From 29eb5dc05ff16fca2d594d619380d7cc352ef1b8 Mon Sep 17 00:00:00 2001
From: "Karl O. Pinc kop@karlpinc.com" <kop@karlpinc.com>
Date: Thu, 13 Feb 2025 20:51:18 +0000
Subject: [PATCH] The user's admin account must be used to mediate when
 becoming the user

---
 bin/sokwedb-user-delete.m4 | 36 ++++++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/bin/sokwedb-user-delete.m4 b/bin/sokwedb-user-delete.m4
index e969959..0d2ed51 100644
--- a/bin/sokwedb-user-delete.m4
+++ b/bin/sokwedb-user-delete.m4
@@ -41,49 +41,61 @@ echo '  username  The username to delete'
 # Parse command line
 export CONNECTIONSTRING='sslmode=require'
 export ADMIN=''
-export FIRSTARG=$1
-while [ "$FIRSTARG" = '-a' \
-        -o "$FIRSTARG" = '-h' \
-        -o "$FIRSTARG" = '--help' ] ; do
-  if [ "$FIRSTARG" = '-a' ] ; then
+export A_ADMINUSER=$1
+while [ "$A_ADMINUSER" = '-a' \
+        -o "$A_ADMINUSER" = '-h' \
+        -o "$A_ADMINUSER" = '--help' ] ; do
+  if [ "$A_ADMINUSER" = '-a' ] ; then
     ADMIN='-a'
     shift
-  elif [ "$FIRSTARG" = '-h' ] ; then
+  elif [ "$A_ADMINUSER" = '-h' ] ; then
     CONNECTIONSTRING="$CONNECTIONSTRING host=$2"
     shift 2
-  elif [ "$FIRSTARG" = '--help' ] ; then
+  elif [ "$A_ADMINUSER" = '--help' ] ; then
     usage
     exit 0
   fi
-  FIRSTARG=$1
+  A_ADMINUSER=$1
 done
-CONNECTIONSTRING="$CONNECTIONSTRING user=$FIRSTARG"
+CONNECTIONSTRING="$CONNECTIONSTRING user=$A_ADMINUSER"
 export A_USER=$2
 
 if [ -z "$ADMIN" ] ; then
   psql "$CONNECTIONSTRING dbname=sokwedb_dev" <<EOF
 -- We start in sokwedb_dev
 begin;
-set role pdb_role_owner;
+set role sdb_role_owner;
+grant $A_USER to $A_ADMINUSER;
+reset role;
 set role $A_USER;
 drop schema if exists $A_USER cascade;
 reset role;
+set role sdb_role_owner;
+revoke $A_USER from $A_ADMINUSER;
 reset role;
 commit;
 \c sokwedb_test
 begin;
-set role pdb_role_owner;
+set role sdb_role_owner;
+grant $A_USER to $A_ADMINUSER;
+reset role;
 set role $A_USER;
 drop schema if exists $A_USER cascade;
 reset role;
+set role sdb_role_owner;
+revoke $A_USER from $A_ADMINUSER;
 reset role;
 commit;
 \c sokwedb
 begin;
-set role pdb_role_owner;
+set role sdb_role_owner;
+grant $A_USER to $A_ADMINUSER;
+reset role;
 set role $A_USER;
 drop schema if exists $A_USER cascade;
 reset role;
+set role sdb_role_owner;
+revoke $A_USER from $A_ADMINUSER;
 drop role $A_USER;
 reset role;
 commit;
-- 
2.34.1