8000 Add migration `with admin` option for permissions to administer roles for postgres role beyond pg16 by encima · Pull Request #1625 · supabase/postgres · GitHub
[go: up one dir, main page]
Skip to content

Add migration with admin option for permissions to administer roles for postgres role beyond pg16 #1625

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Jun 5, 2025
Merged

Add migration with admin option for permissions to administer roles for postgres role beyond pg16 #1625

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
e0ee3c5
add migration with admin option for permissions for postgres to admin…
encima Jun 5, 2025
62bffe1
chore: bump AMIs
pcnc Jun 5, 2025
9bdc6e3
chore: update snapshot
pcnc Jun 5, 2025
7115a63
Add separate tests output for Postgres 15 and 17
za-arthur Jun 5, 2025
d8733a3
chore: update snapshots; multiversion boogaloo
pcnc Jun 5, 2025
2e54f13
chore: remove additional roles file
pcnc Jun 5, 2025
2ce63b0
fix: add more roles
soedirgo Jun 5, 2025
368bf20
fix: use inner join
soedirgo Jun 5, 2025
50456c3
test: update z_*_roles snapshots
soedirgo Jun 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions ansible/vars.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ postgres_major:

# Full version strings for each major version
postgres_release:
postgresorioledb-17: "17.0.1.090-orioledb"
postgres17: "17.4.1.040"
postgres15: "15.8.1.097"
postgresorioledb-17: "17.0.1.091-orioledb"
postgres17: "17.4.1.041"
postgres15: "15.8.1.098"

# Non Postgres Extensions
pgbouncer_release: "1.19.0"
Expand Down
13 changes: 13 additions & 0 deletions migrations/db/migrations/20250605172253_grant_with_admin_to_postgres_16_and_above.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
-- migrate:up
DO $$
DECLARE
major_version INT;
BEGIN
SELECT current_setting('server_version_num')::INT / 10000 INTO major_version;

IF major_version >= 16 THEN
GRANT anon, authenticated, service_role, authenticator, pg_monitor, pg_read_all_data, pg_signal_backend TO postgres WITH ADMIN OPTION;
END IF;
END $$;

-- migrate:down
37 changes: 0 additions & 37 deletions nix/tests/expected/roles.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,43 +91,6 @@ order by rolname;
supabase_storage_admin | {search_path=storage,log_statement=none}
(29 rows)

-- all role memberships
select
r.rolname as member,
g.rolname as "member_of (can become)",
m.admin_option
from
pg_roles r
left join
pg_auth_members m on r.oid = m.member
left join
pg_roles g on m.roleid = g.oid
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
order by
r.rolname, g.rolname;
member | member_of (can become) | admin_option
-------------------------+------------------------+--------------
authenticator | anon | f
authenticator | authenticated | f
authenticator | service_role | f
pg_monitor | pg_read_all_settings | f
pg_monitor | pg_read_all_stats | f
pg_monitor | pg_stat_scan_tables | f
pgsodium_keyholder | pgsodium_keyiduser | f
pgsodium_keymaker | pgsodium_keyholder | f
pgsodium_keymaker | pgsodium_keyiduser | f
postgres | anon | f
postgres | authenticated | f
postgres | pg_monitor | f
postgres | pg_read_all_data | f
postgres | pg_signal_backend | f
postgres | pgtle_admin | f
postgres | service_role | f
supabase_read_only_user | pg_read_all_data | f
supabase_storage_admin | authenticator | f
(18 rows)

-- Check all privileges of the roles on the schemas
select schema_name, privilege_type, grantee, default_for
from (
Expand Down
35 changes: 35 additions & 0 deletions nix/tests/expected/z_15_roles.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
-- version-specific role memberships
select
r.rolname as member,
g.rolname as "member_of (can become)",
m.admin_option
from
pg_roles r
join
pg_auth_members m on r.oid = m.member
left join
pg_roles g on m.roleid = g.oid
order by
r.rolname, g.rolname;
member | member_of (can become) | admin_option
-------------------------+------------------------+--------------
authenticator | anon | f
authenticator | authenticated | f
authenticator | service_role | f
pg_monitor | pg_read_all_settings | f
pg_monitor | pg_read_all_stats | f
pg_monitor | pg_stat_scan_tables | f
pgsodium_keyholder | pgsodium_keyiduser | f
pgsodium_keymaker | pgsodium_keyholder | f
pgsodium_keymaker | pgsodium_keyiduser | f
postgres | anon | f
postgres | authenticated | f
postgres | pg_monitor | f
postgres | pg_read_all_data | f
postgres | pg_signal_backend | f
postgres | pgtle_admin | f
postgres | service_role | f
supabase_read_only_user | pg_read_all_data | f
supabase_storage_admin | authenticator | f
(18 rows)

