@@ -0,0 +1,1165 @@
+# Copyright (C) 2017 Google Inc.%0A# Licensed under http://www.apache.org/licenses/LICENSE-2.0 %3Csee LICENSE file%3E%0A%0A%22%22%22%0AClear user roles with invalid context%0A%0ACreate Date: 2017-03-11 14:26:55.133169%0A%22%22%22%0A# disable Invalid constant name pylint warning for mandatory Alembic variables.%0A# pylint: disable=invalid-name%0A%0Afrom alembic import op%0A%0A%0A# revision identifiers, used by Alembic.%0Arevision = '3ab8b37b04'%0Adown_revision = '53831d153d8e'%0A%0A%0Adef upgrade():%0A  %22%22%22Delete audit user roles from bad audits.%0A%0A  This will remove all auditors from audits that had the program context%0A  instead of their own context. In that case there is no way of knowing t%0A  which audit the any given auditor belonged to in the first place, so from%0A  security standpoint it is safer to remove those roles and manually add them%0A  back if needed.%0A  %22%22%22%0A  sql = %22%22%22%0A  DELETE user_roles%0A  FROM user_roles%0A  JOIN roles as r on user_roles.role_id = r.id%0A  JOIN contexts as c on user_roles.context_id = c.id%0A  WHERE%0A    r.name = %22Auditor%22 AND%0A    c.related_object_type = %22Program%22%0A  %22%22%22%0A  op.execute(sql)%0A%0A%0Adef downgrade():%0A  %22%22%22Downgrade database schema and/or data back to the previous revision.%22%22%22%0A

Remove invalid user role entries