Commit 39bd0b44 authored by Eric Dieckman's avatar Eric Dieckman
Browse files

fix: revise Infoblox permission seeding with nuanced IPv4/IPv6 and zone types 

Expands resource types to 21 entries and replaces the broad network/domain
seed blocks with four targeted blocks that detect IPv4 vs IPv6 networks via
subnet CIDR and forward vs reverse zones via domain name. Removes invalid
ON UPDATE utc_timestamp() syntax from datetime column defaults.
parent 92ec9efa

src/migrations/scripts/20260429_1200_AddInfobloxPermissions.sql

+61 −20
Original line number Diff line number Diff line
@@ -3,7 +3,7 @@ CREATE TABLE `ib_permission_types` ( 
  `ib_permission_type_id` bigint unsigned NOT NULL AUTO_INCREMENT,

  `name` varchar(255) NOT NULL,

  `created_at` datetime NOT NULL DEFAULT (utc_timestamp()),

  `updated_at` datetime NOT NULL DEFAULT (utc_timestamp()) ON UPDATE utc_timestamp(),

  `updated_at` datetime NOT NULL DEFAULT (utc_timestamp()),

  PRIMARY KEY (`ib_permission_type_id`),

  UNIQUE KEY `ib_permission_types_name_uniq` (`name`)

) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
@@ -17,22 +17,33 @@ CREATE TABLE `ib_resource_types` ( 
  `ib_resource_type_id` bigint unsigned NOT NULL AUTO_INCREMENT,

  `name` varchar(255) NOT NULL,

  `created_at` datetime NOT NULL DEFAULT (utc_timestamp()),

  `updated_at` datetime NOT NULL DEFAULT (utc_timestamp()) ON UPDATE utc_timestamp(),

  `updated_at` datetime NOT NULL DEFAULT (utc_timestamp()),

  PRIMARY KEY (`ib_resource_type_id`),

  UNIQUE KEY `ib_resource_types_name_uniq` (`name`)

) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;



INSERT INTO `ib_resource_types` (`name`) VALUES

  ('A record'),

  ('AAAA record'),

  ('Bulk Host'),

  ('CNAME record'),

  ('DNAME record'),

  ('Host'),

  ('IPv4 DHCP fixed address'),

  ('IPv4 Host address'),

  ('IPv4 Network'),

  ('IPv4 range'),

  ('IPv6 DHCP fixed address'),

  ('IPv6 Host address'),

  ('IPv6 Network'),

  ('IPv6 range'),

  ('MX record'),

  ('NAPTR record'),

  ('Port Control'),

  ('PTR record'),

  ('IPv4 range'),

  ('Zone'),

  ('CNAME record'),

  ('DNAME record'),

  ('Host');

  ('SRV record'),

  ('TXT record'),

  ('Zone');



-- Create ib_role_permissions junction table

CREATE TABLE `ib_role_permissions` (
@@ -42,7 +53,7 @@ CREATE TABLE `ib_role_permissions` ( 
  `ib_resource_type_id` bigint unsigned NOT NULL,

  `permission` varchar(2) NOT NULL,

  `created_at` datetime NOT NULL DEFAULT (utc_timestamp()),

  `updated_at` datetime NOT NULL DEFAULT (utc_timestamp()) ON UPDATE utc_timestamp(),

  `updated_at` datetime NOT NULL DEFAULT (utc_timestamp()),

  PRIMARY KEY (`ib_role_permission_id`),

  UNIQUE KEY `ib_role_permissions_access_type_resource_uniq` (`ib_role_access_id`, `ib_permission_type_id`, `ib_resource_type_id`),

  KEY `ib_role_permissions_ib_role_access_fk` (`ib_role_access_id`),
@@ -58,27 +69,57 @@ CREATE TABLE `ib_role_permissions` ( 
    CHECK (`permission` IN ('RO', 'RW'))

) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;



-- Seed default permissions for all existing network-based role access rows

-- Network gets: DHCP+IPAM permissions on 6 resource types, DNS permissions on 5 resource types

-- Block 1: IPv4 network access rows

-- Detected by: subnet CIDR contains no colons (IPv4 notation)

-- Permissions: DHCP+IPAM / IPv4 Network, A record, IPv4 DHCP fixed address, IPv4 Host address, Port Control, PTR record, IPv4 range

INSERT INTO `ib_role_permissions` (`ib_role_access_id`, `ib_permission_type_id`, `ib_resource_type_id`, `permission`)

SELECT ra.`ib_role_access_id`, pt.`ib_permission_type_id`, rt.`ib_resource_type_id`, 'RW'

