configure dedicated db user for database migrations: DML-only user fo…

extensions/flyway/deployment/src/test/java/io/quarkus/flyway/test/FlywayExtensionDifferentUsernameTest.java

@@ -0,0 +1,46 @@
+package io.quarkus.flyway.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+
+import javax.inject.Inject;
+import javax.sql.DataSource;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+import io.quarkus.test.QuarkusUnitTest;
+
+public class FlywayExtensionDifferentUsernameTest {
+
+ @Inject
+ DataSource datasource;
+
+ @RegisterExtension
+ static final QuarkusUnitTest config = new QuarkusUnitTest()
+ .withApplicationRoot((jar) -> jar
+
+ .addAsResource("config-for-different-username.properties", "application.properties"));
+
+ @Test
+ @DisplayName("Check if connected with new username")
+ public void testFlywayInitSql() throws SQLException {
+
+ int var = 0;
+ try (Connection con = datasource.getConnection();
+ PreparedStatement ps = con.prepareStatement("SELECT 100");
+ ResultSet rs = ps.executeQuery()) {
+ if (rs.next()) {
+ var = rs.getInt(1);
+ }
+ }
+ assertEquals(100, var, "Different username and password was not executed");
+
+ }
+
+}

extensions/flyway/deployment/src/test/resources/config-for-different-username.properties

@@ -0,0 +1,4 @@
+# Flyway config properties
+quarkus.flyway.username=sa
+quarkus.flyway.password=sa
+

extensions/flyway/runtime/src/main/java/io/quarkus/flyway/runtime/DataSourceDecorator.java

@@ -0,0 +1,72 @@
+package io.quarkus.flyway.runtime;
+
+import java.io.PrintWriter;
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.sql.SQLFeatureNotSupportedException;
+import java.util.Optional;
+import java.util.logging.Logger;
+
+import javax.sql.DataSource;
+
+public class DataSourceDecorator implements DataSource {
+
+ private DataSource dataSource;
+ private Optional<String> username;
+ private Optional<String> password;
+
+ public DataSourceDecorator(DataSource datasource, Optional<String> username, Optional<String> password) {
+
+ this.dataSource = datasource;
+ this.username = username;
+ this.password = password;
+
+ }
+
+ public PrintWriter getLogWriter() throws SQLException {
+ // TODO Auto-generated method stub
+ return dataSource.getLogWriter();
+ }
+
+ public int getLoginTimeout() throws SQLException {
+ // TODO Auto-generated method stub
+ return dataSource.getLoginTimeout();
+ }
+
+ public Logger getParentLogger() throws SQLFeatureNotSupportedException {
+ // TODO Auto-generated method stub
+ return dataSource.getParentLogger();
+ }
+
+ public void setLogWriter(PrintWriter arg0) throws SQLException {
+ // TODO Auto-generated method stub
+ dataSource.setLogWriter(arg0);
+ }
+
+ public void setLoginTimeout(int arg0) throws SQLException {
+ // TODO Auto-generated method stub
+ dataSource.setLoginTimeout(arg0);
+ }
+
+ public boolean isWrapperFor(Class<?> arg0) throws SQLException {
+ // TODO Auto-generated method stub
+ return dataSource.isWrapperFor(arg0);
+ }
+
+ public <T> T unwrap(Class<T> arg0) throws SQLException {
+ // TODO Auto-generated method stub
+ return dataSource.unwrap(arg0);
+ }
+
+ public Connection getConnection() throws SQLException {
+ // TODO Auto-generated method stub
+ return dataSource.getConnection(username.get(), password.get());
+ }
+
+ public Connection getConnection(String username, String password)
+ throws SQLException {
+ // TODO Auto-generated method stub
+ return dataSource.getConnection(username, password);
+ }
+
+}

extensions/flyway/runtime/src/main/java/io/quarkus/flyway/runtime/FlywayCreator.java

@@ -33,7 +33,13 @@ public FlywayCreator withCallbacks(Collection<Callback> callbacks) {
 
  public Flyway createFlyway(DataSource dataSource) {
  FluentConfiguration configure = Flyway.configure();
- configure.dataSource(dataSource);
+
+ if (flywayRuntimeConfig.username.isPresent() && flywayRuntimeConfig.password.isPresent()) {
+ configure.dataSource(
+ new DataSourceDecorator(dataSource, flywayRuntimeConfig.username, flywayRuntimeConfig.password));
+ } else {
+ configure.dataSource(dataSource);
+ }
  if (flywayRuntimeConfig.initSql.isPresent()) {
  configure.initSql(flywayRuntimeConfig.initSql.get());
  }

extensions/flyway/runtime/src/main/java/io/quarkus/flyway/runtime/FlywayDataSourceRuntimeConfig.java

@@ -43,6 +43,26 @@ public static FlywayDataSourceRuntimeConfig defaultConfig() {
  @ConfigItem
  public Optional<String> defaultSchema = Optional.empty();
 
+ /**
+ * This is a safety measurement against theoretical situations where the application goes haywire for any reason.
+ * This includes e.g. accidentally setting quarkus.hibernate-orm.database.generation to drop-and-create.
+ * If the application runs with a restricted database user, damage in such situations can be mitigated.
+ * # Name of a custom database user for flyway to use. Must have DDL rights
+ * quarkus.flyway.username=my_schema_owner
+ *
+ */
+
+ @ConfigItem
+ public Optional<String> username = Optional.empty();
+
+ /**
+ * Set the password for connection;
+ * quarkus.flyway.password=my_secret_password
+ */
+
+ @ConfigItem
+ public Optional<String> password = Optional.empty();
+
  /**
  * Comma-separated case-sensitive list of schemas managed by Flyway.
  * The first schema in the list will be automatically set as the default one during the migration.