feat: Make db-anon-role optional

Without db-anon-role, PostgREST will block any anonymous access without hitting the database.

Resolves #1689, Ref #1823

test/io/configs/aliases.config

@@ -1,5 +1,3 @@
-db-anon-role = "required"
-
 db-schema = "provided_through_alias"
 max-rows = 1000
 pre-request = "check_alias"

test/io/configs/boolean-numeric.config

@@ -1,5 +1,3 @@
-db-anon-role = "required"
-
 db-channel-enabled = "1"
 db-prepared-statements = "0"
 jwt-secret-is-base64 = "2"

test/io/configs/boolean-string.config

@@ -1,5 +1,3 @@
-db-anon-role = "required"
-
 db-channel-enabled = "true"
 db-prepared-statements = "FALSE"
 jwt-secret-is-base64 = "\"true\""

test/io/configs/defaults.config

@@ -1,3 +1,2 @@
-db-anon-role = "required"
 # Not the default, but only works with PG* variables, which are not set
 db-config = false

test/io/configs/expected/aliases.config

@@ -1,4 +1,4 @@
-db-anon-role = "required"
+db-anon-role = ""
 db-channel = "pgrst"
 db-channel-enabled = true
 db-extra-search-path = "public"

test/io/configs/expected/boolean-numeric.config

@@ -1,4 +1,4 @@
-db-anon-role = "required"
+db-anon-role = ""
 db-channel = "pgrst"
 db-channel-enabled = true
 db-extra-search-path = "public"

test/io/configs/expected/boolean-string.config

@@ -1,4 +1,4 @@
-db-anon-role = "required"
+db-anon-role = ""
 db-channel = "pgrst"
 db-channel-enabled = true
 db-extra-search-path = "public"

test/io/configs/expected/defaults.config

@@ -1,4 +1,4 @@
-db-anon-role = "required"
+db-anon-role = ""
 db-channel = "pgrst"
 db-channel-enabled = true
 db-extra-search-path = "public"

test/io/configs/expected/no-defaults-with-db-other-authenticator.config

@@ -1,4 +1,4 @@
-db-anon-role = "postgrest_test_anonymous"
+db-anon-role = "other"
 db-channel = "postgrest"
 db-channel-enabled = false
 db-extra-search-path = "public,extensions,other"

test/io/configs/expected/no-defaults-with-db.config

@@ -1,4 +1,4 @@
-db-anon-role = "postgrest_test_anonymous"
+db-anon-role = "anonymous"
 db-channel = "postgrest"
 db-channel-enabled = false
 db-extra-search-path = "public,extensions,private"

test/io/configs/expected/types.config

@@ -1,4 +1,4 @@
-db-anon-role = "required"
+db-anon-role = ""
 db-channel = "pgrst"
 db-channel-enabled = true
 db-extra-search-path = "public"

test/io/configs/types.config

@@ -1,5 +1,4 @@
 # tests how config options fall back with invalid types
-db-anon-role = "required"
 
