diff --git a/client/renderer/templates/25_exception_safe_public_functions.erb b/client/renderer/templates/25_exception_safe_public_functions.erb new file mode 100644 index 0000000..bd479c4 --- /dev/null +++ b/client/renderer/templates/25_exception_safe_public_functions.erb @@ -0,0 +1,36 @@ +-- +-- Exception-safe public DataServices API function +-- + +CREATE OR REPLACE FUNCTION <%= DATASERVICES_CLIENT_SCHEMA %>.<%= name %>_exception_safe (<%= params_with_type_and_default.join(' ,') %>) +RETURNS <%= return_type %> AS $$ +DECLARE + <% if not multi_row %>ret <%= return_type %>;<% end %> + username text; + orgname text; +BEGIN + IF session_user = 'publicuser' OR session_user ~ 'cartodb_publicuser_*' THEN + RAISE EXCEPTION 'The api_key must be provided'; + END IF; + SELECT u, o INTO username, orgname FROM <%= DATASERVICES_CLIENT_SCHEMA %>._cdb_entity_config() AS (u text, o text); + -- JSON value stored "" is taken as literal + IF username IS NULL OR username = '' OR username = '""' THEN + RAISE EXCEPTION 'Username is a mandatory argument, check it out'; + END IF; + BEGIN + <% if multi_row %> + RETURN QUERY + SELECT * FROM <%= DATASERVICES_CLIENT_SCHEMA %>._<%= name %>(<%= ['username', 'orgname'].concat(params).join(', ') %>); + <% elsif multi_field %> + SELECT * FROM <%= DATASERVICES_CLIENT_SCHEMA %>._<%= name %>(<%= ['username', 'orgname'].concat(params).join(', ') %>) INTO ret; + RETURN ret; + <% else %> + SELECT <%= DATASERVICES_CLIENT_SCHEMA %>._<%= name %>(<%= ['username', 'orgname'].concat(params).join(', ') %>) INTO ret; + RETURN ret; + <% end %> + EXCEPTION + WHEN OTHERS THEN + RAISE WARNING 'whatever'; + END; +END; +$$ LANGUAGE 'plpgsql' SECURITY DEFINER; diff --git a/client/renderer/templates/90_grant_execute.erb b/client/renderer/templates/90_grant_execute.erb index bde5944..bb00c6b 100644 --- a/client/renderer/templates/90_grant_execute.erb +++ b/client/renderer/templates/90_grant_execute.erb @@ -1 +1,2 @@ GRANT EXECUTE ON FUNCTION <%= DATASERVICES_CLIENT_SCHEMA %>.<%= name %>(<%= params_with_type.join(', ') %>) TO publicuser; +GRANT EXECUTE ON FUNCTION <%= DATASERVICES_CLIENT_SCHEMA %>.<%= name %>_exception_safe(<%= params_with_type.join(', ') %>) TO publicuser;