Skip to content

Commit 4039e4c

Browse files
soedirgosoedirgo
committed
test: add z_17_roles.sql
1 parent 7a8fc2c commit 4039e4c

File tree

4 files changed

+211
-51
lines changed

4 files changed

+211
-51
lines changed

‎nix/tests/expected/roles.out‎

Lines changed: 30 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
-- Some predefined roles don't exist in earlier versions of Postgres, so we
2+
-- exclude them in this test file. They're tested in version-specific test files
3+
-- (z_<ver>_roles.sql).
4+
--
5+
-- Currently those roles are:
6+
-- pg_create_subscription, pg_maintain, pg_use_reserved_connections
17
-- all roles and attributes
28
select
39
rolname,
@@ -11,7 +17,6 @@ select
1117
rolbypassrls ,
1218
rolvaliduntil
1319
from pg_roles r
14-
-- TODO: this exclusion is to maintain compat with pg17, we should cover it
1520
where rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
1621
order by rolname;
1722
rolname | rolcreaterole | rolcanlogin | rolsuper | rolinherit | rolcreatedb | rolreplication | rolconnlimit | rolbypassrls | rolvaliduntil
@@ -51,7 +56,6 @@ select
5156
rolname,
5257
rolconfig
5358
from pg_roles r
54-
-- TODO: this exclusion is to maintain compat with pg17, we should cover it
5559
where rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
5660
order by rolname;
5761
rolname | rolconfig
@@ -98,53 +102,31 @@ left join
98102
pg_auth_members m on r.oid = m.member
99103
left join
100104
pg_roles g on m.roleid = g.oid
101-
-- TODO: this exclusion is to maintain compat with pg17, we should cover it
102105
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
106+
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
103107
order by
104108
r.rolname, g.rolname;
105-
member | member_of (can become) | admin_option
106-
----------------------------+------------------------+--------------
107-
anon | |
108-
authenticated | |
109-
authenticator | anon | f
110-
authenticator | authenticated | f
111-
authenticator | service_role | f
112-
dashboard_user | |
113-
pg_checkpoint | |
114-
pg_database_owner | |
115-
pg_execute_server_program | |
116-
pg_monitor | pg_read_all_settings | f
117-
pg_monitor | pg_read_all_stats | f
118-
pg_monitor | pg_stat_scan_tables | f
119-
pg_read_all_data | |
120-
pg_read_all_settings | |
121-
pg_read_all_stats | |
122-
pg_read_server_files | |
123-
pg_signal_backend | |
124-
pg_stat_scan_tables | |
125-
pg_write_all_data | |
126-
pg_write_server_files | |
127-
pgbouncer | |
128-
pgsodium_keyholder | pgsodium_keyiduser | f
129-
pgsodium_keyiduser | |
130-
pgsodium_keymaker | pgsodium_keyholder | f
131-
pgsodium_keymaker | pgsodium_keyiduser | f
132-
pgtle_admin | |
133-
postgres | anon | f
134-
postgres | authenticated | f
135-
postgres | pg_monitor | f
136-
postgres | pg_read_all_data | f
137-
postgres | pg_signal_backend | f
138-
postgres | pgtle_admin | f
139-
postgres | service_role | f
140-
service_role | |
141-
supabase_admin | |
142-
supabase_auth_admin | |
143-
supabase_functions_admin | |
144-
supabase_read_only_user | pg_read_all_data | f
145-
supabase_replication_admin | |
146-
supabase_storage_admin | authenticator | f
147-
(40 rows)
109+
member | member_of (can become) | admin_option
110+
-------------------------+------------------------+--------------
111+
authenticator | anon | f
112+
authenticator | authenticated | f
113+
authenticator | service_role | f
114+
pg_monitor | pg_read_all_settings | f
115+
pg_monitor | pg_read_all_stats | f
116+
pg_monitor | pg_stat_scan_tables | f
117+
pgsodium_keyholder | pgsodium_keyiduser | f
118+
pgsodium_keymaker | pgsodium_keyholder | f
119+
pgsodium_keymaker | pgsodium_keyiduser | f
120+
postgres | anon | f
121+
postgres | authenticated | f
122+
postgres | pg_monitor | f
123+
postgres | pg_read_all_data | f
124+
postgres | pg_signal_backend | f
125+
postgres | pgtle_admin | f
126+
postgres | service_role | f
127+
supabase_read_only_user | pg_read_all_data | f
128+
supabase_storage_admin | authenticator | f
129+
(18 rows)
148130