72 changes: 62 additions & 10 deletions nix/tests/expected/z_17_roles.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,21 +40,35 @@ select
m.admin_option
from
pg_roles r
left join
join
pg_auth_members m on r.oid = m.member
left join
pg_roles g on m.roleid = g.oid
where r.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
or g.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
order by
r.rolname, g.rolname;
member | member_of (can become) | admin_option
-----------------------------+------------------------+--------------
pg_create_subscription | |
pg_maintain | |
pg_use_reserved_connections | |
postgres | pg_create_subscription | f
(4 rows)
member | member_of (can become) | admin_option
-------------------------+------------------------+--------------
authenticator | anon | f
authenticator | authenticated | f
authenticator | service_role | f
pg_monitor | pg_read_all_settings | f
pg_monitor | pg_read_all_stats | f
pg_monitor | pg_stat_scan_tables | f
pgsodium_keyholder | pgsodium_keyiduser | f
pgsodium_keymaker | pgsodium_keyholder | f
pgsodium_keymaker | pgsodium_keyiduser | f
postgres | anon | t
postgres | authenticated | t
postgres | authenticator | t
postgres | pg_create_subscription | f
postgres | pg_monitor | t
postgres | pg_read_all_data | t
postgres | pg_signal_backend | t
postgres | pgtle_admin | f
postgres | service_role | t
supabase_read_only_user | pg_read_all_data | f
supabase_storage_admin | authenticator | f
(20 rows)

-- Check version-specific privileges of the roles on the schemas
select schema_name, privilege_type, grantee, default_for
Expand Down Expand Up @@ -109,3 +123,41 @@ order by schema_order, schema_name, privilege_type, grantee, default_for;
storage | MAINTAIN | service_role | postgres
(28 rows)

-- version specific role memberships
select
r.rolname as member,
g.rolname as "member_of (can become)",
m.admin_option
from
pg_roles r
left join
pg_auth_members m on r.oid = m.member
left join
pg_roles g on m.roleid = g.oid
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
order by
r.rolname, g.rolname;
member | member_of (can become) | admin_option
-------------------------+------------------------+--------------
authenticator | anon | f
authenticator | authenticated | f
authenticator | service_role | f
pg_monitor | pg_read_all_settings | f
pg_monitor | pg_read_all_stats | f
pg_monitor | pg_stat_scan_tables | f
pgsodium_keyholder | pgsodium_keyiduser | f
pgsodium_keymaker | pgsodium_keyholder | f
pgsodium_keymaker | pgsodium_keyiduser | f
postgres | anon | t
postgres | authenticated | t
postgres | authenticator | t
postgres | pg_monitor | t
postgres | pg_read_all_data | t
postgres | pg_signal_backend | t
postgres | pgtle_admin | f
postgres | service_role | t
supabase_read_only_user | pg_read_all_data | f
supabase_storage_admin | authenticator | f
(19 rows)

16 changes: 0 additions & 16 deletions nix/tests/sql/roles.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,22 +28,6 @@ from pg_roles r
where rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
order by rolname;

-- all role memberships
select
r.rolname as member,
g.rolname as "member_of (can become)",
m.admin_option
from
pg_roles r
left join
pg_auth_members m on r.oid = m.member
left join
pg_roles g on m.roleid = g.oid
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
order by
r.rolname, g.rolname;

-- Check all privileges of the roles on the schemas
select schema_name, privilege_type, grantee, default_for
from (
Expand Down
15 changes: 15 additions & 0 deletions nix/tests/sql/z_15.roles.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
-- all role memberships
select
r.rolname as member,
g.rolname as "member_of (can become)",
m.admin_option
from
pg_roles r
left join
pg_auth_members m on r.oid = m.member
left join
pg_roles g on m.roleid = g.oid
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
order by
r.rolname, g.rolname;
13 changes: 13 additions & 0 deletions nix/tests/sql/z_15_roles.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
-- version-specific role memberships
select
r.rolname as member,
g.rolname as "member_of (can become)",
m.admin_option
from
pg_roles r
join
pg_auth_members m on r.oid = m.member
left join
pg_roles g on m.roleid = g.oid
order by
r.rolname, g.rolname;
20 changes: 17 additions & 3 deletions nix/tests/sql/z_17_roles.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,12 +28,10 @@ select
m.admin_option
from
pg_roles r
left join
join
pg_auth_members m on r.oid = m.member
left join
pg_roles g on m.roleid = g.oid
where r.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
or g.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
order by
r.rolname, g.rolname;

Expand All @@ -58,3 +56,19 @@ from (
a.privilege_type = 'MAINTAIN'
) sub
order by schema_order, schema_name, privilege_type, grantee, default_for;

-- version specific role memberships
select
r.rolname as member,
g.rolname as "member_of (can become)",
m.admin_option
from
pg_roles r
left join
pg_auth_members m on r.oid = m.member
left join
pg_roles g on m.roleid = g.oid
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
order by
r.rolname, g.rolname;
Loading
0