feat: add config db-hoisted-tx-settings to allow only hoisted function settings

test/io/__snapshots__/test_cli/test_schema_cache_snapshot[dbRoutines].yaml

@@ -59,31 +59,32 @@
       pdSchema: public
       pdVolatility: Volatile
 
-- - qiName: multiple_func_settings_test
+- - qiName: rpc_with_one_hoisted
     qiSchema: public
   - - pdDescription: null
       pdFuncSettings:
-      - - work_mem
-        - '5000'
       - - statement_timeout
-        - 10s
+        - 7s
       pdHasVariadic: false
-      pdName: multiple_func_settings_test
+      pdName: rpc_with_one_hoisted
       pdParams: []
       pdReturnType:
         contents:
           contents:
-            qiName: record
-            qiSchema: pg_catalog
-          tag: Scalar
-        tag: SetOf
+          - qiName: items
+            qiSchema: public
+          - false
+          tag: Composite
+        tag: Single
       pdSchema: public
       pdVolatility: Volatile
 
 - - qiName: serializable_isolation_level
     qiSchema: public
   - - pdDescription: null
-      pdFuncSettings: []
+      pdFuncSettings:
+      - - default_transaction_isolation
+        - serializable
       pdHasVariadic: false
       pdName: serializable_isolation_level
       pdParams: []
@@ -170,6 +171,26 @@
       pdSchema: public
       pdVolatility: Volatile
 
+- - qiName: rpc_with_two_hoisted
+    qiSchema: public
+  - - pdDescription: null
+      pdFuncSettings:
+      - - statement_timeout
+        - 10s
+      pdHasVariadic: false
+      pdName: rpc_with_two_hoisted
+      pdParams: []
+      pdReturnType:
+        contents:
+          contents:
+          - qiName: items
+            qiSchema: public
+          - false
+          tag: Composite
+        tag: Single
+      pdSchema: public
+      pdVolatility: Volatile
+
 - - qiName: set_statement_timeout
     qiSchema: public
   - - pdDescription: null
@@ -219,25 +240,6 @@
       pdSchema: public
       pdVolatility: Volatile
 
-- - qiName: work_mem_test
-    qiSchema: public
-  - - pdDescription: null
-      pdFuncSettings:
-      - - work_mem
-        - 6000kB
-      pdHasVariadic: false
-      pdName: work_mem_test
-      pdParams: []
-      pdReturnType:
-        contents:
-          contents:
-            qiName: text
-            qiSchema: pg_catalog
-          tag: Scalar
-        tag: Single
-      pdSchema: public
-      pdVolatility: Volatile
-
 - - qiName: invalid_role_claim_key_reload
     qiSchema: public
   - - pdDescription: null
@@ -348,7 +350,9 @@
 - - qiName: repeatable_read_isolation_level
     qiSchema: public
   - - pdDescription: null
-      pdFuncSettings: []
+      pdFuncSettings:
+      - - default_transaction_isolation
+        - REPEATABLE READ
       pdHasVariadic: false
       pdName: repeatable_read_isolation_level
       pdParams: []
@@ -454,6 +458,24 @@
       pdSchema: public
       pdVolatility: Volatile
 
+- - qiName: rpc_work_mem
+    qiSchema: public
+  - - pdDescription: null
+      pdFuncSettings: []
+      pdHasVariadic: false
+      pdName: rpc_work_mem
+      pdParams: []
+      pdReturnType:
+        contents:
+          contents:
+          - qiName: items
+            qiSchema: public
+          - false
+          tag: Composite
+        tag: Single
+      pdSchema: public
+      pdVolatility: Volatile
+
 - - qiName: four_sec_timeout
     qiSchema: public
   - - pdDescription: null

test/io/configs/expected/aliases.config

@@ -3,6 +3,7 @@ db-anon-role = ""
 db-channel = "pgrst"
 db-channel-enabled = true
 db-extra-search-path = "public"
+db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
 db-max-rows = 1000
 db-plan-enabled = false
 db-pool = 10

test/io/configs/expected/boolean-numeric.config

@@ -3,6 +3,7 @@ db-anon-role = ""
 db-channel = "pgrst"
 db-channel-enabled = true
 db-extra-search-path = "public"
+db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
 db-max-rows = ""
 db-plan-enabled = false
 db-pool = 10

test/io/configs/expected/boolean-string.config

@@ -3,6 +3,7 @@ db-anon-role = ""
 db-channel = "pgrst"
 db-channel-enabled = true
 db-extra-search-path = "public"
+db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
 db-max-rows = ""
 db-plan-enabled = false
 db-pool = 10

