Is your feature request related to a problem? Please describe.
When using the --grant-to option, the schema tool applies SELECT,INSERT,UPDATE grants to tables and view as well as usage grants on sequences and exec on procedures. This gives the user the necessary permissions to ingest data as well as read/search data.
Describe the solution you'd like
Provide an additional grant option which instructs the schema tool to apply only read permissions thus preventing that user from being able to modify the database.
Describe alternatives you've considered
Manually apply the grants to the 1000+ objects we have in our schema.
Acceptance Criteria
- GIVEN a provisioned FHIR data schema
AND a valid database username or role
WHEN the schema tool is run using --grant-to username --grant-read-only--grant-read-to username
THEN the given username has only read access to the FHIR data schema.
Additional context
The target user does not necessarily have to be used as a datasource for an IBM FHIR Server. The user may be used by external systems wishing to query the IBM FHIR Server database directly.
For testing with the dev/test docker image, a new user can be added to PostgreSQL as follows:
docker exec -ti your-pg-container-name psql -d fhirdb -U postgres
CREATE USER fhirreader WITH LOGIN encrypted password 'change-password';
GRANT CONNECT ON DATABASE fhirdb TO fhirreader;
Note: for production, follow the PostgreSQL documentation to create a secure user login configuration.
Is your feature request related to a problem? Please describe.
When using the
--grant-tooption, the schema tool applies SELECT,INSERT,UPDATE grants to tables and view as well as usage grants on sequences and exec on procedures. This gives the user the necessary permissions to ingest data as well as read/search data.Describe the solution you'd like
Provide an additional grant option which instructs the schema tool to apply only read permissions thus preventing that user from being able to modify the database.
Describe alternatives you've considered
Manually apply the grants to the 1000+ objects we have in our schema.
Acceptance Criteria
AND a valid database username or role
WHEN the schema tool is run using
--grant-to username --grant-read-only--grant-read-to usernameTHEN the given username has only read access to the FHIR data schema.
Additional context
The target user does not necessarily have to be used as a datasource for an IBM FHIR Server. The user may be used by external systems wishing to query the IBM FHIR Server database directly.
For testing with the dev/test docker image, a new user can be added to PostgreSQL as follows:
Note: for production, follow the PostgreSQL documentation to create a secure user login configuration.