Skip to content

Commit 0b428a7

Browse files
encimaencima
authored
Add migration with admin option for permissions to administer roles for postgres role beyond pg16 (supabase#1625)
1 parent e48bc39 commit 0b428a7

File tree

9 files changed

+158
-69
lines changed

9 files changed

+158
-69
lines changed

‎ansible/vars.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ postgres_major:
99

1010
# Full version strings for each major version
1111
postgres_release:
12-
postgresorioledb-17: "17.0.1.090-orioledb"
13-
postgres17: "17.4.1.040"
14-
postgres15: "15.8.1.097"
12+
postgresorioledb-17: "17.0.1.091-orioledb"
13+
postgres17: "17.4.1.041"
14+
postgres15: "15.8.1.098"
1515

1616
# Non Postgres Extensions
1717
pgbouncer_release: "1.19.0"

‎migrations/db/migrations/20250605172253_grant_with_admin_to_postgres_16_and_above.sql‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-- migrate:up
2+
DO $$
3+
DECLARE
4+
major_version INT;
5+
BEGIN
6+
SELECT current_setting('server_version_num')::INT / 10000 INTO major_version;
7+
8+
IF major_version >= 16 THEN
9+
GRANT anon, authenticated, service_role, authenticator, pg_monitor, pg_read_all_data, pg_signal_backend TO postgres WITH ADMIN OPTION;
10+
END IF;
11+
END $$;
12+
13+
-- migrate:down

‎nix/tests/expected/roles.out‎

Lines changed: 0 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -91,43 +91,6 @@ order by rolname;
9191
supabase_storage_admin | {search_path=storage,log_statement=none}
9292
(29 rows)
9393

94-
-- all role memberships
95-
select
96-
r.rolname as member,
97-
g.rolname as "member_of (can become)",
98-
m.admin_option
99-
from
100-
pg_roles r
101-
left join
102-
pg_auth_members m on r.oid = m.member
103-
left join
104-
pg_roles g on m.roleid = g.oid
105-
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
106-
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
107-
order by
108-
r.rolname, g.rolname;
109-
member | member_of (can become) | admin_option
110-
-------------------------+------------------------+--------------
111-
authenticator | anon | f
112-
authenticator | authenticated | f
113-
authenticator | service_role | f
114-
pg_monitor | pg_read_all_settings | f
115-
pg_monitor | pg_read_all_stats | f
116-
pg_monitor | pg_stat_scan_tables | f
117-
pgsodium_keyholder | pgsodium_keyiduser | f
118-
pgsodium_keymaker | pgsodium_keyholder | f
119-
pgsodium_keymaker | pgsodium_keyiduser | f
120-
postgres | anon | f
121-
postgres | authenticated | f
122-
postgres | pg_monitor | f
123-
postgres | pg_read_all_data | f
124-
postgres | pg_signal_backend | f
125-
postgres | pgtle_admin | f
126-
postgres | service_role | f
127-
supabase_read_only_user | pg_read_all_data | f
128-
supabase_storage_admin | authenticator | f
129-
(18 rows)
130-
13194
-- Check all privileges of the roles on the schemas
13295
select schema_name, privilege_type, grantee, default_for
13396
from (

‎nix/tests/expected/z_15_roles.out‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
-- version-specific role memberships
2+
select
3+
r.rolname as member,
4+
g.rolname as "member_of (can become)",
5+
m.admin_option
6+
from
7+
pg_roles r
8+
join
9+
pg_auth_members m on r.oid = m.member
10+
left join
11+
pg_roles g on m.roleid = g.oid
12+
order by
13+
r.rolname, g.rolname;
14+
member | member_of (can become) | admin_option
15+
-------------------------+------------------------+--------------
16+
authenticator | anon | f
17+
authenticator | authenticated | f
18+
authenticator | service_role | f
19+
pg_monitor | pg_read_all_settings | f
20+
pg_monitor | pg_read_all_stats | f
21+
pg_monitor | pg_stat_scan_tables | f
22+
pgsodium_keyholder | pgsodium_keyiduser | f
23+
pgsodium_keymaker | pgsodium_keyholder | f
24+
pgsodium_keymaker | pgsodium_keyiduser | f
25+
postgres | anon | f
26+
postgres | authenticated | f
27+
postgres | pg_monitor | f
28+
postgres | pg_read_all_data | f
29+
postgres | pg_signal_backend | f
30+
postgres | pgtle_admin | f
31+
postgres | service_role | f
32+
supabase_read_only_user | pg_read_all_data | f
33+
supabase_storage_admin | authenticator | f
34+
(18 rows)
35+

