feat: add pre-config function

Allows using the in-database configuration without SUPERUSER

test/io/configs/expected/aliases.config

@@ -13,6 +13,7 @@ db-prepared-statements = true
 db-root-spec = "open_alias"
 db-schemas = "provided_through_alias"
 db-config = true
+db-pre-config = ""
 db-tx-end = "commit"
 db-uri = "postgresql://"
 db-use-legacy-gucs = true

test/io/configs/expected/boolean-numeric.config

@@ -13,6 +13,7 @@ db-prepared-statements = false
 db-root-spec = ""
 db-schemas = "public"
 db-config = true
+db-pre-config = ""
 db-tx-end = "commit"
 db-uri = "postgresql://"
 db-use-legacy-gucs = true

test/io/configs/expected/boolean-string.config

@@ -13,6 +13,7 @@ db-prepared-statements = false
 db-root-spec = ""
 db-schemas = "public"
 db-config = true
+db-pre-config = ""
 db-tx-end = "commit"
 db-uri = "postgresql://"
 db-use-legacy-gucs = true

test/io/configs/expected/defaults.config

@@ -13,6 +13,7 @@ db-prepared-statements = true
 db-root-spec = ""
 db-schemas = "public"
 db-config = false
+db-pre-config = ""
 db-tx-end = "commit"
 db-uri = "postgresql://"
 db-use-legacy-gucs = true

test/io/configs/expected/no-defaults-with-db-other-authenticator.config

@@ -1,4 +1,4 @@
-db-anon-role = "other"
+db-anon-role = "pre_config_role"
 db-channel = "postgrest"
 db-channel-enabled = false
 db-extra-search-path = "public,extensions,other"
@@ -13,11 +13,12 @@ db-prepared-statements = false
 db-root-spec = "other_root"
 db-schemas = "test,other_tenant1,other_tenant2"
 db-config = true
+db-pre-config = "postgrest.pre_config"
 db-tx-end = "rollback-allow-override"
 db-uri = "postgresql://"
 db-use-legacy-gucs = false
 jwt-aud = "https://otherexample.org"
-jwt-role-claim-key = ".\"other\".\"role\""
+jwt-role-claim-key = ".\"other\".\"pre_config_role\""
 jwt-secret = "ODERREALLYREALLYREALLYREALLYVERYSAFE"
 jwt-secret-is-base64 = true
 log-level = "info"

test/io/configs/expected/no-defaults-with-db.config

@@ -13,6 +13,7 @@ db-prepared-statements = false
 db-root-spec = "root"
 db-schemas = "test,tenant1,tenant2"
 db-config = true
+db-pre-config = "postgrest.preconf"
 db-tx-end = "commit-allow-override"
 db-uri = "postgresql://"
 db-use-legacy-gucs = false

test/io/configs/expected/no-defaults.config

@@ -13,6 +13,7 @@ db-prepared-statements = false
 db-root-spec = "openapi_v3"
 db-schemas = "multi,tenant,setup"
 db-config = false
+db-pre-config = "postgrest.pre_config"
 db-tx-end = "rollback-allow-override"
 db-uri = "tmp_db"
 db-use-legacy-gucs = false

test/io/configs/expected/types.config

@@ -13,6 +13,7 @@ db-prepared-statements = true
 db-root-spec = ""
 db-schemas = "public"
 db-config = true
+db-pre-config = ""
 db-tx-end = "commit"
 db-uri = "postgresql://"
 db-use-legacy-gucs = true

test/io/configs/no-defaults-env.yaml

@@ -15,9 +15,9 @@ PGRST_DB_PRE_REQUEST: please_run_fast
 PGRST_DB_ROOT_SPEC: openapi_v3
 PGRST_DB_SCHEMAS: multi,   tenant,setup
 PGRST_DB_CONFIG: false
+PGRST_DB_PRE_CONFIG: "postgrest.pre_config"
 PGRST_DB_TX_END: rollback-allow-override
 PGRST_DB_URI: tmp_db
-PGRST_DB_EMBED_DEFAULT_JOIN: inner
 PGRST_DB_USE_LEGACY_GUCS: false
 PGRST_JWT_AUD: 'https://postgrest.org'
 PGRST_JWT_ROLE_CLAIM_KEY: '.user[0]."real-role"'

test/io/configs/no-defaults.config

@@ -13,6 +13,7 @@ db-prepared-statements = false
 db-root-spec = "openapi_v3"
 db-schemas = "multi,   tenant,setup"
 db-config = false
+db-pre-config = "postgrest.pre_config"
 db-tx-end = "rollback-allow-override"
 db-uri = "tmp_db"
 db-use-legacy-gucs = false

