Integrate object-level locks for concurrent grants (PR #595)

[jBouyoud]

Overview

This PR integrates upstream PR #595 which implements object-level advisory locks for concurrent grant operations, significantly improving parallelism and preventing "tuple concurrently updated" errors.

Problem Solved

When running multiple postgresql_grant resources concurrently in Terraform, users would frequently encounter:

Error: could not execute revoke query: pq: tuple concurrently updated

This happened because the provider used database-wide locks, creating unnecessary contention between unrelated grant operations.

Solution

Replace database-wide locks with hash-based object-level locks using PostgreSQL's advisory lock mechanism:

• Uses hashtext() for deterministic lock IDs (e.g., grant:table:db.schema.table)
• Locks are acquired only for the specific object being modified (table, schema, function, etc.)
• Multiple grant operations on different objects can now run in parallel
• Locks are automatically released at transaction end

Changes

Core Implementation

• postgresql/config.go: Add LockGrants configuration field and IsLockGrants() methods
• postgresql/helpers.go:
  • Add generateGrantLockID() - generates deterministic lock identifiers per object type
  • Add pgLockGrantTarget() - acquires advisory locks at object level
• postgresql/provider.go: Add lock_grants provider configuration parameter (default: false)
• postgresql/resource_postgresql_grant.go: Replace database-wide locks with object-level locking when enabled

Testing & Examples

• examples/issues/178/: Complete test setup with Docker PostgreSQL and concurrent grant scenarios
  • Demonstrates concurrent operations on 300 tables with 60 users
  • Shows proper usage of lock_grants parameter

Documentation

• README.md: Mark PR Use object-level locks for concurrent grants to improve parallelism cyrilgdn/terraform-provider-postgresql#595 as integrated ✅

Usage

Enable object-level locking in your provider configuration:

provider "postgresql" {
  # ... other configuration ...
  lock_grants = true  # Enable object-level locks for concurrent grants
}

Performance Impact

• Before: All grant operations serialized at database level
• After: Parallel execution possible for grants on different objects
• Backward Compatible: Feature is opt-in (default: false)

Testing

The example configuration in examples/issues/178/ can be used to verify concurrent grant behavior:

cd examples/issues/178/
terraform init
terraform test

Credits

Original implementation by @benoittgt in cyrilgdn/terraform-provider-postgresql#595

Related

• Closes issue with concurrent grant operations
• Part of maintaining an up-to-date fork while upstream is inactive

[benoittgt]

Hello

Happy to see this merged here. Curious about the feedbacks. Is it working as expected ?