Reset using connectionString instead of rootConnectionString?

I am trying to “start from scratch” using graphile/migrate to manage a database. I’m making strides, but I am pretty sure there are some issues with graphile-migrate reset - it throws permissions errors when I reset the database. I’m trying to do things exactly as in starter, just writing things from scratch. here are some samples:

BEGIN;
GRANT CONNECT ON DATABASE :DATABASE_NAME TO :DATABASE_OWNER;
GRANT CONNECT ON DATABASE :DATABASE_NAME TO :DATABASE_AUTHENTICATOR;
GRANT ALL ON DATABASE :DATABASE_NAME TO :DATABASE_OWNER;

-- Some extensions require superuser privileges, so we create them before migration time.
CREATE EXTENSION IF NOT EXISTS plpgsql WITH SCHEMA pg_catalog;
CREATE EXTENSION IF NOT EXISTS "uuid-ossp" WITH SCHEMA public;
CREATE EXTENSION IF NOT EXISTS citext WITH SCHEMA public;
CREATE EXTENSION IF NOT EXISTS pgcrypto WITH SCHEMA public;
COMMIT;

  export DATABASE_URL="postgresql://${DATABASE_AUTHENTICATOR}:${DATABASE_AUTHENTICATOR_PASSWORD}@${POSTGRES_HOST}:5432/${DATABASE_NAME}"
  export SHADOW_DATABASE_URL="postgresql://${DATABASE_AUTHENTICATOR}:${DATABASE_AUTHENTICATOR_PASSWORD}@${POSTGRES_HOST}:5432/${DATABASE_NAME}_shadow"
  export ROOT_DATABASE_URL="postgresql://${DATABASE_OWNER}:${DATABASE_OWNER_PASSWORD}@${POSTGRES_HOST}/${POSTGRES_DB}"

and this is the database initialization script:

   await this.pg(`DROP DATABASE IF EXISTS "${env.DATABASE_NAME};"`);
    await this.pg(`DROP DATABASE IF EXISTS "${env.DATABASE_NAME}_shadow";`);
    await this.pg(`DROP DATABASE IF EXISTS "${env.DATABASE_NAME}_test";`);

    await this.pg(`DROP ROLE IF EXISTS "${env.DATABASE_VISITOR}";`);
    await this.pg(`DROP ROLE IF EXISTS "${env.DATABASE_AUTHENTICATOR}";`);
    await this.pg(`DROP ROLE IF EXISTS "${env.DATABASE_OWNER}";`);

    await this.pg(`CREATE ROLE "${env.DATABASE_OWNER}" WITH LOGIN PASSWORD '${env.DATABASE_OWNER_PASSWORD}' ${env.NODE_ENV == 'development' ? 'SUPERUSER' : ''};`);
    await this.pg(`CREATE ROLE "${env.DATABASE_AUTHENTICATOR}" WITH LOGIN PASSWORD '${env.DATABASE_AUTHENTICATOR_PASSWORD}' NOINHERIT;`);

    await this.pg(`CREATE ROLE "${env.DATABASE_VISITOR}";`);

    await this.pg(`GRANT "${env.DATABASE_VISITOR}" TO "${env.DATABASE_AUTHENTICATOR}";`);

Everything works correctly if I do graphile-migrate reset with connectionString being a superuser, but throws an error on “uuid-ossp” when it’s a non-superuser.

Knowing this, I can easily DATABASE_URL=$ROOT_DATABASE_URL graphile-migrate reset, but it’d be good to reset using root (right?).

Tnanks!

[abeluck]

@benjie the docs actually clearly state this:

ownerConnectionString: Connection string to use to connect to the database as a privileged user (e.g. for setting up watch fixtures, logical decoding, etc).

So, whoops! Sorry for the noise here.

Getting back on track for this issue: @dts in the context of migrate if connectionString is not superuser, then you cannot perform actions that require superuser privs. You can get around this by using a script (see my post above).

I’ve standardized on:

• postgraphile:
  • pgConfig: non-superuser (DATABASE_AUTHENTICATOR in language of the starter)
  • ownerConnectionString: superuser, with app database
• migrate:
  • connectionString: non-superuser, a user that has all privs on the database, but is not a superuser. this is the same user my node js app uses to run manual queries.
  • rootConnectionString: superuser, with database template1

[benjie]

@abeluck Beware of using rootConnectionString with template1 - if you accidentally install extensions there rather than reconnecting to your relevant database then all database created from then onwards will contain those extensions.