test/io/db_config.sql

@@ -9,6 +9,7 @@ ALTER ROLE db_config_authenticator SET pgrst.jwt_secret_is_base64 = 'false';
 ALTER ROLE db_config_authenticator SET pgrst.jwt_role_claim_key = '."a"."role"';
 ALTER ROLE db_config_authenticator SET pgrst.db_anon_role = 'anonymous';
 ALTER ROLE db_config_authenticator SET pgrst.db_tx_end = 'commit-allow-override';
+ALTER ROLE db_config_authenticator SET pgrst.db_pre_config = 'postgrest.preconf';
 ALTER ROLE db_config_authenticator SET pgrst.db_schemas = 'test, tenant1, tenant2';
 ALTER ROLE db_config_authenticator SET pgrst.db_root_spec = 'root';
 ALTER ROLE db_config_authenticator SET pgrst.db_plan_enabled = 'true';
@@ -43,7 +44,7 @@ ALTER ROLE db_config_authenticator SET pgrst.db_pool_timeout = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.db_pool_acquisition_timeout = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.db_pool_max_lifetime = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.db_pool_max_idletime = 'ignored';
-ALTER ROLE db_config_authenticator SET pgrst.db_config = 'ignored';
+ALTER ROLE db_config_authenticator SET pgrst.db_config = 'true';
 
 -- other authenticator reloadable config options
 CREATE ROLE other_authenticator LOGIN NOINHERIT;
@@ -52,9 +53,6 @@ ALTER ROLE other_authenticator SET pgrst.openapi_server_proxy_uri = 'https://oth
 ALTER ROLE other_authenticator SET pgrst.raw_media_types = 'application/vnd.pgrst.other-db-config';
 ALTER ROLE other_authenticator SET pgrst.jwt_secret = 'ODERREALLYREALLYREALLYREALLYVERYSAFE';
 ALTER ROLE other_authenticator SET pgrst.jwt_secret_is_base64 = 'true';
-ALTER ROLE other_authenticator SET pgrst.jwt_role_claim_key = '."other"."role"';
-ALTER ROLE other_authenticator SET pgrst.db_anon_role = 'other';
-ALTER ROLE other_authenticator SET pgrst.db_tx_end = 'rollback-allow-override';
 ALTER ROLE other_authenticator SET pgrst.db_schemas = 'test, other_tenant1, other_tenant2';
 ALTER ROLE other_authenticator SET pgrst.db_root_spec = 'other_root';
 ALTER ROLE other_authenticator SET pgrst.db_plan_enabled = 'true';
@@ -65,6 +63,32 @@ ALTER ROLE other_authenticator SET pgrst.db_extra_search_path = 'public, extensi
 ALTER ROLE other_authenticator SET pgrst.openapi_mode = 'disabled';
 ALTER ROLE other_authenticator SET pgrst.openapi_security_active = 'false';
 ALTER ROLE other_authenticator SET pgrst.server_trace_header = 'traceparent';
+ALTER ROLE other_authenticator SET pgrst.db_pre_config = 'postgrest.pre_config';
+
+create schema postgrest;
+grant usage on schema postgrest to db_config_authenticator;
+grant usage on schema postgrest to other_authenticator;
+
+-- pre-config hook
+create or replace function postgrest.pre_config()
+returns void as $$
+begin
+  if current_user = 'other_authenticator' then
+    perform
+      set_config('pgrst.jwt_role_claim_key', '."other"."pre_config_role"', true)
+    , set_config('pgrst.db_anon_role', 'pre_config_role', true)
+    , set_config('pgrst.db_schemas', 'will be overriden with the above ALTER ROLE.. db_schemas', true)
+    , set_config('pgrst.db_tx_end', 'rollback-allow-override', true);
+  else
+    null;
+  end if;
+end $$ language plpgsql;
+
+create or replace function postgrest.preconf()
+returns void as $$
+begin
+  null;
+end $$ language plpgsql;
 
 -- authenticator used for tests that manipulate statement timeout
 CREATE ROLE timeout_authenticator LOGIN NOINHERIT;

test/spec/SpecHelper.hs

@@ -90,6 +90,7 @@ baseCfg = let secret = Just $ encodeUtf8 "reallyreallyreallyreallyverysafe" in
   , configDbRootSpec            = Nothing
   , configDbSchemas             = fromList ["test"]
   , configDbConfig              = False
+  , configDbPreConfig           = Nothing
   , configDbUri                 = "postgresql://"
   , configDbUseLegacyGucs       = True
   , configFilePath              = Nothing