test: prove that authenticator is not a superuser

postgrest.cabal

@@ -187,6 +187,7 @@ test-suite spec
                       Feature.CorsSpec
                       Feature.ExtraSearchPathSpec
                       Feature.LegacyGucsSpec
+                      Feature.NoSuperuserSpec
                       Feature.ObservabilitySpec
                       Feature.OpenApi.DisabledOpenApiSpec
                       Feature.OpenApi.IgnorePrivOpenApiSpec

test/spec/Feature/NoSuperuserSpec.hs

@@ -0,0 +1,20 @@
+module Feature.NoSuperuserSpec where
+
+import Network.Wai (Application)
+
+import Network.HTTP.Types
+import Test.Hspec
+import Test.Hspec.Wai
+
+import Protolude
+
+spec :: SpecWith ((), Application)
+spec =
+  describe "No Superuser" $ do
+    it "proves that the authenticator role is not a superuser" $ do
+      request methodGet "/rpc/is_superuser"
+          mempty
+          ""
+        `shouldRespondWith`
+          "false"
+          { matchStatus = 200 }

test/spec/Main.hs

@@ -27,6 +27,7 @@ import qualified Feature.ConcurrentSpec
 import qualified Feature.CorsSpec
 import qualified Feature.ExtraSearchPathSpec
 import qualified Feature.LegacyGucsSpec
+import qualified Feature.NoSuperuserSpec
 import qualified Feature.ObservabilitySpec
 import qualified Feature.OpenApi.DisabledOpenApiSpec
 import qualified Feature.OpenApi.IgnorePrivOpenApiSpec
@@ -149,6 +150,7 @@ main = do
         , ("Feature.Query.ComputedRelsSpec"              , Feature.Query.ComputedRelsSpec.spec)
         , ("Feature.Query.RelatedQueriesSpec"            , Feature.Query.RelatedQueriesSpec.spec)
         , ("Feature.Query.SpreadQueriesSpec"             , Feature.Query.SpreadQueriesSpec.spec)
+        , ("Feature.NoSuperuserSpec"                     , Feature.NoSuperuserSpec.spec)
         ]
 
   hspec $ do

test/spec/fixtures/schema.sql

@@ -3122,3 +3122,9 @@ BEGIN
   END IF;
 END
 $do$;
+
+CREATE FUNCTION test.is_superuser() RETURNS boolean
+LANGUAGE sql
+AS $$
+  select current_setting('is_superuser')::boolean;
+$$;