add idle_in_transaction_session_timeout support to role (#39)

Author: colesnodgrass

postgresql/resource_postgresql_role.go

@@ -16,23 +16,24 @@ import (
 )
 
 const (
-	roleBypassRLSAttr         = "bypass_row_level_security"
-	roleConnLimitAttr         = "connection_limit"
-	roleCreateDBAttr          = "create_database"
-	roleCreateRoleAttr        = "create_role"
-	roleEncryptedPassAttr     = "encrypted_password"
-	roleInheritAttr           = "inherit"
-	roleLoginAttr             = "login"
-	roleNameAttr              = "name"
-	rolePasswordAttr          = "password"
-	roleReplicationAttr       = "replication"
-	roleSkipDropRoleAttr      = "skip_drop_role"
-	roleSkipReassignOwnedAttr = "skip_reassign_owned"
-	roleSuperuserAttr         = "superuser"
-	roleValidUntilAttr        = "valid_until"
-	roleRolesAttr             = "roles"
-	roleSearchPathAttr        = "search_path"
-	roleStatementTimeoutAttr  = "statement_timeout"
+	roleBypassRLSAttr                       = "bypass_row_level_security"
+	roleConnLimitAttr                       = "connection_limit"
+	roleCreateDBAttr                        = "create_database"
+	roleCreateRoleAttr                      = "create_role"
+	roleEncryptedPassAttr                   = "encrypted_password"
+	roleIdleInTransactionSessionTimeoutAttr = "idle_in_transaction_session_timeout"
+	roleInheritAttr                         = "inherit"
+	roleLoginAttr                           = "login"
+	roleNameAttr                            = "name"
+	rolePasswordAttr                        = "password"
+	roleReplicationAttr                     = "replication"
+	roleSkipDropRoleAttr                    = "skip_drop_role"
+	roleSkipReassignOwnedAttr               = "skip_reassign_owned"
+	roleSuperuserAttr                       = "superuser"
+	roleValidUntilAttr                      = "valid_until"
+	roleRolesAttr                           = "roles"
+	roleSearchPathAttr                      = "search_path"
+	roleStatementTimeoutAttr                = "statement_timeout"
 
 	// Deprecated options
 	roleDepEncryptedAttr = "encrypted"
@@ -118,6 +119,12 @@ func resourcePostgreSQLRole() *schema.Resource {
 				Default:     false,
 				Description: "Determine whether this role will be permitted to create new roles",
 			},
+			roleIdleInTransactionSessionTimeoutAttr: {
+				Type:         schema.TypeInt,
+				Optional:     true,
+				Description:  "Terminate any session with an open transaction that has been idle for longer than the specified duration in milliseconds",
+				ValidateFunc: validation.IntAtLeast(0),
+			},
 			roleInheritAttr: {
 				Type:        schema.TypeBool,
 				Optional:    true,
@@ -290,6 +297,10 @@ func resourcePostgreSQLRoleCreate(db *DBConnection, d *schema.ResourceData) erro
 		return err
 	}
 
+	if err = setIdleInTransactionSessionTimeout(txn, d); err != nil {
+		return err
+	}
+
 	if err = txn.Commit(); err != nil {
 		return fmt.Errorf("could not commit transaction: %w", err)
 	}
@@ -439,6 +450,13 @@ func resourcePostgreSQLRoleReadImpl(db *DBConnection, d *schema.ResourceData) er
 
 	d.Set(roleStatementTimeoutAttr, statementTimeout)
 
+	idleInTransactionSessionTimeout, err := readIdleInTransactionSessionTimeout(roleConfig)
+	if err != nil {
+		return err
+	}
+
+	d.Set(roleIdleInTransactionSessionTimeoutAttr, idleInTransactionSessionTimeout)
+
 	d.SetId(roleName)
 
 	password, err := readRolePassword(db, d, roleCanLogin)
@@ -466,6 +484,23 @@ func readSearchPath(roleConfig pq.ByteaArray) []string {
 	return nil
 }
 
+// readIdleInTransactionSessionTimeout searches for a idle_in_transaction_session_timeout entry in the rolconfig array.
+// In case no such value is present, it returns nil.
+func readIdleInTransactionSessionTimeout(roleConfig pq.ByteaArray) (int, error) {
+	for _, v := range roleConfig {
+		config := string(v)
+		if strings.HasPrefix(config, roleIdleInTransactionSessionTimeoutAttr) {
+			var result = strings.Split(strings.TrimPrefix(config, roleIdleInTransactionSessionTimeoutAttr+"="), ", ")
+			res, err := strconv.Atoi(result[0])
+			if err != nil {
+				return -1, fmt.Errorf("Error reading statement_timeout: %w", err)
+			}
+			return res, nil
+		}
+	}
+	return 0, nil
+}
+
 // readStatementTimeout searches for a statement_timeout entry in the rolconfig array.
 // In case no such value is present, it returns nil.
 func readStatementTimeout(roleConfig pq.ByteaArray) (int, error) {
@@ -610,6 +645,10 @@ func resourcePostgreSQLRoleUpdate(db *DBConnection, d *schema.ResourceData) erro
 		return err
 	}
 
