test

Author: soedirgo

ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh

@@ -325,6 +325,13 @@ declare
   supabase_admin_rolpassword text := (select rolpassword from pg_authid where rolname = 'supabase_admin');
   postgres_role_settings text[] := (select setconfig from pg_db_role_setting where setdatabase = 0 and setrole = 'postgres'::regrole);
   supabase_admin_role_settings text[] := (select setconfig from pg_db_role_setting where setdatabase = 0 and setrole = 'supabase_admin'::regrole);
+  event_triggers jsonb[] := (select coalesce(array_agg(jsonb_build_object('name', evtname)), '{}') from pg_event_trigger where evtowner = 'postgres'::regrole);
+  default_acls jsonb[] := (
+    select coalesce(array_agg(jsonb_build_object('oid', d.oid, 'role', a.rolname, 'schema', n.nspname, 'objtype', d.defaclobjtype, 'acl', defaclacl::text)), '{}')
+    from pg_default_acl d
+    join pg_authid a on a.oid = d.defaclrole
+    left join pg_namespace n on n.oid = d.defaclnamespace
+  );
   schemas jsonb[] := (
     select coalesce(array_agg(jsonb_build_object('oid', n.oid, 'owner', a.rolname, 'acl', nspacl::text)), '{}')
     from pg_namespace n
@@ -438,6 +445,12 @@ begin
     execute(format('alter database %I owner to postgres;', rec.datname));
   end loop;
 
+  -- event triggers
+  foreach obj in array event_triggers
+  loop
+    execute(format('alter event trigger %I owner to postgres;', obj->>'name'));
+  end loop;
+
   -- publications
   for rec in
     select * from pg_publication
@@ -464,10 +477,51 @@ begin
   update pg_user_mapping set umuser = 'postgres'::regrole where umuser = 'supabase_admin'::regrole;
 
   -- default acls
-  -- TODO: don't modify system catalog directly
-  update pg_default_acl set defaclrole = 0 where defaclrole = 'postgres'::regrole;
-  update pg_default_acl set defaclrole = 'postgres'::regrole where defaclrole = 'supabase_admin'::regrole;
-  update pg_default_acl set defaclrole = 'supabase_admin'::regrole where defaclrole = 0;
+  foreach obj in array default_acls
+  loop
+    for rec in
+      select grantor, grantee, privilege_type, is_grantable
+      from aclexplode((obj->>'acl')::aclitem[])
+    loop
+      if obj->>'role' in ('postgres', 'supabase_admin') or rec.grantee::regrole in ('postgres', 'supabase_admin') then
+        execute(format('alter default privileges for role %I %s revoke %s on %s from %I'
+                     , case when obj->>'role' = 'postgres' then 'supabase_admin'
+                            else 'postgres'
+                       end
+                     , case when obj->>'schema' is null then ''
+                            else format('in schema %I', (obj->>'schema')::regnamespace)
+                       end
+                     , rec.privilege_type
+                     , case when obj->>'objtype' = 'r' then 'tables'
+                            when obj->>'objtype' = 'S' then 'sequences'
+                            when obj->>'objtype' = 'f' then 'functions'
+                            when obj->>'objtype' = 'T' then 'types'
+                            when obj->>'objtype' = 'n' then 'schemas'
+                       end
+                     , case when rec.grantee = 'postgres'::regrole then 'supabase_admin'
+                            when rec.grantee = 'supabase_admin'::regrole then 'postgres'
+                            else rec.grantee::regrole
+                       end
+                     ));
+
+        execute(format('alter default privileges for role %I %s grant %s on %s to %I %s'
+                     , obj->>'role'
+                     , case when obj->>'schema' is null then ''
+                            else format('in schema %I', (obj->>'schema')::regnamespace)
+                       end
+                     , rec.privilege_type
+                     , case when obj->>'objtype' = 'r' then 'tables'
+                            when obj->>'objtype' = 'S' then 'sequences'
+                            when obj->>'objtype' = 'f' then 'functions'
+                            when obj->>'objtype' = 'T' then 'types'
+                            when obj->>'objtype' = 'n' then 'schemas'
+                       end
+                     , rec.grantee::regrole
+                     , case when rec.is_grantable then 'with grant option' else '' end
+                     ));
+      end if;
+    end loop;
+  end loop;
 
   -- schemas
   foreach obj in array schemas