refactor: rename bypassRls to grantBypassRls

Author: ptlc8

cdk-postgresql/lib/read-access.handler.ts

@@ -8,7 +8,7 @@ interface Props {
   Role: string;
   Schema: string;
   CreatorRoles: string[];
-  BypassRls: boolean | "true" | "false";
+  GrantBypassRls: boolean | "true" | "false";
 }
 
 export const handler = async (event: CloudFormationCustomResourceEvent) => {
@@ -22,7 +22,7 @@ export const handler = async (event: CloudFormationCustomResourceEvent) => {
   const role = quote(props.Role);
   const schema = quote(props.Schema);
   const creators = props.CreatorRoles.map(quote).join(", ");
-  const bypass = props.BypassRls === true || props.BypassRls === "true";
+  const bypass = props.GrantBypassRls === true || props.GrantBypassRls === "true";
   const client = await getConnectedClient(props.Connection);
   try {
     await client.query(`

cdk-postgresql/lib/read-access.ts

@@ -11,8 +11,10 @@ export interface ReadAccessProps {
   schema?: string;
   /** Roles that create future tables, not the reader role. Must exist. */
   creatorRoles: string[];
-  /** Grant a cluster-wide RLS exemption. Omitted/false leaves RLS attributes unchanged. */
-  bypassRls?: boolean;
+  /**
+   * Grant a cluster-wide RLS exemption. False, omission and removal do not revoke it.
+   */
+  grantBypassRls?: boolean;
 }
 
 /**
@@ -38,7 +40,7 @@ export class ReadAccess extends Construct {
         role: props.role,
         schema: props.schema ?? "public",
         creatorRoles: props.creatorRoles,
-        bypassRls: props.bypassRls ?? false,
+        grantBypassRls: props.grantBypassRls ?? false,
       },
       pascalCaseProperties: true,
       removalPolicy: cdk.RemovalPolicy.RETAIN,

cdk-postgresql/test/constructs.test.ts

@@ -23,7 +23,7 @@ test("read access reuses the provider and retains grants", () => {
     database: "appdb",
     role: "reader",
     creatorRoles: ["app", "master"],
-    bypassRls: true,
+    grantBypassRls: true,
   });
   const template = Template.fromStack(stack);
   template.hasResource("Custom::Postgresql-ReadAccess", {
@@ -35,7 +35,7 @@ test("read access reuses the provider and retains grants", () => {
       Role: "reader",
       Schema: "public",
       CreatorRoles: ["app", "master"],
-      BypassRls: true,
+      GrantBypassRls: true,
     },
   });
   template.resourceCountIs("AWS::Lambda::Function", 3);

cdk-postgresql/test/lambda.integration.test.ts

@@ -81,7 +81,7 @@ afterAll(async () => {
 // starts from a blank cluster:
 beforeEach(() => cluster.reset());
 
-test.each([true, false, undefined])("read access covers existing/RLS and future tables without writes (BypassRls: %s)", async (bypassRls) => {
+test.each([true, false, undefined])("read access covers existing/RLS and future tables without writes (GrantBypassRls: %s)", async (grantBypassRls) => {
   const client = await cluster.connectTo(DB_DEFAULT_DB);
   try {
     await client.query(`
@@ -109,7 +109,7 @@ test.each([true, false, undefined])("read access covers existing/RLS and future
         },
         Role: "reader", Schema: "public",
         CreatorRoles: ["app", DB_MASTER_USERNAME],
-        ...(bypassRls === undefined ? {} : { BypassRls: bypassRls }),
+        ...(grantBypassRls === undefined ? {} : { GrantBypassRls: grantBypassRls }),
       },
     } as CloudFormationCustomResourceEvent;
     await expect(handler({
@@ -132,16 +132,16 @@ test.each([true, false, undefined])("read access covers existing/RLS and future
     `);
     expect((await client.query(
       "SELECT rolbypassrls FROM pg_roles WHERE rolname = current_user"
-    )).rows[0].rolbypassrls).toBe(bypassRls === true);
-    expect((await client.query("SELECT * FROM public.items")).rowCount).toBe(bypassRls ? 1 : 0);
+    )).rows[0].rolbypassrls).toBe(grantBypassRls === true);
+    expect((await client.query("SELECT * FROM public.items")).rowCount).toBe(grantBypassRls ? 1 : 0);
     for (const table of ["ordinary", "from_master", "from_app"]) {
       expect((await client.query(`SELECT * FROM public.${table}`)).rowCount).toBe(1);
     }
     await expect(client.query("INSERT INTO public.items VALUES (4)")).rejects.toThrow(/permission denied/);
     await expect(client.query("UPDATE public.items SET id = 4")).rejects.toThrow(/permission denied/);
     await expect(client.query("DELETE FROM public.items")).rejects.toThrow(/permission denied/);
     await handler({ ...event, RequestType: "Delete", PhysicalResourceId: "ReadAccess" });
-    expect((await client.query("SELECT * FROM public.items")).rowCount).toBe(bypassRls ? 1 : 0);
+    expect((await client.query("SELECT * FROM public.items")).rowCount).toBe(grantBypassRls ? 1 : 0);
     expect((await client.query("SELECT * FROM public.ordinary")).rowCount).toBe(1);
   } finally {
     await client.end();