PM-1832 add read only user create task (#58)

* PM-1832 add invoke task to create read only db user

* PM-1832 update README with new task details

README.md

@@ -87,6 +87,10 @@ Set these environment variables for the Postgres connection:
 - `POSTGRES_USER` - Username for PostgreSQL authentication.
 - `POSTGRES_PASSWORD` - Password for the specified PostgreSQL user.
 
+> **Optional**(Used with `invoke create-ro-user` task):
+- `POSTGRES_RO_USER` - Desired username for creating read only postgres user.
+- `POSTGRES_RO_PASSWORD` - Desired password for read only postgres user.
+
 Create a database and relevant tables before first-time program execution using Python `invoke` tasks:
 
 1. **Create database and tables**:
@@ -121,6 +125,13 @@ It is possible to drop database using:
 invoke drop-database
 ```
 
+A task to create a read only user that later can be used to connect to Delegation Program database with services such as `leaderboard`.
+
+```
+invoke create-ro-user
+```
+> **Note:** This task uses `POSTGRES_RO_USER` and `POSTGRES_RO_PASSWORD` env variables.
+
 ### AWS Keyspaces/Cassandra Configuration
 
 To connect to AWS Keyspaces/Cassandra, the following environment variables need to be set:
@@ -217,4 +228,4 @@ The system's database can grow over time, but typically, keeping more than 90 da
 SELECT cleanup_old_data(180);
 ```
 
-**Note:** It is advisable to perform a database backup before initiating the cleanup process.
+**Note:** It is advisable to perform a database backup before initiating the cleanup process.

tasks.py

@@ -121,6 +121,39 @@ def init_database(ctx, batch_end_epoch=None, mins_ago=None, override_empty=False
     cursor.close()
     conn.close()
 
+@task
+def create_ro_user(ctx):
+    db_host = os.environ.get("POSTGRES_HOST")
+    db_port = os.environ.get("POSTGRES_PORT")
+    db_name = os.environ.get("POSTGRES_DB")
+    db_user = os.environ.get("POSTGRES_USER")
+    db_password = os.environ.get("POSTGRES_PASSWORD")
+    db_ro_user = os.environ.get("POSTGRES_RO_USER")
+    db_ro_password = os.environ.get("POSTGRES_RO_PASSWORD")
+
+    conn = psycopg2.connect(
+        host=db_host, port=db_port, dbname=db_name, user=db_user, password=db_password
+    )
+    cursor = conn.cursor()
+
+    # Check if the user exists
+    user_exists = False
+    cursor.execute("SELECT 1 FROM pg_roles WHERE rolname=%s;", (db_ro_user,))
+    user_exists = cursor.fetchone() is not None
+
+    if not user_exists:
+        cursor.execute(sql.SQL("CREATE USER {} WITH PASSWORD %s;").format(sql.Identifier(db_ro_user)), (db_ro_password,))
+        cursor.execute(sql.SQL("GRANT CONNECT ON DATABASE {} TO {};").format(sql.Identifier(db_name),sql.Identifier(db_ro_user)))
+        cursor.execute(sql.SQL("GRANT USAGE ON SCHEMA public TO {};").format(sql.Identifier(db_ro_user)))
+        cursor.execute(sql.SQL("GRANT SELECT ON ALL TABLES IN SCHEMA public TO {};").format(sql.Identifier(db_ro_user)))
+        cursor.execute(sql.SQL("ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO {};").format(sql.Identifier(db_ro_user)))
+        print(f"User {db_ro_user} created")
+    else:
+        print(f"User {db_ro_user} already exists")
+
+    conn.commit()
+    cursor.close()
+    conn.close()
 
 @task
 def drop_database(ctx):