‎nix/tests/expected/z_17_roles.out‎

Lines changed: 62 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -40,21 +40,35 @@ select
4040
m.admin_option
4141
from
4242
pg_roles r
43-
left join
43+
join
4444
pg_auth_members m on r.oid = m.member
4545
left join
4646
pg_roles g on m.roleid = g.oid
47-
where r.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
48-
or g.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
4947
order by
5048
r.rolname, g.rolname;
51-
member | member_of (can become) | admin_option
52-
-----------------------------+------------------------+--------------
53-
pg_create_subscription | |
54-
pg_maintain | |
55-
pg_use_reserved_connections | |
56-
postgres | pg_create_subscription | f
57-
(4 rows)
49+
member | member_of (can become) | admin_option
50+
-------------------------+------------------------+--------------
51+
authenticator | anon | f
52+
authenticator | authenticated | f
53+
authenticator | service_role | f
54+
pg_monitor | pg_read_all_settings | f
55+
pg_monitor | pg_read_all_stats | f
56+
pg_monitor | pg_stat_scan_tables | f
57+
pgsodium_keyholder | pgsodium_keyiduser | f
58+
pgsodium_keymaker | pgsodium_keyholder | f
59+
pgsodium_keymaker | pgsodium_keyiduser | f
60+
postgres | anon | t
61+
postgres | authenticated | t
62+
postgres | authenticator | t
63+
postgres | pg_create_subscription | f
64+
postgres | pg_monitor | t
65+
postgres | pg_read_all_data | t
66+
postgres | pg_signal_backend | t
67+
postgres | pgtle_admin | f
68+
postgres | service_role | t
69+
supabase_read_only_user | pg_read_all_data | f
70+
supabase_storage_admin | authenticator | f
71+
(20 rows)
5872

5973
-- Check version-specific privileges of the roles on the schemas
6074
select schema_name, privilege_type, grantee, default_for
@@ -109,3 +123,41 @@ order by schema_order, schema_name, privilege_type, grantee, default_for;
109123
storage | MAINTAIN | service_role | postgres
110124
(28 rows)
111125

126+
-- version specific role memberships
127+
select
128+
r.rolname as member,
129+
g.rolname as "member_of (can become)",
130+
m.admin_option
131+
from
132+
pg_roles r
133+
left join
134+
pg_auth_members m on r.oid = m.member
135+
left join
136+
pg_roles g on m.roleid = g.oid
137+
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
138+
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
139+
order by
140+
r.rolname, g.rolname;
141+
member | member_of (can become) | admin_option
142+
-------------------------+------------------------+--------------
143+
authenticator | anon | f
144+
authenticator | authenticated | f
145+
authenticator | service_role | f
146+
pg_monitor | pg_read_all_settings | f
147+
pg_monitor | pg_read_all_stats | f
148+
pg_monitor | pg_stat_scan_tables | f
149+
pgsodium_keyholder | pgsodium_keyiduser | f
150+
pgsodium_keymaker | pgsodium_keyholder | f
151+
pgsodium_keymaker | pgsodium_keyiduser | f
152+
postgres | anon | t
153+
postgres | authenticated | t
154+
postgres | authenticator | t
155+
postgres | pg_monitor | t
156+
postgres | pg_read_all_data | t
157+
postgres | pg_signal_backend | t
158+
postgres | pgtle_admin | f
159+
postgres | service_role | t
160+
supabase_read_only_user | pg_read_all_data | f
161+
supabase_storage_admin | authenticator | f
162+
(19 rows)
163+

‎nix/tests/sql/roles.sql‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -28,22 +28,6 @@ from pg_roles r
2828
where rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
2929
order by rolname;
3030

31-
-- all role memberships
32-
select
33-
r.rolname as member,
34-
g.rolname as "member_of (can become)",
35-
m.admin_option
36-
from
37-
pg_roles r
38-
left join
39-
pg_auth_members m on r.oid = m.member
40-
left join
41-
pg_roles g on m.roleid = g.oid
42-
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
43-
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
44-
order by
45-
r.rolname, g.rolname;
46-
4731
-- Check all privileges of the roles on the schemas
4832
select schema_name, privilege_type, grantee, default_for
4933
from (

‎nix/tests/sql/z_15.roles.sql‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
-- all role memberships
2+
select
3+
r.rolname as member,
4+
g.rolname as "member_of (can become)",
5+
m.admin_option
6+
from
7+
pg_roles r
8+
left join
9+
pg_auth_members m on r.oid = m.member
10+
left join
11+
pg_roles g on m.roleid = g.oid
12+
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
13+
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
14+
order by
15+
r.rolname, g.rolname;

‎nix/tests/sql/z_15_roles.sql‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-- version-specific role memberships
2+
select
3+
r.rolname as member,
4+
g.rolname as "member_of (can become)",
5+
m.admin_option
6+
from
7+
pg_roles r
8+
join
9+
pg_auth_members m on r.oid = m.member
10+
left join
11+
pg_roles g on m.roleid = g.oid
12+
order by
13+
r.rolname, g.rolname;

‎nix/tests/sql/z_17_roles.sql‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,10 @@ select
2828
m.admin_option
2929
from
3030
pg_roles r
31-
left join
31+
join
3232
pg_auth_members m on r.oid = m.member
3333
left join
3434
pg_roles g on m.roleid = g.oid
35-
where r.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
36-
or g.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
3735
order by
3836
r.rolname, g.rolname;
3937

@@ -58,3 +56,19 @@ from (
5856
a.privilege_type = 'MAINTAIN'
5957
) sub
6058
order by schema_order, schema_name, privilege_type, grantee, default_for;
59+
60+
-- version specific role memberships
61+
select
62+
r.rolname as member,
63+
g.rolname as "member_of (can become)",
64+
m.admin_option
65+
from
66+
pg_roles r
67+
left join
68+
pg_auth_members m on r.oid = m.member
69+
left join
70+
pg_roles g on m.roleid = g.oid
71+
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
72+
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
73+
order by
74+
r.rolname, g.rolname;

0 commit comments

Comments
 (0)