feat: get configuration parameters from the db

Allows configuring postgrest from the db by setting config parameters
on the connection role. For example:

ALTER ROLE postgrest_test_authenticator
SET pgrst.jwt-secret = "REALLYREALLYREALLYREALLYVERYSAFE"

The above wWill set the `jwt-secret` config option accordingly.

SUPERUSER privileges are required for ALTERing role settings,
so this might not work on some cloud-managed databases.

This feature is enabled by default, for disabling it you can add the
following to the config file:

db-load-guc-config = false

test/io-tests/configs/aliases.config

@@ -7,3 +7,4 @@ pre-request = "check_alias"
 role-claim-key = ".aliased"
 root-spec = "open_alias"
 secret-is-base64 = true
+db-load-guc-config = false

test/io-tests/configs/app-settings.config

@@ -2,3 +2,4 @@ db-pool = 1
 db-pool-timeout = 1
 
 app.settings.external_api_secret = "0123456789abcdef"
+db-load-guc-config = false

test/io-tests/configs/base64-secret-from-file.config

@@ -3,3 +3,4 @@ db-pool = 1
 # Read secret from a file: /dev/stdin (alias for standard input)
 jwt-secret = "@/dev/stdin"
 jwt-secret-is-base64 = true
+db-load-guc-config = false

test/io-tests/configs/boolean-numeric.config

@@ -5,3 +5,4 @@ db-anon-role = "required"
 db-channel-enabled = "1"
 db-prepared-statements = "0"
 jwt-secret-is-base64 = "2"
+db-load-guc-config = false

test/io-tests/configs/boolean-string.config

@@ -5,3 +5,4 @@ db-anon-role = "required"
 db-channel-enabled = "true"
 db-prepared-statements = "FALSE"
 jwt-secret-is-base64 = "\"true\""
+db-load-guc-config = false

test/io-tests/configs/dburi-from-file.config

@@ -1,3 +1,4 @@
 db-uri = "@/dev/stdin"
 db-pool = 1
 jwt-secret = "reallyreallyreallyreallyverysafe"
+db-load-guc-config = false

test/io-tests/configs/defaults.config

@@ -1,3 +1,5 @@
 db-uri = "required"
 db-schemas = "required"
 db-anon-role = "required"
+# Not the default, but only works with proper db-uri
+db-load-guc-config = false

test/io-tests/configs/expected/aliases.config

@@ -9,6 +9,7 @@ db-pre-request = "check_alias"
 db-prepared-statements = true
 db-root-spec = "open_alias"
 db-schemas = "provided_through_alias"
+db-load-guc-config = "false"
 db-tx-end = "commit"
 db-uri = "required"
 jwt-aud = ""

test/io-tests/configs/expected/boolean-numeric.config

@@ -9,6 +9,7 @@ db-pre-request = ""
 db-prepared-statements = false
 db-root-spec = ""
 db-schemas = "required"
+db-load-guc-config = "false"
 db-tx-end = "commit"
 db-uri = "required"
 jwt-aud = ""

test/io-tests/configs/expected/boolean-string.config

@@ -9,6 +9,7 @@ db-pre-request = ""
 db-prepared-statements = false
 db-root-spec = ""
 db-schemas = "required"
+db-load-guc-config = "false"
 db-tx-end = "commit"
 db-uri = "required"
 jwt-aud = ""

test/io-tests/configs/expected/defaults.config

@@ -9,6 +9,7 @@ db-pre-request = ""
 db-prepared-statements = true
 db-root-spec = ""
 db-schemas = "required"
+db-load-guc-config = "false"
 db-tx-end = "commit"
 db-uri = "required"
 jwt-aud = ""

