diff --git a/CHANGELOG.md b/CHANGELOG.md index e240728c7..66b3db0fd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -39,6 +39,7 @@ This project adheres to [Semantic Versioning](http://semver.org/). - #1586, Fix function parameters of type character and bit not ignoring length - @laurenceisla + Fixes the error "value too long for type character(1)" when the char length of the parameter was bigger than one. - #2881, Fix error when a function returns `RECORD` or `SET OF RECORD` - @laurenceisla + - #2896, Fix applying superuser settings for impersonated role - @steve-chavez ## [11.1.0] - 2023-06-07 diff --git a/src/PostgREST/Config/Database.hs b/src/PostgREST/Config/Database.hs index 9356cc4a2..25a64fb76 100644 --- a/src/PostgREST/Config/Database.hs +++ b/src/PostgREST/Config/Database.hs @@ -156,6 +156,7 @@ queryRoleSettings prepared = i.value as iso_lvl, array_agg(row(kv.key, kv.value)) filter (where key <> 'default_transation_isolation') as role_settings from kv_settings kv + join pg_settings ps on ps.name = kv.key and ps.context = 'user' left join iso_setting i on i.rolname = kv.rolname group by kv.rolname, i.value; |] diff --git a/test/io/fixtures.sql b/test/io/fixtures.sql index 20f89a1fa..7315ee5ee 100644 --- a/test/io/fixtures.sql +++ b/test/io/fixtures.sql @@ -14,7 +14,14 @@ alter role postgrest_test_serializable set default_transaction_isolation = 'seri CREATE ROLE postgrest_test_repeatable_read; alter role postgrest_test_repeatable_read set default_transaction_isolation = 'REPEATABLE READ'; -GRANT postgrest_test_anonymous, postgrest_test_author, postgrest_test_serializable, postgrest_test_repeatable_read TO :PGUSER; +CREATE ROLE postgrest_test_w_superuser_settings; +alter role postgrest_test_w_superuser_settings set log_min_duration_statement = 1; +alter role postgrest_test_w_superuser_settings set log_min_messages = 'fatal'; + +GRANT + postgrest_test_anonymous, postgrest_test_author, + postgrest_test_serializable, postgrest_test_repeatable_read, + postgrest_test_w_superuser_settings TO :PGUSER; CREATE SCHEMA v1; GRANT USAGE ON SCHEMA v1 TO postgrest_test_anonymous; @@ -23,7 +30,7 @@ CREATE TABLE authors_only (); GRANT SELECT ON authors_only TO postgrest_test_author; CREATE TABLE projects AS SELECT FROM generate_series(1,5); -GRANT SELECT ON projects TO postgrest_test_anonymous; +GRANT SELECT ON projects TO postgrest_test_anonymous, postgrest_test_w_superuser_settings; create function get_guc_value(name text) returns text as $$ select nullif(current_setting(name), '')::text; diff --git a/test/io/test_io.py b/test/io/test_io.py index ff4538f5c..036e074f2 100644 --- a/test/io/test_io.py +++ b/test/io/test_io.py @@ -1051,3 +1051,15 @@ def test_log_postgrest_version(defaultenv): "Starting PostgREST %s..." % version in postgrest.process.stdout.readline().decode() ) + + +def test_succeed_w_role_having_superuser_settings(defaultenv): + "Should succeed when having superuser settings on the impersonated role" + + env = {**defaultenv, "PGRST_DB_CONFIG": "true", "PGRST_JWT_SECRET": SECRET} + + with run(stdin=SECRET.encode(), env=env) as postgrest: + headers = jwtauthheader({"role": "postgrest_test_w_superuser_settings"}, SECRET) + response = postgrest.session.get("/projects", headers=headers) + print(response.text) + assert response.status_code == 200