google-nomulus/db/build.gradle

// Copyright 2019 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import org.gradle.api.internal.tasks.userinput.UserInputHandler

plugins {
  id "org.flywaydb.flyway" version "6.0.1"
  id 'maven-publish'
}

ext {
  Set restrictedDbEnv =
      [ 'sandbox', 'production' ].asUnmodifiable()
  Set allDbEnv =
      [ 'alpha', 'crash' ].plus(restrictedDbEnv).asUnmodifiable()

  def dbServerProperty = 'dbServer'
  def dbNameProperty = 'dbName'

  def dbServer = findProperty(dbServerProperty).toString().toLowerCase()
  def dbName = findProperty(dbNameProperty)

  reconfirmRestrictedDbEnv = {
    if (!restrictedDbEnv.contains(dbServer)) {
      return
    }
    // For restricted environments, ask the user to type again to confirm.
    // The following statement uses Gradle internal API to get around the
    // missing console bug when Gradle Daemon is in use. Another option is
    // to use the ant.input task. For details please refer to
    // https://github.com/gradle/gradle/issues/1251.
    def dbServerAgain = services.get(UserInputHandler.class).askQuestion(
        """\
           Are you sure? Operating on ${dbServer} from desktop is unsafe.
           Please type '${dbServer}' again to proceed: """.stripIndent(),
        '').trim()
    if (dbServer != dbServerAgain) {
      throw new RuntimeException(
          "Failed to confirm for restricted database environment. Operation aborted.")
    }
  }

  getAccessInfoByHostPort = { hostAndPort ->
    return [
        url: "jdbc:postgresql://${hostAndPort}/${dbName}",
        user: findProperty('dbUser'),
        password: findProperty('dbPassword')]
  }

  getSocketFactoryAccessInfo = { env ->
    def cred = getCloudSqlCredential(env, 'admin').split(' ')
    def sqlInstance = cred[0]
    return [
        url: """\
                   jdbc:postgresql://google/${dbName}?cloudSqlInstance=
                   ${sqlInstance}&socketFactory=
                   com.google.cloud.sql.postgres.SocketFactory"""
                   .stripIndent()
                   .replaceAll(System.lineSeparator(), '') ,
        user: cred[1],
        password: cred[2]]
  }

  getJdbcAccessInfo = {
    if (allDbEnv.contains(dbServer)) {
      return getSocketFactoryAccessInfo(dbServer)
    } else {
      return getAccessInfoByHostPort(dbServer)
    }
  }

  // Retrieves Cloud SQL credential for a given role. Result is in the form of
  // 'instancename username password'.
  //
  // The env parameter may be one of the following: alpha, crash, sandbox, or
  // production. The role parameter may be superuser. (More roles will be added
  // later).
  getCloudSqlCredential = { env, role ->
    env = env == 'production' ? '' : "-${env}"
    def keyProject = env == '-crash'
        ? 'domain-registry-crash-kms-keys'
        : "domain-registry${env}-keys"
    def command =
        """gsutil cp \
           gs://domain-registry${env}-cloudsql-credentials/${role}_credential.enc - | \
           base64 -d | \
           gcloud kms decrypt --location global --keyring nomulus \
           --key sql-credentials-on-gcs-key --plaintext-file=- \
           --ciphertext-file=- \
           --project=${keyProject}"""

    return execInBash(command, '/tmp')
  }
}

task schemaJar(type: Jar) {
  archiveBaseName = 'schema'
  from(sourceSets.main.resources) {
    include 'sql/flyway/**'
    include 'sql/schema/nomulus.golden.sql'
  }
}

artifacts {
  archives schemaJar
}

publishing {
  repositories {
    maven {
      url project.schema_publish_repo
    }
  }
  publications {
    sqlSchemaPublication(MavenPublication) {
      groupId 'google.registry'
      artifactId 'schema'
      version project.schema_version
      artifact schemaJar
    }
  }
}


flyway {
  def accessInfo = project.ext.getJdbcAccessInfo()

  url = accessInfo.url
  user = accessInfo.user
  password = accessInfo.password
  schemas = [ 'public' ]

  locations = [ "classpath:sql/flyway" ]
}

tasks.flywayMigrate.dependsOn(
    tasks.create('confirmMigrateOnRestrictedDb') {
      doLast {
        project.ext.reconfirmRestrictedDbEnv()
      }
    })

dependencies {
  def deps = rootProject.dependencyMap

  compile deps['org.flywaydb:flyway-core']

  runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
  runtimeOnly deps['org.postgresql:postgresql']

  testCompile deps['com.google.flogger:flogger']
  testRuntime deps['com.google.flogger:flogger-system-backend']
  testCompile deps['com.google.guava:guava']
  testCompile deps['com.google.truth:truth']
  testCompile deps['io.github.java-diff-utils:java-diff-utils']
  testCompile deps['junit:junit']
  testCompile deps['org.testcontainers:postgresql']
  testCompile deps['org.testcontainers:testcontainers']
  testCompile project(':third_party')
}

// Ensure that resources are rebuilt before running Flyway tasks
tasks
    .findAll { task -> task.group.equals('Flyway')}
    .collect { task -> task.dependsOn('buildNeeded') }