Restrict db settings to current db and global

Global settings are overriden by database specific settings if they
share common ones.

test/fixtures/roles.sql

@@ -21,6 +21,15 @@ ALTER ROLE postgrest_test_authenticator SET pgrst."db_pre_request" = 'test.custo
 ALTER ROLE postgrest_test_authenticator SET pgrst."db_max_rows" = '1000';
 ALTER ROLE postgrest_test_authenticator SET pgrst."db_extra_search_path" = 'public, extensions';
 
+-- override with database specific setting
+ALTER ROLE postgrest_test_authenticator IN DATABASE :DBNAME SET pgrst."jwt_secret" = 'OVERRIDEREALLYREALLYREALLYREALLYVERYSAFE';
+ALTER ROLE postgrest_test_authenticator IN DATABASE :DBNAME SET pgrst."db_extra_search_path" = 'public, extensions, private';
+
+-- other database settings that should be ignored
+DROP DATABASE IF EXISTS other;
+CREATE DATABASE other;
+ALTER ROLE postgrest_test_authenticator IN DATABASE other SET pgrst."db_max_rows" = '1111';
+
 -- non-reloadable configs for io tests
 ALTER ROLE postgrest_test_authenticator SET pgrst."server_host" = 'ignored';
 ALTER ROLE postgrest_test_authenticator SET pgrst."server_port" = 'ignored';

test/io-tests/configs/expected/no-defaults-with-db.config

@@ -1,7 +1,7 @@
 db-anon-role = "postgrest_test_anonymous"
 db-channel = "postgrest"
 db-channel-enabled = true
-db-extra-search-path = "public,extensions"
+db-extra-search-path = "public,extensions,private"
 db-max-rows = 1000
 db-pool = 1
 db-pool-timeout = 100
@@ -14,7 +14,7 @@ db-tx-end = "commit-allow-override"
 db-uri = "<REPLACED_WITH_DB_URI>"
 jwt-aud = "https://example.org"
 jwt-role-claim-key = ".\"a\".\"role\""
-jwt-secret = "REALLYREALLYREALLYREALLYVERYSAFE"
+jwt-secret = "OVERRIDEREALLYREALLYREALLYREALLYVERYSAFE"
 jwt-secret-is-base64 = true
 log-level = "info"
 openapi-server-proxy-uri = "https://example.org/api"

test/io-tests/test_io.py

@@ -309,10 +309,10 @@ def test_read_db_setting(defaultenv):
         "PGRST_DB_LOAD_GUC_CONFIG": "true",
     }
     with run(env=env) as postgrest:
-        uri = "/rpc/get_guc_value?name=pgrst.db_max_rows"
+        uri = "/rpc/get_guc_value?name=pgrst.jwt_secret"
         response = postgrest.session.get(uri)
 
-        assert response.text == '"1000"'
+        assert response.text == '"OVERRIDEREALLYREALLYREALLYREALLYVERYSAFE"'
 
 
 @pytest.mark.parametrize(