Search code examples
ruby-on-railspostgresqlprivileges

What's the simplest least-privilege way to enable UUIDs in a Rails schema?


I am working with a Rails project that uses UUIDs, through the uuid-ossp extension.

This is done through what looks to me like a standard migration:

class EnableExtensions < ActiveRecord::Migration
  def change
    enable_extension 'plpgsql'
    enable_extension 'uuid-ossp' if Rails.env.development? || Rails.env.test?
  end
end

However, working with this requires that I manually go around and set the extension to be enabled with a postgres superuser for each database:

-- enable_extension("uuid-ossp")
rake aborted!
ActiveRecord::StatementInvalid: PG::InsufficientPrivilege: ERROR:  permission denied to create extension "uuid-ossp"
HINT:  Must be superuser to create this extension.
: CREATE EXTENSION IF NOT EXISTS "uuid-ossp"

I'm not going to give my user, or the rails project users, superuser privileges on any of my databases--that doesn't seem like a good habit. So how am I supposed to do this?

Note: this question's accepted answer doesn't answer the larger question in the title.


Solution

  • Apparently https://github.com/dimitri/pgextwlist will allow you to whitelist extensions without having to grant superuser privileges.

    Found as an answer to Why can only a superuser CREATE EXTENSION hstore, but not on Heroku?