test/io/configs/expected/defaults.config

@@ -3,6 +3,7 @@ db-anon-role = ""
 db-channel = "pgrst"
 db-channel-enabled = true
 db-extra-search-path = "public"
+db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
 db-max-rows = ""
 db-plan-enabled = false
 db-pool = 10

test/io/configs/expected/no-defaults-with-db-other-authenticator.config

@@ -3,6 +3,7 @@ db-anon-role = "pre_config_role"
 db-channel = "postgrest"
 db-channel-enabled = false
 db-extra-search-path = "public,extensions,other"
+db-hoisted-tx-settings = "maintenance_work_mem"
 db-max-rows = 100
 db-plan-enabled = true
 db-pool = 1

test/io/configs/expected/no-defaults-with-db.config

@@ -3,6 +3,7 @@ db-anon-role = "anonymous"
 db-channel = "postgrest"
 db-channel-enabled = false
 db-extra-search-path = "public,extensions,private"
+db-hoisted-tx-settings = "autovacuum_work_mem"
 db-max-rows = 500
 db-plan-enabled = false
 db-pool = 1

test/io/configs/expected/no-defaults.config

@@ -3,6 +3,7 @@ db-anon-role = "root"
 db-channel = "postgrest"
 db-channel-enabled = false
 db-extra-search-path = "public,test"
+db-hoisted-tx-settings = "work_mem"
 db-max-rows = 1000
 db-plan-enabled = true
 db-pool = 1

test/io/configs/expected/types.config

@@ -3,6 +3,7 @@ db-anon-role = ""
 db-channel = "pgrst"
 db-channel-enabled = true
 db-extra-search-path = "public"
+db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
 db-max-rows = ""
 db-plan-enabled = false
 db-pool = 10

test/io/configs/no-defaults-env.yaml

@@ -5,6 +5,7 @@ PGRST_DB_ANON_ROLE: root
 PGRST_DB_CHANNEL: postgrest
 PGRST_DB_CHANNEL_ENABLED: false
 PGRST_DB_EXTRA_SEARCH_PATH: public, test
+PGRST_DB_HOISTED_TX_SETTINGS: work_mem
 PGRST_DB_MAX_ROWS: 1000
 PGRST_DB_PLAN_ENABLED: true
 PGRST_DB_POOL: 1

test/io/configs/no-defaults.config

@@ -3,6 +3,7 @@ db-anon-role = "root"
 db-channel = "postgrest"
 db-channel-enabled = false
 db-extra-search-path = "public, test"
+db-hoisted-tx-settings = "work_mem"
 db-max-rows = 1000
 db-plan-enabled = true
 db-pool = 1

test/io/db_config.sql

@@ -23,6 +23,7 @@ ALTER ROLE db_config_authenticator SET pgrst.openapi_server_proxy_uri = 'https:/
 ALTER ROLE db_config_authenticator SET pgrst.server_cors_allowed_origins = 'http://origin.com';
 ALTER ROLE db_config_authenticator SET pgrst.server_timing_enabled = 'false';
 ALTER ROLE db_config_authenticator SET pgrst.server_trace_header = 'CF-Ray';
+ALTER ROLE db_config_authenticator SET pgrst.db_hoisted_tx_settings = 'autovacuum_work_mem';
 
 -- override with database specific setting
 ALTER ROLE db_config_authenticator IN DATABASE :DBNAME SET pgrst.db_extra_search_path = 'public, extensions, private';
@@ -72,6 +73,7 @@ ALTER ROLE other_authenticator SET pgrst.openapi_server_proxy_uri = 'https://oth
 ALTER ROLE other_authenticator SET pgrst.server_cors_allowed_origins = 'http://otherorigin.com';
 ALTER ROLE other_authenticator SET pgrst.server_timing_enabled = 'true';
 ALTER ROLE other_authenticator SET pgrst.server_trace_header = 'traceparent';
+ALTER ROLE other_authenticator SET pgrst.db_hoisted_tx_settings = 'maintenance_work_mem';
 
 create schema postgrest;
 grant usage on schema postgrest to db_config_authenticator;

test/io/fixtures.sql

@@ -1,4 +1,3 @@
--- \ir big_schema.sql big schema test currently skipped, see test_io.py
 \ir db_config.sql
 
 set check_function_bodies = false; -- to allow conditionals based on the pg version
@@ -203,13 +202,27 @@ create function get_postgres_version() returns int as $$
   select current_setting('server_version_num')::int;
 $$ language sql;
 
