fix: impersonated role applying superuser settings

CHANGELOG.md

@@ -39,6 +39,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
  - #1586, Fix function parameters of type character and bit not ignoring length - @laurenceisla
    + Fixes the error "value too long for type character(1)" when the char length of the parameter was bigger than one.
  - #2881, Fix error when a function returns `RECORD` or `SET OF RECORD` - @laurenceisla
+ - #2896, Fix applying superuser settings for impersonated role - @steve-chavez
 
 ## [11.1.0] - 2023-06-07
 

src/PostgREST/Config/Database.hs

@@ -156,6 +156,7 @@ queryRoleSettings prepared =
         i.value as iso_lvl,
         array_agg(row(kv.key, kv.value)) filter (where key <> 'default_transation_isolation') as role_settings
       from kv_settings kv
+      join pg_settings ps on ps.name = kv.key and ps.context = 'user'
       left join iso_setting i on i.rolname = kv.rolname
       group by kv.rolname, i.value;
     |]

test/io/fixtures.sql

@@ -14,7 +14,14 @@ alter role postgrest_test_serializable set default_transaction_isolation = 'seri
 CREATE ROLE postgrest_test_repeatable_read;
 alter role postgrest_test_repeatable_read set default_transaction_isolation = 'REPEATABLE READ';
 
-GRANT postgrest_test_anonymous, postgrest_test_author, postgrest_test_serializable, postgrest_test_repeatable_read TO :PGUSER;
+CREATE ROLE postgrest_test_w_superuser_settings;
+alter role postgrest_test_w_superuser_settings set log_min_duration_statement = 1;
+alter role postgrest_test_w_superuser_settings set log_min_messages = 'fatal';
+
+GRANT
+  postgrest_test_anonymous, postgrest_test_author,
+  postgrest_test_serializable, postgrest_test_repeatable_read,
+  postgrest_test_w_superuser_settings TO :PGUSER;
 
 CREATE SCHEMA v1;
 GRANT USAGE ON SCHEMA v1 TO postgrest_test_anonymous;
@@ -23,7 +30,7 @@ CREATE TABLE authors_only ();
 GRANT SELECT ON authors_only TO postgrest_test_author;
 
 CREATE TABLE projects AS SELECT FROM generate_series(1,5);
-GRANT SELECT ON projects TO postgrest_test_anonymous;
+GRANT SELECT ON projects TO postgrest_test_anonymous, postgrest_test_w_superuser_settings;
 
 create function get_guc_value(name text) returns text as $$
   select nullif(current_setting(name), '')::text;

test/io/test_io.py

@@ -1051,3 +1051,15 @@ def test_log_postgrest_version(defaultenv):
             "Starting PostgREST %s..." % version
             in postgrest.process.stdout.readline().decode()
         )
+
+
+def test_succeed_w_role_having_superuser_settings(defaultenv):
+    "Should succeed when having superuser settings on the impersonated role"
+
+    env = {**defaultenv, "PGRST_DB_CONFIG": "true", "PGRST_JWT_SECRET": SECRET}
+
+    with run(stdin=SECRET.encode(), env=env) as postgrest:
+        headers = jwtauthheader({"role": "postgrest_test_w_superuser_settings"}, SECRET)
+        response = postgrest.session.get("/projects", headers=headers)
+        print(response.text)
+        assert response.status_code == 200