grant access to the deleteUserKeys APIs to some roles and clean code

Author: bernardodemarco

engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql

@@ -50,7 +50,7 @@ CREATE TABLE IF NOT EXISTS `cloud`.`webhook_filter` (
     CONSTRAINT `fk_webhook_filter__webhook_id` FOREIGN KEY(`webhook_id`) REFERENCES `webhook`(`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
 
--- Create "api_keypair" table for api and secret keys
+-- "api_keypair" table for API and secret keys
 CREATE TABLE IF NOT EXISTS `cloud`.`api_keypair` (
     `id` bigint(20) unsigned NOT NULL auto_increment,
     `uuid` varchar(40) UNIQUE NOT NULL,
@@ -71,6 +71,7 @@ CREATE TABLE IF NOT EXISTS `cloud`.`api_keypair` (
     CONSTRAINT `fk_api_keypair__domain_id` FOREIGN KEY(`domain_id`) REFERENCES `cloud`.`domain`(`id`)
 );
 
+-- "api_keypair_permissions" table for API key pairs permissions
 CREATE TABLE IF NOT EXISTS `cloud`.`api_keypair_permissions` (
     `id` bigint(20) unsigned NOT NULL auto_increment,
     `uuid` varchar(40) UNIQUE,
@@ -83,11 +84,17 @@ CREATE TABLE IF NOT EXISTS `cloud`.`api_keypair_permissions` (
     CONSTRAINT `fk_keypair_permissions__api_keypair_id` FOREIGN KEY(`api_keypair_id`) REFERENCES `cloud`.`api_keypair`(`id`)
 );
 
+-- Populate "api_keypair" table with existing user API keys
 INSERT INTO `cloud`.`api_keypair` (uuid, user_id, domain_id, account_id, api_key, secret_key, created, name)
-SELECT  uuid(), user.id, account.domain_id, account.id, user.api_key, user.secret_key, now(), 'Active key pair'
-FROM    `cloud`.`user` AS user
-JOIN    `cloud`.`account` AS account ON user.account_id = account.id
-WHERE   user.api_key IS NOT NULL
-  AND     user.secret_key IS NOT NULL;
+SELECT UUID(), user.id, account.domain_id, account.id, user.api_key, user.secret_key, NOW(), 'Active key pair'
+FROM `cloud`.`user` AS user
+JOIN `cloud`.`account` AS account ON user.account_id = account.id
+WHERE user.api_key IS NOT NULL AND user.secret_key IS NOT NULL;
 
+-- Drop API keys from user table
 ALTER TABLE `cloud`.`user` DROP COLUMN api_key, DROP COLUMN secret_key;
+
+-- Grant access to the "deleteUserKeys" API to the "User", "Domain Admin" and "Resource Admin" roles, similarly to the "registerUserKeys" API.
+CALL `cloud`.`IDEMPOTENT_UPDATE_API_PERMISSION`('User', 'deleteUserKeys', 'ALLOW');
+CALL `cloud`.`IDEMPOTENT_UPDATE_API_PERMISSION`('Domain Admin', 'deleteUserKeys', 'ALLOW');
+CALL `cloud`.`IDEMPOTENT_UPDATE_API_PERMISSION`('Resource Admin', 'deleteUserKeys', 'ALLOW');