamat_name_xxx TO xxx_db_tiamat_username_xxx;
 
 -- switch database context to stop db to initialize it to the state where tiamat can use it
 \connect xxx_db_tiamat_name_xxx;
 
+-- make the JORE4 admin user the owner of the public schema of the stop registry
+-- database
+ALTER SCHEMA public OWNER TO CURRENT_USER;
+
 CREATE EXTENSION IF NOT EXISTS pg_trgm WITH SCHEMA public;
 CREATE EXTENSION IF NOT EXISTS postgis WITH SCHEMA public;
 
+-- grant access to the PostGIS tables and functions to the tiamat user
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO xxx_db_tiamat_username_xxx;
+GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO xxx_db_tiamat_username_xxx;
+
 CREATE SCHEMA IF NOT EXISTS topology AUTHORIZATION xxx_db_tiamat_username_xxx;
 CREATE EXTENSION IF NOT EXISTS postgis_topology WITH SCHEMA topology;
 -- the postgis_topology creates two tables
 ALTER TABLE topology.layer OWNER TO xxx_db_tiamat_username_xxx;
 ALTER TABLE topology.topology OWNER TO xxx_db_tiamat_username_xxx;
 
+-- grant full schema access to the public schema to the tiamat user
+GRANT ALL ON SCHEMA public TO xxx_db_tiamat_username_xxx;
+
 -- grant hasura user read permissions to the tiamat database
 GRANT CONNECT ON DATABASE xxx_db_tiamat_name_xxx TO xxx_db_hasura_username_xxx;
 

azuredbmock/Dockerfile

@@ -1,5 +1,5 @@
-# Builder docker image.
-FROM postgis/postgis:12-3.1
+# base Docker image
+FROM postgis/postgis:15-3.5
 
 # fix collations to use fi_FI
 RUN localedef -i fi_FI -c -f UTF-8 -A /usr/share/locale/locale.alias fi_FI.UTF-8