149131
-- Check all privileges of the roles on the schemas
150132
select schema_name, privilege_type, grantee, default_for
@@ -164,7 +146,8 @@ from (
164146
join
165147
pg_roles r on a.grantee = r.oid
166148
where
167-
a.privilege_type != 'MAINTAIN' -- TODO: this is to maintain compat with pg17, we should cover it
149+
-- PG17+, handled in version-specific test files
150+
a.privilege_type != 'MAINTAIN'
168151
union all
169152
-- explicit grant usage and create on the schemas
170153
select

‎nix/tests/expected/z_17_roles.out‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
-- version-specific roles and attributes
2+
select
3+
rolname,
4+
rolcreaterole ,
5+
rolcanlogin ,
6+
rolsuper ,
7+
rolinherit ,
8+
rolcreatedb ,
9+
rolreplication ,
10+
rolconnlimit ,
11+
rolbypassrls ,
12+
rolvaliduntil
13+
from pg_roles r
14+
where rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
15+
order by rolname;
16+
rolname | rolcreaterole | rolcanlogin | rolsuper | rolinherit | rolcreatedb | rolreplication | rolconnlimit | rolbypassrls | rolvaliduntil
17+
-----------------------------+---------------+-------------+----------+------------+-------------+----------------+--------------+--------------+---------------
18+
pg_create_subscription | f | f | f | t | f | f | -1 | f |
19+
pg_maintain | f | f | f | t | f | f | -1 | f |
20+
pg_use_reserved_connections | f | f | f | t | f | f | -1 | f |
21+
(3 rows)
22+
23+
select
24+
rolname,
25+
rolconfig
26+
from pg_roles r
27+
where rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
28+
order by rolname;
29+
rolname | rolconfig
30+
-----------------------------+-----------
31+
pg_create_subscription |
32+
pg_maintain |
33+
pg_use_reserved_connections |
34+
(3 rows)
35+
36+
-- version-specific role memberships
37+
select
38+
r.rolname as member,
39+
g.rolname as "member_of (can become)",
40+
m.admin_option
41+
from
42+
pg_roles r
43+
left join
44+
pg_auth_members m on r.oid = m.member
45+
left join
46+
pg_roles g on m.roleid = g.oid
47+
where r.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
48+
or g.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
49+
order by
50+
r.rolname, g.rolname;
51+
member | member_of (can become) | admin_option
52+
-----------------------------+------------------------+--------------
53+
pg_create_subscription | |
54+
pg_maintain | |
55+
pg_use_reserved_connections | |
56+
postgres | pg_create_subscription | f
57+
(4 rows)
58+
59+
-- Check version-specific privileges of the roles on the schemas
60+
select schema_name, privilege_type, grantee, default_for
61+
from (
62+
-- ALTER DEFAULT privileges on schemas
63+
select
64+
n.nspname as schema_name,
65+
a.privilege_type,
66+
r.rolname as grantee,
67+
d.defaclrole::regrole as default_for,
68+
case when n.nspname = 'public' then 0 else 1 end as schema_order
69+
from
70+
pg_default_acl d
71+
join
72+
pg_namespace n on d.defaclnamespace = n.oid
73+
cross join lateral aclexplode(d.defaclacl) as a
74+
join
75+
pg_roles r on a.grantee = r.oid
76+
where
77+
a.privilege_type = 'MAINTAIN'
78+
) sub
79+
order by schema_order, schema_name, privilege_type, grantee, default_for;
80+
schema_name | privilege_type | grantee | default_for
81+
----------------+----------------+--------------------+---------------------
82+
public | MAINTAIN | anon | supabase_admin
83+
public | MAINTAIN | anon | postgres
84+
public | MAINTAIN | authenticated | supabase_admin
85+
public | MAINTAIN | authenticated | postgres
86+
public | MAINTAIN | postgres | supabase_admin
87+
public | MAINTAIN | postgres | postgres
88+
public | MAINTAIN | service_role | supabase_admin
89+
public | MAINTAIN | service_role | postgres
90+
auth | MAINTAIN | dashboard_user | supabase_auth_admin
91+
auth | MAINTAIN | postgres | supabase_auth_admin
92+
extensions | MAINTAIN | postgres | supabase_admin
93+
graphql | MAINTAIN | anon | supabase_admin
94+
graphql | MAINTAIN | authenticated | supabase_admin
95+
graphql | MAINTAIN | postgres | supabase_admin
96+
graphql | MAINTAIN | service_role | supabase_admin
97+
graphql_public | MAINTAIN | anon | supabase_admin
98+
graphql_public | MAINTAIN | authenticated | supabase_admin
99+
graphql_public | MAINTAIN | postgres | supabase_admin
100+
graphql_public | MAINTAIN | service_role | supabase_admin
101+
pgsodium | MAINTAIN | pgsodium_keyholder | supabase_admin
102+
pgsodium_masks | MAINTAIN | pgsodium_keyiduser | supabase_admin
103+
realtime | MAINTAIN | dashboard_user | supabase_admin
104+
realtime | MAINTAIN | postgres | supabase_admin
105+
repack | MAINTAIN | postgres | supabase_admin
106+
storage | MAINTAIN | anon | postgres
107+
storage | MAINTAIN | authenticated | postgres
108+
storage | MAINTAIN | postgres | postgres
109+
storage | MAINTAIN | service_role | postgres
110+
(28 rows)
111+