+	if err = setIdleInTransactionSessionTimeout(txn, d); err != nil {
+		return err
+	}
+
 	if err = txn.Commit(); err != nil {
 		return fmt.Errorf("could not commit transaction: %w", err)
 	}
@@ -933,3 +972,28 @@ func setStatementTimeout(txn *sql.Tx, d *schema.ResourceData) error {
 	}
 	return nil
 }
+
+func setIdleInTransactionSessionTimeout(txn *sql.Tx, d *schema.ResourceData) error {
+	if !d.HasChange(roleIdleInTransactionSessionTimeoutAttr) {
+		return nil
+	}
+
+	roleName := d.Get(roleNameAttr).(string)
+	idleInTransactionSessionTimeout := d.Get(roleIdleInTransactionSessionTimeoutAttr).(int)
+	if idleInTransactionSessionTimeout != 0 {
+		sql := fmt.Sprintf(
+			"ALTER ROLE %s SET idle_in_transaction_session_timeout TO %d", pq.QuoteIdentifier(roleName), idleInTransactionSessionTimeout,
+		)
+		if _, err := txn.Exec(sql); err != nil {
+			return fmt.Errorf("could not set idle_in_transaction_session_timeout %d for %s: %w", idleInTransactionSessionTimeout, roleName, err)
+		}
+	} else {
+		sql := fmt.Sprintf(
+			"ALTER ROLE %s RESET idle_in_transaction_session_timeout", pq.QuoteIdentifier(roleName),
+		)
+		if _, err := txn.Exec(sql); err != nil {
+			return fmt.Errorf("could not reset idle_in_transaction_session_timeout for %s: %w", roleName, err)
+		}
+	}
+	return nil
+}

postgresql/resource_postgresql_role_test.go

@@ -45,6 +45,7 @@ func TestAccPostgresqlRole_Basic(t *testing.T) {
 					resource.TestCheckResourceAttr("postgresql_role.role_with_defaults", "skip_drop_role", "false"),
 					resource.TestCheckResourceAttr("postgresql_role.role_with_defaults", "skip_reassign_owned", "false"),
 					resource.TestCheckResourceAttr("postgresql_role.role_with_defaults", "statement_timeout", "0"),
+					resource.TestCheckResourceAttr("postgresql_role.role_with_defaults", "idle_in_transaction_session_timeout", "0"),
 
 					resource.TestCheckResourceAttr("postgresql_role.role_with_create_database", "name", "role_with_create_database"),
 					resource.TestCheckResourceAttr("postgresql_role.role_with_create_database", "create_database", "true"),
@@ -120,6 +121,7 @@ resource "postgresql_role" "update_role" {
   roles = ["${postgresql_role.group_role.name}"]
   search_path = ["mysearchpath"]
   statement_timeout = 30000
+  idle_in_transaction_session_timeout = 60000
 }
 `
 	resource.Test(t, resource.TestCase{
@@ -142,6 +144,7 @@ resource "postgresql_role" "update_role" {
 					resource.TestCheckResourceAttr("postgresql_role.update_role", "roles.#", "0"),
 					resource.TestCheckResourceAttr("postgresql_role.update_role", "search_path.#", "0"),
 					resource.TestCheckResourceAttr("postgresql_role.update_role", "statement_timeout", "0"),
+					resource.TestCheckResourceAttr("postgresql_role.update_role", "idle_in_transaction_session_timeout", "0"),
 					testAccCheckRoleCanLogin(t, "update_role", "toto"),
 				),
 			},
@@ -164,6 +167,7 @@ resource "postgresql_role" "update_role" {
 					resource.TestCheckResourceAttr("postgresql_role.update_role", "search_path.#", "1"),
 					resource.TestCheckResourceAttr("postgresql_role.update_role", "search_path.0", "mysearchpath"),
 					resource.TestCheckResourceAttr("postgresql_role.update_role", "statement_timeout", "30000"),
+					resource.TestCheckResourceAttr("postgresql_role.update_role", "idle_in_transaction_session_timeout", "60000"),
 					testAccCheckRoleCanLogin(t, "update_role2", "titi"),
 				),
 			},
@@ -180,6 +184,7 @@ resource "postgresql_role" "update_role" {
 					resource.TestCheckResourceAttr("postgresql_role.update_role", "roles.#", "0"),
 					resource.TestCheckResourceAttr("postgresql_role.update_role", "search_path.#", "0"),
 					resource.TestCheckResourceAttr("postgresql_role.update_role", "statement_timeout", "0"),
+					resource.TestCheckResourceAttr("postgresql_role.update_role", "idle_in_transaction_session_timeout", "0"),
 					testAccCheckRoleCanLogin(t, "update_role", "toto"),
 				),
 			},
@@ -411,6 +416,7 @@ resource "postgresql_role" "role_with_defaults" {
   skip_drop_role = false
   valid_until = "infinity"
   statement_timeout = 0
+  idle_in_transaction_session_timeout = 0
 }
 
 resource "postgresql_role" "role_with_create_database" {