diff --git a/ansible/vars.yml b/ansible/vars.yml index 06522a8d1..2f749e143 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -9,9 +9,9 @@ postgres_major: # Full version strings for each major version postgres_release: - postgresorioledb-17: "17.0.1.102-orioledb" - postgres17: "17.4.1.052" - postgres15: "15.8.1.109" + postgresorioledb-17: "17.0.1.103-orioledb" + postgres17: "17.4.1.053" + postgres15: "15.8.1.110" # Non Postgres Extensions pgbouncer_release: "1.19.0" diff --git a/migrations/db/migrations/20250709135250_grant_storage_schema_to_postgres_with_grant_option.sql b/migrations/db/migrations/20250709135250_grant_storage_schema_to_postgres_with_grant_option.sql new file mode 100644 index 000000000..604ff998e --- /dev/null +++ b/migrations/db/migrations/20250709135250_grant_storage_schema_to_postgres_with_grant_option.sql @@ -0,0 +1,4 @@ +-- migrate:up +grant usage on schema storage to postgres with grant option; + +-- migrate:down diff --git a/nix/tests/expected/storage.out b/nix/tests/expected/storage.out index fc1882923..c6edf49e1 100644 --- a/nix/tests/expected/storage.out +++ b/nix/tests/expected/storage.out @@ -206,3 +206,24 @@ select * from storage.migrations ; ----+------+------+------------- (0 rows) +-- postgres can grant storage privileges to custom roles +create role r; +grant r to postgres with admin option; +set role r; +select * from storage.buckets; +ERROR: permission denied for schema storage +LINE 1: select * from storage.buckets; + ^ +set role postgres; +grant usage on schema storage to r; +grant select on storage.buckets to r; +set role r; +select * from storage.buckets; + id | name | owner | created_at | updated_at +----+------+-------+------------+------------ +(0 rows) + +set role postgres; +drop owned by r cascade; +drop role r; +reset role; diff --git a/nix/tests/sql/storage.sql b/nix/tests/sql/storage.sql index b9d80820f..770741844 100644 --- a/nix/tests/sql/storage.sql +++ b/nix/tests/sql/storage.sql @@ -95,3 +95,22 @@ order by -- storage service migrations select * from storage.migrations ; + +-- postgres can grant storage privileges to custom roles +create role r; +grant r to postgres with admin option; + +set role r; +select * from storage.buckets; + +set role postgres; +grant usage on schema storage to r; +grant select on storage.buckets to r; + +set role r; +select * from storage.buckets; + +set role postgres; +drop owned by r cascade; +drop role r; +reset role;