test/io-tests/configs/expected/no-defaults-with-db.config

@@ -0,0 +1,27 @@
+db-anon-role = "postgrest_test_anonymous"
+db-channel = "postgrest"
+db-channel-enabled = true
+db-extra-search-path = "public,extensions"
+db-max-rows = 1000
+db-pool = 1
+db-pool-timeout = 100
+db-pre-request = "custom_headers"
+db-prepared-statements = false
+db-root-spec = "root"
+db-schemas = "test,tenant1,tenant2"
+db-load-guc-config = "true"
+db-tx-end = "commit-allow-override"
+db-uri = "<REPLACED_WITH_DB_URI>"
+jwt-aud = "https://example.org"
+jwt-role-claim-key = ".\"a\".\"role\""
+jwt-secret = "REALLYREALLYREALLYREALLYVERYSAFE"
+jwt-secret-is-base64 = true
+log-level = "info"
+openapi-server-proxy-uri = "https://example.org/api"
+raw-media-types = "application/vnd.pgrst.db-config"
+server-host = "0.0.0.0"
+server-port = 80
+server-unix-socket = "/tmp/pgrst_io_test.sock"
+server-unix-socket-mode = "777"
+app.settings.test = "test"
+app.settings.test2 = "test"

test/io-tests/configs/expected/no-defaults.config

@@ -9,6 +9,7 @@ db-pre-request = "please_run_fast"
 db-prepared-statements = false
 db-root-spec = "openapi_v3"
 db-schemas = "multi,tenant,setup"
+db-load-guc-config = "false"
 db-tx-end = "rollback-allow-override"
 db-uri = "tmp_db"
 jwt-aud = "https://postgrest.org"

test/io-tests/configs/expected/types.config

@@ -9,6 +9,7 @@ db-pre-request = ""
 db-prepared-statements = true
 db-root-spec = ""
 db-schemas = "required"
+db-load-guc-config = "true"
 db-tx-end = "commit"
 db-uri = "required"
 jwt-aud = ""

test/io-tests/configs/no-defaults-env.yaml

@@ -11,6 +11,7 @@ PGRST_DB_PREPARED_STATEMENTS: false
 PGRST_DB_PRE_REQUEST: please_run_fast
 PGRST_DB_ROOT_SPEC: openapi_v3
 PGRST_DB_SCHEMAS: multi,   tenant,setup
+PGRST_DB_LOAD_GUC_CONFIG: false
 PGRST_DB_TX_END: rollback-allow-override
 PGRST_DB_URI: tmp_db
 PGRST_JWT_AUD: 'https://postgrest.org'

test/io-tests/configs/no-defaults.config

@@ -9,6 +9,7 @@ db-pre-request = "please_run_fast"
 db-prepared-statements = false
 db-root-spec = "openapi_v3"
 db-schemas = "multi,   tenant,setup"
+db-load-guc-config = "false"
 db-tx-end = "rollback-allow-override"
 db-uri = "tmp_db"
 jwt-aud = "https://postgrest.org"

test/io-tests/configs/role-claim-key.config

@@ -1,3 +1,4 @@
 db-pool = 1
 jwt-role-claim-key = "$(ROLE_CLAIM_KEY)"
 jwt-secret = "reallyreallyreallyreallyverysafe"
+db-load-guc-config = false

test/io-tests/configs/secret-from-file.config

@@ -3,3 +3,4 @@ db-pool = 1
 # Read secret from a file: /dev/stdin (alias for standard input)
 jwt-secret = "@/dev/stdin"
 jwt-secret-is-base64 = false
+db-load-guc-config = false

test/io-tests/configs/sigusr2-settings.config

@@ -3,3 +3,4 @@ db-pool = 1
 
 app.settings.name_var = "John"
 jwt-secret = "invalidinvalidinvalidinvalidinvalid"
+db-load-guc-config = false

test/io-tests/configs/simple.config

@@ -1,2 +1,3 @@
 db-pool = 1
 jwt-secret = "reallyreallyreallyreallyverysafe"
+db-load-guc-config = false

test/io-tests/configs/unix-socket.config

@@ -1,3 +1,4 @@
 db-pool = 1
 server-unix-socket = "$(POSTGREST_TEST_SOCKET)"
 jwt-secret = "reallyreallyreallyreallyverysafe"
+db-load-guc-config = false