FROM `ib_role_access` ra

JOIN `ib_networks` n ON ra.`ib_network_id` = n.`ib_network_id`

JOIN `subnets` s ON n.`subnet_id` = s.`subnet_id`

CROSS JOIN `ib_permission_types` pt

CROSS JOIN `ib_resource_types` rt

WHERE ra.`ib_network_id` IS NOT NULL

  AND (

    (pt.`name` = 'DHCP Permissions/IPAM Permissions' AND rt.`name` IN ('A record', 'IPv4 DHCP fixed address', 'IPv4 Host address', 'Port Control', 'PTR record', 'IPv4 range'))

    OR

    (pt.`name` = 'DNS Permissions' AND rt.`name` IN ('Zone', 'CNAME record', 'DNAME record', 'Host', 'PTR record'))

  );

WHERE s.`cidr` NOT LIKE '%:%'

  AND pt.`name` = 'DHCP Permissions/IPAM Permissions'

  AND rt.`name` IN ('IPv4 Network', 'A record', 'IPv4 DHCP fixed address', 'IPv4 Host address', 'Port Control', 'PTR record', 'IPv4 range');



-- Block 2: IPv6 network access rows

-- Detected by: subnet CIDR contains a colon (IPv6 notation)

-- Permissions: DHCP+IPAM / IPv6 Network, AAAA record, IPv6 DHCP fixed address, IPv6 Host address, Port Control, PTR record, IPv6 range

INSERT INTO `ib_role_permissions` (`ib_role_access_id`, `ib_permission_type_id`, `ib_resource_type_id`, `permission`)

SELECT ra.`ib_role_access_id`, pt.`ib_permission_type_id`, rt.`ib_resource_type_id`, 'RW'

FROM `ib_role_access` ra

JOIN `ib_networks` n ON ra.`ib_network_id` = n.`ib_network_id`

JOIN `subnets` s ON n.`subnet_id` = s.`subnet_id`

CROSS JOIN `ib_permission_types` pt

CROSS JOIN `ib_resource_types` rt

WHERE s.`cidr` LIKE '%:%'

  AND pt.`name` = 'DHCP Permissions/IPAM Permissions'

  AND rt.`name` IN ('IPv6 Network', 'AAAA record', 'IPv6 DHCP fixed address', 'IPv6 Host address', 'Port Control', 'PTR record', 'IPv6 range');



-- Block 3: Reverse zone domain access rows

-- Detected by: domain name ends in 'in-addr.arpa' (IPv4 reverse) or 'ip6.arpa' (IPv6 reverse)

-- Permissions: DNS Permissions / PTR record, DNAME record, CNAME record, Zone, Host

INSERT INTO `ib_role_permissions` (`ib_role_access_id`, `ib_permission_type_id`, `ib_resource_type_id`, `permission`)

SELECT ra.`ib_role_access_id`, pt.`ib_permission_type_id`, rt.`ib_resource_type_id`, 'RW'

FROM `ib_role_access` ra

JOIN `ib_domains` d ON ra.`ib_domain_id` = d.`ib_domain_id`

CROSS JOIN `ib_permission_types` pt

CROSS JOIN `ib_resource_types` rt

WHERE (d.`name` LIKE '%in-addr.arpa' OR d.`name` LIKE '%ip6.arpa')

  AND pt.`name` = 'DNS Permissions'

  AND rt.`name` IN ('PTR record', 'DNAME record', 'CNAME record', 'Zone', 'Host');



-- Seed default permissions for all existing domain-based role access rows

-- Domain gets: DNS Permissions / Zone / RW only

-- Block 4: Forward zone domain access rows

-- Detected by: domain name does not end in 'in-addr.arpa' or 'ip6.arpa'

-- Permissions: DNS Permissions / Zone, A record, DNAME record, CNAME record, Host, MX record, SRV record, AAAA record, NAPTR record, Bulk Host, TXT record

INSERT INTO `ib_role_permissions` (`ib_role_access_id`, `ib_permission_type_id`, `ib_resource_type_id`, `permission`)

SELECT ra.`ib_role_access_id`, pt.`ib_permission_type_id`, rt.`ib_resource_type_id`, 'RW'

FROM `ib_role_access` ra

JOIN `ib_domains` d ON ra.`ib_domain_id` = d.`ib_domain_id`

CROSS JOIN `ib_permission_types` pt

CROSS JOIN `ib_resource_types` rt

WHERE ra.`ib_domain_id` IS NOT NULL

WHERE d.`name` NOT LIKE '%in-addr.arpa'

  AND d.`name` NOT LIKE '%ip6.arpa'

  AND pt.`name` = 'DNS Permissions'

  AND rt.`name` = 'Zone';
 
  AND rt.`name` IN ('Zone', 'A record', 'DNAME record', 'CNAME record', 'Host', 'MX record', 'SRV record', 'AAAA record', 'NAPTR record', 'Bulk Host', 'TXT record');