github.com/supabase/cli@v1.168.1/internal/utils/templates/globals.sql (about)

     1  --
     2  -- PostgreSQL database cluster dump
     3  --
     4  
     5  SET default_transaction_read_only = off;
     6  
     7  SET client_encoding = 'UTF8';
     8  SET standard_conforming_strings = on;
     9  
    10  --
    11  -- Roles
    12  --
    13  
    14  CREATE ROLE anon;
    15  ALTER ROLE anon WITH NOSUPERUSER NOINHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION NOBYPASSRLS;
    16  CREATE ROLE authenticated;
    17  ALTER ROLE authenticated WITH NOSUPERUSER NOINHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION NOBYPASSRLS;
    18  CREATE ROLE authenticator;
    19  ALTER ROLE authenticator WITH NOSUPERUSER NOINHERIT NOCREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'postgres';
    20  CREATE ROLE dashboard_user;
    21  ALTER ROLE dashboard_user WITH NOSUPERUSER INHERIT CREATEROLE CREATEDB NOLOGIN REPLICATION NOBYPASSRLS;
    22  CREATE ROLE pgbouncer;
    23  ALTER ROLE pgbouncer WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'postgres';
    24  -- CREATE ROLE pgsodium_keyholder;
    25  -- ALTER ROLE pgsodium_keyholder WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION NOBYPASSRLS;
    26  -- CREATE ROLE pgsodium_keyiduser;
    27  -- ALTER ROLE pgsodium_keyiduser WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION NOBYPASSRLS;
    28  -- CREATE ROLE pgsodium_keymaker;
    29  -- ALTER ROLE pgsodium_keymaker WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION NOBYPASSRLS;
    30  -- CREATE ROLE postgres;
    31  -- ALTER ROLE postgres WITH NOSUPERUSER INHERIT CREATEROLE CREATEDB LOGIN REPLICATION BYPASSRLS;
    32  CREATE ROLE service_role;
    33  ALTER ROLE service_role WITH NOSUPERUSER NOINHERIT NOCREATEROLE NOCREATEDB NOLOGIN NOREPLICATION BYPASSRLS;
    34  CREATE ROLE supabase_admin;
    35  ALTER ROLE supabase_admin WITH SUPERUSER INHERIT CREATEROLE CREATEDB LOGIN REPLICATION BYPASSRLS PASSWORD 'postgres';
    36  CREATE ROLE supabase_auth_admin;
    37  ALTER ROLE supabase_auth_admin WITH NOSUPERUSER NOINHERIT CREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'postgres';
    38  CREATE ROLE supabase_functions_admin;
    39  ALTER ROLE supabase_functions_admin WITH NOSUPERUSER NOINHERIT CREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'postgres';
    40  CREATE ROLE supabase_read_only_user;
    41  ALTER ROLE supabase_read_only_user WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB LOGIN NOREPLICATION BYPASSRLS PASSWORD 'postgres';
    42  CREATE ROLE supabase_replication_admin;
    43  ALTER ROLE supabase_replication_admin WITH NOSUPERUSER INHERIT NOCREATEROLE NOCREATEDB LOGIN REPLICATION NOBYPASSRLS PASSWORD 'postgres';
    44  CREATE ROLE supabase_storage_admin;
    45  ALTER ROLE supabase_storage_admin WITH NOSUPERUSER NOINHERIT CREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'postgres';
    46  
    47  --
    48  -- User Configurations
    49  --
    50  
    51  --
    52  -- User Config "anon"
    53  --
    54  
    55  ALTER ROLE anon SET statement_timeout TO '3s';
    56  
    57  --
    58  -- User Config "authenticated"
    59  --
    60  
    61  ALTER ROLE authenticated SET statement_timeout TO '8s';
    62  
    63  --
    64  -- User Config "authenticator"
    65  --
    66  
    67  ALTER ROLE authenticator SET session_preload_libraries TO 'safeupdate';
    68  ALTER ROLE authenticator SET statement_timeout TO '8s';
    69  
    70  --
    71  -- User Config "postgres"
    72  --
    73  
    74  ALTER ROLE postgres SET search_path TO E'\\$user', 'public', 'extensions';
    75  
    76  --
    77  -- User Config "supabase_admin"
    78  --
    79  
    80  ALTER ROLE supabase_admin SET search_path TO E'\\$user', 'public', 'auth', 'extensions';
    81  
    82  --
    83  -- User Config "supabase_auth_admin"
    84  --
    85  
    86  ALTER ROLE supabase_auth_admin SET search_path TO 'auth';
    87  ALTER ROLE supabase_auth_admin SET idle_in_transaction_session_timeout TO '60000';
    88  
    89  --
    90  -- User Config "supabase_functions_admin"
    91  --
    92  
    93  ALTER ROLE supabase_functions_admin SET search_path TO 'supabase_functions';
    94  
    95  --
    96  -- User Config "supabase_storage_admin"
    97  --
    98  
    99  ALTER ROLE supabase_storage_admin SET search_path TO 'storage';
   100  
   101  
   102  --
   103  -- Role memberships
   104  --
   105  
   106  GRANT anon TO authenticator GRANTED BY postgres;
   107  GRANT anon TO postgres GRANTED BY supabase_admin;
   108  GRANT anon TO supabase_storage_admin GRANTED BY supabase_admin;
   109  GRANT authenticated TO authenticator GRANTED BY postgres;
   110  GRANT authenticated TO postgres GRANTED BY supabase_admin;
   111  GRANT authenticated TO supabase_storage_admin GRANTED BY supabase_admin;
   112  GRANT pg_monitor TO postgres GRANTED BY supabase_admin;
   113  -- GRANT pg_read_all_data TO supabase_read_only_user GRANTED BY postgres;
   114  -- GRANT pgsodium_keyholder TO pgsodium_keymaker GRANTED BY postgres;
   115  -- GRANT pgsodium_keyholder TO postgres WITH ADMIN OPTION GRANTED BY postgres;
   116  -- GRANT pgsodium_keyiduser TO pgsodium_keyholder GRANTED BY postgres;
   117  -- GRANT pgsodium_keyiduser TO pgsodium_keymaker GRANTED BY postgres;
   118  -- GRANT pgsodium_keyiduser TO postgres WITH ADMIN OPTION GRANTED BY postgres;
   119  -- GRANT pgsodium_keymaker TO postgres WITH ADMIN OPTION GRANTED BY postgres;
   120  GRANT service_role TO authenticator GRANTED BY postgres;
   121  GRANT service_role TO postgres GRANTED BY supabase_admin;
   122  GRANT service_role TO supabase_storage_admin GRANTED BY supabase_admin;
   123  GRANT supabase_auth_admin TO postgres GRANTED BY supabase_admin;
   124  GRANT supabase_functions_admin TO postgres GRANTED BY supabase_admin;
   125  GRANT supabase_storage_admin TO postgres GRANTED BY supabase_admin;
   126  
   127  
   128  
   129  
   130  --
   131  -- PostgreSQL database cluster dump complete
   132  --
   133  
   134  DO $$
   135  BEGIN
   136      -- role pg_read_all_data is not available on pg13
   137      IF EXISTS (
   138          SELECT FROM pg_catalog.pg_roles
   139          WHERE rolname = 'pg_read_all_data'
   140      ) THEN
   141          GRANT pg_read_all_data TO supabase_read_only_user GRANTED BY postgres;
   142      END IF;
   143  END
   144  $$;
   145  
   146  RESET ALL;