You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: META.json
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
{
2
2
"name": "supautils",
3
3
"abstract": "Unlock advanced Postgres features without granting SUPERUSER access",
4
-
"description": "Loadable library that allows creating event triggers, publications, and other highly privileged database objects on cloud deployments where giving SUPERUSER rights to end users isn’t an option",
4
+
"description": "Loadable library that securely allows creating event triggers, publications, extensions to non-superusers",
Supautils is an extension that unlocks advanced Postgres features without granting SUPERUSER access.
6
7
7
-
It's a loadable library that allows creating event triggers, publications, and other highly privileged database objects on cloud deployments where giving SUPERUSER rights to end users isn’t an option.
8
+
It's a loadable library that securely allows creating event triggers, publications, extensions to non-superusers. Built for cloud deployments where giving SUPERUSER rights to end users isn’t an option.
8
9
9
-
It's managed entirely by configuration — no tables, functions, or security labels are added to your database. That makes upgrades effortless and lets you apply settings cluster-wide solely via `postgresql.conf`.
10
-
11
-
Tested to work on PostgreSQL 13, 14, 15, 16 and 17.
10
+
Completely managed by configuration — no tables, functions, or security labels are added to your database. This makes upgrades effortless and lets you apply settings cluster-wide solely via `postgresql.conf`.
12
11
13
12
## Installation
14
13
@@ -22,6 +21,7 @@ To make supautils available to the whole cluster, you can add the following to `
@@ -42,22 +46,57 @@ ALTER ROLE role1 SET session_preload_libraries TO 'supautils';
42
46
43
47
### Privileged Role
44
48
45
-
PostgreSQL doesn't allow non-superusers to create certain database objects like publications, foreign data wrappers or event triggers. supautils allows creating these by configuring a `supautils.privileged_role`.
46
-
This role is a proxy role for a SUPERUSER, which is configured by `supautils.superuser` (defaults to the bootstrap user, i.e. the role used to bootstrap the Postgres cluster).
49
+
The privileged role is a proxy role for a SUPERUSER, which is configured by `supautils.superuser` (defaults to the bootstrap user, i.e. the role used to start the Postgres cluster).
50
+
51
+
When the privileged role creates a superuser-only database object (like publications):
52
+
53
+
- supautils will switch the role to the `supautils.superuser`, allowing the operation and creating the database object.
54
+
+ In cases like event triggers, it will add additional protections. See [Non-Superuser Event Triggers](#non-superuser-event-triggers).
55
+
- It will change the ownership of the database object to the privileged role.
56
+
- Finally, supautils will switch back to the privileged role.
57
+
58
+
### Non-Superuser Publications
59
+
60
+
The privileged role can create publications. Once created they will be owned by the privileged role.
47
61
48
-
#### Non-Superuser Publications
62
+
```sql
63
+
set role privileged_role;
64
+
select current_setting('is_superuser');
65
+
current_setting
66
+
-----------------
67
+
off
68
+
(1 row)
49
69
50
-
The privileged role can create publications. When it executes `create publication`, supautils will detect the statement and:
70
+
create publication p for all tables;
71
+
CREATE PUBLICATION
51
72
52
-
- It will switch to the `supautils.superuser`, allowing the operation and creating the publication.
53
-
- It will change the ownership of the publication to the privileged role.
54
-
- Finally, it will switch back to the privileged role.
73
+
drop publication p;
74
+
DROP PUBLICATION
75
+
```
55
76
56
-
####Non-Superuser Foreign Data Wrappers
77
+
### Non-Superuser Foreign Data Wrappers
57
78
58
-
The privileged role can also execute `create foreign data wrapper..`, the logic followed is analogous to publication creation.
79
+
The privileged role can create FDWs.
59
80
60
-
#### Non-Superuser Event Triggers
81
+
82
+
```sql
83
+
set role privileged_role;
84
+
select current_setting('is_superuser');
85
+
current_setting
86
+
-----------------
87
+
off
88
+
(1 row)
89
+
90
+
create extension postgres_fdw;
91
+
CREATE EXTENSION
92
+
93
+
create foreign data wrapper new_fdw
94
+
handler postgres_fdw_handler
95
+
validator postgres_fdw_validator;
96
+
CREATE FOREIGN DATA WRAPPER
97
+
```
98
+
99
+
### Non-Superuser Event Triggers
61
100
62
101
The privileged role is also able to create event triggers, while adding protection for privilege escalation.
63
102
@@ -72,17 +111,24 @@ The skipping behavior can be logged by setting the `supautils.log_skipped_evtrig
72
111
Superuser event triggers work as usual, with the additional restriction that the event trigger function must be owned by a superuser.
73
112
74
113
```sql
114
+
set role privileged_role;
115
+
select current_setting('is_superuser');
116
+
current_setting
117
+
-----------------
118
+
off
119
+
(1 row)
120
+
75
121
create event trigger evtrig on ddl_command_end
76
122
execute procedure func(); -- func must be owned by the superuser
123
+
CREATE EVENT TRIGGER
77
124
```
78
125
79
126
The privileged role won't be able to ALTER or DROP a superuser event trigger.
80
127
81
128
> [!IMPORTANT]
82
-
> Limitation: privileged role event triggers won't fire when creating publications, foreign data wrappers or extensions.
83
-
> This is due to implementation details, since supautils has to switch to `supautils.superuser` when creating the above database objects, and we have to skip privileged role event triggers here to avoid privilege escalation.
129
+
> Limitation: privileged role event triggers won't fire when creating publications, foreign data wrappers or extensions. See https://github.com/supabase/supautils/issues/123.
84
130
85
-
####Non-Superuser Settings
131
+
### Non-Superuser Settings
86
132
87
133
Certain settings like `session_replication_role` can only be set by superusers. The privileged role can be allowed to change these settings by listing them in:
0 commit comments