Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions features_api_database/infrastructure/config.py
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,10 @@ class FeaturesDBSettings(BaseSettings):
False,
description="Boolean if the RDS should be encrypted",
)
rds_deletion_protection: Optional[bool] = Field(

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This confuses me a little bit. Can you explain the maintenance operation a little more?

True,
description="Config to temporarily disable deletion protection for certain maintenance operations. Be sure to reenable after work is complete.",
)
max_allocated_storage: Optional[int] = Field(
500,
description="Upper limit to which RDS can scale the storage in GiB(Gibibyte)",
Expand Down
4 changes: 2 additions & 2 deletions features_api_database/infrastructure/construct.py
Original file line number Diff line number Diff line change
Expand Up @@ -180,8 +180,8 @@ def __init__(
"engine": engine,
"instance_type": rds_instance_type,
"vpc_subnets": self.vpc_subnets,
"deletion_protection": True,
"removal_policy": RemovalPolicy.RETAIN,
"deletion_protection": features_db_settings.rds_deletion_protection,
"removal_policy": RemovalPolicy.RETAIN_ON_UPDATE_OR_DELETE,
"publicly_accessible": features_db_settings.publicly_accessible,
"parameter_group": parameter_group,
}
Expand Down
35 changes: 15 additions & 20 deletions features_api_database/runtime/handler.py
Original file line number Diff line number Diff line change
Expand Up @@ -107,29 +107,24 @@ def create_user(cursor, username: str, password: str) -> None:

try:
# Check if user exists before
cursor.execute("SELECT rolname FROM pg_roles WHERE rolname = %s", (username,))
exists_before = cursor.fetchone() is not None
cursor.execute("SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = %s)", (username,))
exists_before = cursor.fetchone()[0]
print(f"DEBUG: User '{username}' exists before: {exists_before}")

# Create/update user
cursor.execute(
sql.SQL(
"DO $$ "
"BEGIN "
" IF NOT EXISTS ( "
" SELECT 1 FROM pg_roles "
" WHERE rolname = {user}) "
" THEN "
" CREATE USER {username} "
" WITH PASSWORD {password}; "
" ELSE "
" ALTER USER {username} "
" WITH PASSWORD {password}; "
" END IF; "
"END "
"$$; "
).format(username=sql.Identifier(username), password=sql.Identifier(password), user=sql.Identifier(username))
)
if exists_before:
cursor.execute(
sql.SQL(
"ALTER USER {username} WITH PASSWORD {password};"
).format(username=sql.Identifier(username), password=password)

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wanted to note previous concern about parameter binding + injection.

Both .format() and %s look like Python-based string interpolation (unsafe), but these are psycopg methods:

)
else:
cursor.execute(
sql.SQL(
"CREATE USER {username} WITH PASSWORD {password};"
).format(username=sql.Identifier(username), password=password)
)

print(f"DEBUG: SQL executed successfully")

# Check if user exists after
Expand Down