From c06237cc56b0d796740d4ff804854280dfb67677 Mon Sep 17 00:00:00 2001
From: steve-chavez <stevechavezast@gmail.com>
Date: Sat, 8 Apr 2023 18:52:47 -0500
Subject: [PATCH] fix: db settings and pg version query not prepared

---
 CHANGELOG.md                     |  1 +
 src/PostgREST/Config/Database.hs | 14 +++++++-------
 src/PostgREST/SchemaCache.hs     |  2 +-
 src/PostgREST/Workers.hs         |  2 +-
 test/spec/Main.hs                |  2 +-
 5 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1fb40bcf0..ed3aca0ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,6 +44,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
  - #2705, Fix bug when using the `Range` header on `PATCH/DELETE` - @laurenceisla
    + Fix the`"message": "syntax error at or near \"RETURNING\""` error
    + Fix doing a limited update/delete when an `order` query parameter was present
+ - #2742, Fix db settings and pg version queries not getting prepared  - @steve-chavez
 
 ### Changed
 
diff --git a/src/PostgREST/Config/Database.hs b/src/PostgREST/Config/Database.hs
index 28d191dcd..a07eb2e82 100644
--- a/src/PostgREST/Config/Database.hs
+++ b/src/PostgREST/Config/Database.hs
@@ -19,11 +19,11 @@ import Text.InterpolatedString.Perl6 (q)
 
 import Protolude
 
-queryPgVersion :: Session PgVersion
-queryPgVersion = statement mempty pgVersionStatement
+queryPgVersion :: Bool -> Session PgVersion
+queryPgVersion prepared = statement mempty $ pgVersionStatement prepared
 
-pgVersionStatement :: SQL.Statement () PgVersion
-pgVersionStatement = SQL.Statement sql HE.noParams versionRow False
+pgVersionStatement :: Bool -> SQL.Statement () PgVersion
+pgVersionStatement = SQL.Statement sql HE.noParams versionRow
   where
     sql = "SELECT current_setting('server_version_num')::integer, current_setting('server_version')"
     versionRow = HD.singleRow $ PgVersion <$> column HD.int4 <*> column HD.text
@@ -31,11 +31,11 @@ pgVersionStatement = SQL.Statement sql HE.noParams versionRow False
 queryDbSettings :: Bool -> Session [(Text, Text)]
 queryDbSettings prepared =
   let transaction = if prepared then SQL.transaction else SQL.unpreparedTransaction in
-  transaction SQL.ReadCommitted SQL.Read $ SQL.statement mempty dbSettingsStatement
+  transaction SQL.ReadCommitted SQL.Read $ SQL.statement mempty $ dbSettingsStatement prepared
 
 -- | Get db settings from the connection role. Global settings will be overridden by database specific settings.
-dbSettingsStatement :: SQL.Statement () [(Text, Text)]
-dbSettingsStatement = SQL.Statement sql HE.noParams decodeSettings False
+dbSettingsStatement :: Bool -> SQL.Statement () [(Text, Text)]
+dbSettingsStatement = SQL.Statement sql HE.noParams decodeSettings
   where
     sql = [q|
       WITH
diff --git a/src/PostgREST/SchemaCache.hs b/src/PostgREST/SchemaCache.hs
index e970756aa..859d83954 100644
--- a/src/PostgREST/SchemaCache.hs
+++ b/src/PostgREST/SchemaCache.hs
@@ -107,7 +107,7 @@ type SqlQuery = ByteString
 querySchemaCache :: [Schema] -> [Schema] -> Bool -> SQL.Transaction SchemaCache
 querySchemaCache schemas extraSearchPath prepared = do
   SQL.sql "set local schema ''" -- This voids the search path. The following queries need this for getting the fully qualified name(schema.name) of every db object
-  pgVer   <- SQL.statement mempty pgVersionStatement
+  pgVer   <- SQL.statement mempty $ pgVersionStatement prepared
   tabs    <- SQL.statement schemas $ allTables pgVer prepared
   keyDeps <- SQL.statement (schemas, extraSearchPath) $ allViewsKeyDependencies prepared
   m2oRels <- SQL.statement mempty $ allM2OandO2ORels pgVer prepared
diff --git a/src/PostgREST/Workers.hs b/src/PostgREST/Workers.hs
index 11fcf464c..c363523e4 100644
--- a/src/PostgREST/Workers.hs
+++ b/src/PostgREST/Workers.hs
@@ -124,7 +124,7 @@ establishConnection appState =
 
     getConnectionStatus :: IO ConnectionStatus
     getConnectionStatus = do
-      pgVersion <- AppState.usePool appState queryPgVersion
+      pgVersion <- AppState.usePool appState $ queryPgVersion False -- No need to prepare the query here, as the connection might not established
       case pgVersion of
         Left e -> do
           AppState.logPgrstError appState e
diff --git a/test/spec/Main.hs b/test/spec/Main.hs
index 38fb744c9..d54bde931 100644
--- a/test/spec/Main.hs
+++ b/test/spec/Main.hs
@@ -67,7 +67,7 @@ main :: IO ()
 main = do
   pool <- P.acquire 3 10 60 $ toUtf8 $ configDbUri testCfg
 
-  actualPgVersion <- either (panic . show) id <$> P.use pool queryPgVersion
+  actualPgVersion <- either (panic . show) id <$> P.use pool (queryPgVersion False)
 
   baseSchemaCache <-
     loadSchemaCache pool