chore: add pgbouncer test for role privileges

Author: kangmingtay

nix/tests/expected/pgbouncer.out

@@ -33,3 +33,35 @@ order by
  pgbouncer   | get_auth      | supabase_admin
 (1 row)
 
+-- Tests role privileges on the pgbouncer objects
+-- INSERT and UPDATE privileges should not be present on the pgbouncer tables for postgres and service_role, only SELECT and DELETE
+WITH schema_obj AS ( 
+  SELECT oid, nspname 
+  FROM pg_namespace 
+  WHERE nspname = 'pgbouncer' 
+) 
+SELECT 
+  s.nspname AS schema, 
+  c.relname AS object_name, 
+  acl.grantee::regrole::text AS grantee, 
+  acl.privilege_type 
+FROM pg_class c 
+JOIN schema_obj s ON s.oid = c.relnamespace 
+CROSS JOIN LATERAL aclexplode(c.relacl) AS acl 
+WHERE c.relkind IN ('r', 'v', 'm', 'f', 'p') 
+  AND acl.privilege_type <> 'MAINTAIN' 
+UNION ALL 
+SELECT 
+  s.nspname AS schema, 
+  p.proname AS object_name, 
+  acl.grantee::regrole::text AS grantee, 
+  acl.privilege_type 
+FROM pg_proc p 
+JOIN schema_obj s ON s.oid = p.pronamespace 
+CROSS JOIN LATERAL aclexplode(p.proacl) AS acl 
+ORDER BY object_name, grantee, privilege_type; 
+ schema   | object_name |    grantee     | privilege_type
+-----------+-------------+----------------+----------------
+ pgbouncer | get_auth    | pgbouncer      | EXECUTE
+ pgbouncer | get_auth    | postgres       | EXECUTE
+ pgbouncer | get_auth    | supabase_admin | EXECUTE

nix/tests/sql/pgbouncer.sql

@@ -24,3 +24,31 @@ where
   n.nspname = 'pgbouncer'
 order by
   p.proname;
+
+-- Tests role privileges on the pgbouncer objects
+-- INSERT and UPDATE privileges should not be present on the pgbouncer tables for postgres and service_role, only SELECT and DELETE
+WITH schema_obj AS ( 
+  SELECT oid, nspname 
+  FROM pg_namespace 
+  WHERE nspname = 'pgbouncer' 
+) 
+SELECT 
+  s.nspname AS schema, 
+  c.relname AS object_name, 
+  acl.grantee::regrole::text AS grantee, 
+  acl.privilege_type 
+FROM pg_class c 
+JOIN schema_obj s ON s.oid = c.relnamespace 
+CROSS JOIN LATERAL aclexplode(c.relacl) AS acl 
+WHERE c.relkind IN ('r', 'v', 'm', 'f', 'p') 
+  AND acl.privilege_type <> 'MAINTAIN' 
+UNION ALL 
+SELECT 
+  s.nspname AS schema, 
+  p.proname AS object_name, 
+  acl.grantee::regrole::text AS grantee, 
+  acl.privilege_type 
+FROM pg_proc p 
+JOIN schema_obj s ON s.oid = p.pronamespace 
+CROSS JOIN LATERAL aclexplode(p.proacl) AS acl 
+ORDER BY object_name, grantee, privilege_type;