mariadb: fixed order roles are removed in

The list of SQL statements is constructed and then executed.

Thus if you delete role `foo` which was granted another role `bar`,
role `bar` has to be revoked before `foo` is removed.

1 files changed, 9 insertions, 9 deletions

diff --git a/modules/apps/mariadb/roles.nix b/modules/apps/mariadb/roles.nix
index 5ec3571..a3c24df 100644
--- a/modules/apps/mariadb/roles.nix
+++ b/modules/apps/mariadb/roles.nix
@@ -161,15 +161,6 @@ let
     ON u = user
     WHERE user IS NULL ;
 
-    -- Remove old roles.
-    SELECT CONCAT('DROP ROLE \''', user, '\';')
-    FROM __roles
-    RIGHT OUTER JOIN user
-    ON u = user
-    WHERE u IS NULL AND is_role = 'Y' ;
-
-    DROP TABLE __roles;
-
 
     CREATE TEMPORARY TABLE __roles_mapping (u CHAR(80), r CHAR(80));
     ${concatMapAttrs (role: subroles: ''
@@ -194,6 +185,15 @@ let
 
     DROP TABLE __roles_mapping;
 
+    -- Remove old roles.
+    SELECT CONCAT('DROP ROLE \''', user, '\';')
+    FROM __roles
+    RIGHT OUTER JOIN user
+    ON u = user
+    WHERE u IS NULL AND is_role = 'Y' ;
+
+    DROP TABLE __roles;
+
   '';
 
   roleType =