-create or replace function work_mem_test() returns text as $$
-  select current_setting('work_mem',false);
-$$ language sql set work_mem = '6000kB';
+create or replace function rpc_work_mem() returns items as $$
+  select 1
+$$ language sql
+set work_mem = '6000';
 
-create or replace function multiple_func_settings_test() returns setof record as $$
-  select current_setting('work_mem',false) as work_mem,
-         current_setting('statement_timeout',false) as statement_timeout;
+create or replace function rpc_with_one_hoisted() returns items as $$
+  select 1
+$$ language sql
+set work_mem = '3000'
+set statement_timeout = '7s';
+
+create or replace function rpc_with_two_hoisted() returns items as $$
+  select 1
 $$ language sql
 set work_mem = '5000'
 set statement_timeout = '10s';
+
+create function get_work_mem(items) returns text as $$
+  select current_setting('work_mem', true) as work_mem
+$$ language sql;
+
+create function get_statement_timeout(items) returns text as $$
+  select current_setting('statement_timeout', true) as statement_timeout
+$$ language sql;

test/io/test_io.py

@@ -1492,19 +1492,65 @@ def test_function_setting_statement_timeout_passes(defaultenv):
 def test_function_setting_work_mem(defaultenv):
     "check function setting work_mem is applied"
 
-    with run(env=defaultenv) as postgrest:
-        response = postgrest.session.post("/rpc/work_mem_test")
+    env = {
+        **defaultenv,
+        "PGRST_DB_HOISTED_TX_SETTINGS": "work_mem",
+    }
 
-        assert response.text == '"6000kB"'
+    with run(env=env) as postgrest:
+        response = postgrest.session.get("/rpc/rpc_work_mem?select=get_work_mem")
+
+        assert response.text == '{"get_work_mem":"6000kB"}'
 
 
 def test_multiple_func_settings(defaultenv):
     "check multiple function settings are applied"
 
-    with run(env=defaultenv) as postgrest:
-        response = postgrest.session.post("/rpc/multiple_func_settings_test")
+    env = {
+        **defaultenv,
+        "PGRST_DB_HOISTED_TX_SETTINGS": "work_mem,statement_timeout",
+    }
 
-        assert response.text == '[{"work_mem":"5000kB","statement_timeout":"10s"}]'
+    with run(env=env) as postgrest:
+        response = postgrest.session.get(
+            "/rpc/rpc_with_two_hoisted?select=get_work_mem,get_statement_timeout"
+        )
+
+        assert (
+            response.text == '{"get_work_mem":"5000kB","get_statement_timeout":"10s"}'
+        )
+
+
+def test_first_hoisted_setting_is_applied(defaultenv):
+    "test that work_mem is applied and statement_timeout is not applied"
+
+    env = {
+        **defaultenv,
+        "PGRST_DB_HOISTED_TX_SETTINGS": "work_mem",  # only work_mem is hoisted
+    }
+
+    with run(env=env) as postgrest:
+        response = postgrest.session.get(
+            "/rpc/rpc_with_one_hoisted?select=get_work_mem,get_statement_timeout"
+        )
+
+        assert response.text == '{"get_work_mem":"3000kB","get_statement_timeout":"2s"}'
+
+
+def test_second_hoisted_setting_is_applied(defaultenv):
+    "test that statement_timeout is applied and work_mem is not applied"
+
+    env = {
+        **defaultenv,
+        "PGRST_DB_HOISTED_TX_SETTINGS": "statement_timeout",
+    }
+
+    with run(env=env) as postgrest:
+        response = postgrest.session.get(
+            "/rpc/rpc_with_one_hoisted?select=get_work_mem,get_statement_timeout"
+        )
+
+        assert response.text == '{"get_work_mem":"4MB","get_statement_timeout":"7s"}'
 
 
 def test_admin_metrics(defaultenv):

test/spec/SpecHelper.hs

@@ -116,6 +116,7 @@ baseCfg = let secret = Just $ encodeUtf8 "reallyreallyreallyreallyverysafe" in
   , configDbChannel                 = mempty
   , configDbChannelEnabled          = True
   , configDbExtraSearchPath         = []
+  , configDbHoistedTxSettings       = ["default_transaction_isolation","plan_filter.statement_cost_limit","statement_timeout"]
   , configDbMaxRows                 = Nothing
   , configDbPlanEnabled             = False
   , configDbPoolSize                = 10