‎nix/tests/sql/roles.sql‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
-- Some predefined roles don't exist in earlier versions of Postgres, so we
2+
-- exclude them in this test file. They're tested in version-specific test files
3+
-- (z_<ver>_roles.sql).
4+
--
5+
-- Currently those roles are:
6+
-- pg_create_subscription, pg_maintain, pg_use_reserved_connections
7+
18
-- all roles and attributes
29
select
310
rolname,
@@ -11,15 +18,13 @@ select
1118
rolbypassrls ,
1219
rolvaliduntil
1320
from pg_roles r
14-
-- TODO: this exclusion is to maintain compat with pg17, we should cover it
1521
where rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
1622
order by rolname;
1723

1824
select
1925
rolname,
2026
rolconfig
2127
from pg_roles r
22-
-- TODO: this exclusion is to maintain compat with pg17, we should cover it
2328
where rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
2429
order by rolname;
2530

@@ -34,8 +39,8 @@ left join
3439
pg_auth_members m on r.oid = m.member
3540
left join
3641
pg_roles g on m.roleid = g.oid
37-
-- TODO: this exclusion is to maintain compat with pg17, we should cover it
3842
where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
43+
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
3944
order by
4045
r.rolname, g.rolname;
4146

@@ -57,7 +62,8 @@ from (
5762
join
5863
pg_roles r on a.grantee = r.oid
5964
where
60-
a.privilege_type != 'MAINTAIN' -- TODO: this is to maintain compat with pg17, we should cover it
65+
-- PG17+, handled in version-specific test files
66+
a.privilege_type != 'MAINTAIN'
6167
union all
6268
-- explicit grant usage and create on the schemas
6369
select

‎nix/tests/sql/z_17_roles.sql‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
-- version-specific roles and attributes
2+
select
3+
rolname,
4+
rolcreaterole ,
5+
rolcanlogin ,
6+
rolsuper ,
7+
rolinherit ,
8+
rolcreatedb ,
9+
rolreplication ,
10+
rolconnlimit ,
11+
rolbypassrls ,
12+
rolvaliduntil
13+
from pg_roles r
14+
where rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
15+
order by rolname;
16+
17+
select
18+
rolname,
19+
rolconfig
20+
from pg_roles r
21+
where rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
22+
order by rolname;
23+
24+
-- version-specific role memberships
25+
select
26+
r.rolname as member,
27+
g.rolname as "member_of (can become)",
28+
m.admin_option
29+
from
30+
pg_roles r
31+
left join
32+
pg_auth_members m on r.oid = m.member
33+
left join
34+
pg_roles g on m.roleid = g.oid
35+
where r.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
36+
or g.rolname in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
37+
order by
38+
r.rolname, g.rolname;
39+
40+
-- Check version-specific privileges of the roles on the schemas
41+
select schema_name, privilege_type, grantee, default_for
42+
from (
43+
-- ALTER DEFAULT privileges on schemas
44+
select
45+
n.nspname as schema_name,
46+
a.privilege_type,
47+
r.rolname as grantee,
48+
d.defaclrole::regrole as default_for,
49+
case when n.nspname = 'public' then 0 else 1 end as schema_order
50+
from
51+
pg_default_acl d
52+
join
53+
pg_namespace n on d.defaclnamespace = n.oid
54+
cross join lateral aclexplode(d.defaclacl) as a
55+
join
56+
pg_roles r on a.grantee = r.oid
57+
where
58+
a.privilege_type = 'MAINTAIN'
59+
) sub
60+
order by schema_order, schema_name, privilege_type, grantee, default_for;

0 commit comments

Comments
 (0)