ores.sql.service
Table of Contents
This page is the node for the ores.sql.service facet of the codegen
template library, part of the ores.sql technical space. Each archetype
below is documented, and holds its mustache source, in its own
linked page — this page is the facet-level summary and the routing
table to them.
Summary
Four templates projecting the service registry onto IAM SQL: one
PostgreSQL login role per service, the DML grants those roles need,
and the matching IAM application accounts with their role assignments.
All four belong to the service-registry profile, with outputs under
projects/ores.sql/create/iam/ and populate/iam/.
The ores.sql.service facet
Driven by the service registry model — a services list carrying
name, description, env_key, iam_role and psql_var per
service — rather than by entities. Together the four artefacts give
every backend service a database identity (users + grants) and an
application identity (accounts + roles); ores.shell.service is the
shell projection of the same registry.
Mustache incantations
Passwords are never inlined: {{psql_var}} emits a psql :variable
reference resolved at execution time from the environment
({{env_key}}). The DB-grants template uses the {{^last}} comma
idiom for the grant lists. Otherwise the group's standard constructs.
Archetypes
| Archetype | Description |
|---|---|
| ores.sql.service.account_roles_populate | Assigns each service account its {{iam_role}}. Output projects/ores.sql/populate/iam/iam_service_account_roles_populate.sql. |
| ores.sql.service.accounts_populate | IAM application accounts for the services (email, description, password via psql variable). Output projects/ores.sql/populate/iam/iam_service_accounts_populate.sql. |
| ores.sql.service.db_grants | Grants each service role its DML surface: per-service dml_prefixes list the table-name prefixes the service may touch. Output projects/ores.sql/create/iam/iam_service_db_grants_create.sql. |
| ores.sql.service.users_create | One CREATE ROLE … LOGIN per registry service, password supplied via the service's psql variable. Output projects/ores.sql/create/iam/service_users_create.sql. |
See also
- ores.sql — the parent technical space's generated facet/archetype catalogue and shared Mustache conventions.
- SQL Technical Space — the domain-concept overview of this technical space.
- Codegen template library — the groups overview.