 # expects string
 app.settings.test = false

test/io/db_config.sql

@@ -7,6 +7,7 @@ ALTER ROLE db_config_authenticator SET pgrst.raw_media_types = 'application/vnd.
 ALTER ROLE db_config_authenticator SET pgrst.jwt_secret = 'REALLY=REALLY=REALLY=REALLY=VERY=SAFE';
 ALTER ROLE db_config_authenticator SET pgrst.jwt_secret_is_base64 = 'false';
 ALTER ROLE db_config_authenticator SET pgrst.jwt_role_claim_key = '."a"."role"';
+ALTER ROLE db_config_authenticator SET pgrst.db_anon_role = 'anonymous';
 ALTER ROLE db_config_authenticator SET pgrst.db_tx_end = 'commit-allow-override';
 ALTER ROLE db_config_authenticator SET pgrst.db_schemas = 'test, tenant1, tenant2';
 ALTER ROLE db_config_authenticator SET pgrst.db_root_spec = 'root';
@@ -29,7 +30,6 @@ ALTER ROLE db_config_authenticator SET pgrst.server_port = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.server_unix_socket = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.server_unix_socket_mode = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.log_level = 'ignored';
-ALTER ROLE db_config_authenticator SET pgrst.db_anon_role = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.db_uri = 'postgresql://ignored';
 ALTER ROLE db_config_authenticator SET pgrst.db_channel_enabled = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.db_channel = 'ignored';
@@ -45,6 +45,7 @@ ALTER ROLE other_authenticator SET pgrst.raw_media_types = 'application/vnd.pgrs
 ALTER ROLE other_authenticator SET pgrst.jwt_secret = 'ODERREALLYREALLYREALLYREALLYVERYSAFE';
 ALTER ROLE other_authenticator SET pgrst.jwt_secret_is_base64 = 'true';
 ALTER ROLE other_authenticator SET pgrst.jwt_role_claim_key = '."other"."role"';
+ALTER ROLE other_authenticator SET pgrst.db_anon_role = 'other';
 ALTER ROLE other_authenticator SET pgrst.db_tx_end = 'rollback-allow-override';
 ALTER ROLE other_authenticator SET pgrst.db_schemas = 'test, other_tenant1, other_tenant2';
 ALTER ROLE other_authenticator SET pgrst.db_root_spec = 'other_root';

test/io/fixtures.sql

@@ -1,6 +1,8 @@
 \ir db_config.sql
 
 CREATE ROLE postgrest_test_anonymous;
+ALTER ROLE :USER SET pgrst.db_anon_role = 'postgrest_test_anonymous';
+
 CREATE ROLE postgrest_test_author;
 
 GRANT postgrest_test_anonymous, postgrest_test_author TO :USER;

test/io/fixtures.yaml

@@ -23,10 +23,6 @@ cli:
   - name: invalid config file
     expect: error
     args: ['test/io-tests/configs/invalid.yaml']
-# failures: required config options
-  - name: missing db-anon-role
-    expect: error
-    env:
 # failures: wrong config values
   - name: invalid server-unix-socket-mode not octal
     expect: error

test/io/test_io.py

@@ -92,8 +92,7 @@ def defaultenv():
         "PGDATABASE": os.environ["PGDATABASE"],
         "PGHOST": os.environ["PGHOST"],
         "PGUSER": os.environ["PGUSER"],
-        "PGRST_DB_ANON_ROLE": os.environ["PGRST_DB_ANON_ROLE"],
-        "PGRST_DB_CONFIG": "false",
+        "PGRST_DB_CONFIG": "true",
         "PGRST_LOG_LEVEL": "info",
     }
 
@@ -384,6 +383,7 @@ def test_read_secret_from_file(secretpath, defaultenv):
 
     with run(stdin=secret, env=env) as postgrest:
         response = postgrest.session.get("/authors_only", headers=headers)
+        print(response.text)
         assert response.status_code == 200
 
 
@@ -600,6 +600,8 @@ def test_jwt_secret_external_file_reload(tmp_path, defaultenv):
         **defaultenv,
         "PGRST_JWT_SECRET": f"@{external_secret_file}",
         "PGRST_DB_CHANNEL_ENABLED": "true",
+        "PGRST_DB_CONFIG": "false",
+        "PGRST_DB_ANON_ROLE": "postgrest_test_anonymous",  # required for NOTIFY
     }
 
     with run(env=env) as postgrest:
@@ -609,7 +611,7 @@ def test_jwt_secret_external_file_reload(tmp_path, defaultenv):
         # change external file
         external_secret_file.write_text(SECRET)
 
-        # SIGUSR1 doesn't reload external files
+        # SIGUSR1 doesn't reload external files, at least when db-config=false
         postgrest.process.send_signal(signal.SIGUSR1)
         time.sleep(0.1)
 
@@ -627,7 +629,8 @@ def test_jwt_secret_external_file_reload(tmp_path, defaultenv):
         external_secret_file.write_text("invalid" * 5)
 
         # reload config and external file with NOTIFY
-        postgrest.session.post("/rpc/reload_pgrst_config")
+        response = postgrest.session.post("/rpc/reload_pgrst_config")
+        assert response.status_code == 200
         time.sleep(0.1)
 
         response = postgrest.session.get("/authors_only", headers=headers)