feat: filter top-level resource with embed filter

This is enabled by adding `!inner` to the embedded resource

/projects?select=*,clients!inner(*)&clients.id=eq.12

This behaviour can be enabled by default with the config option

db-embed-default-join='inner'

Which saves the need for specifying `!inner` on every request.
If this is enabled, the previous behavior can be restored
per request by specifying `!left`  on the embedded resource.

/projects?select=*,clients!left(*)&clients.id=eq.12`

Tested on M20/02M/M2M relationships, views, RPC.

test/io-tests/configs/expected/aliases.config

@@ -12,6 +12,7 @@ db-schemas = "provided_through_alias"
 db-config = "false"
 db-tx-end = "commit"
 db-uri = "required"
+db-embed-default-join = "left"
 jwt-aud = ""
 jwt-role-claim-key = ".\"aliased\""
 jwt-secret = ""

test/io-tests/configs/expected/boolean-numeric.config

@@ -12,6 +12,7 @@ db-schemas = "required"
 db-config = "false"
 db-tx-end = "commit"
 db-uri = "required"
+db-embed-default-join = "left"
 jwt-aud = ""
 jwt-role-claim-key = ".\"role\""
 jwt-secret = ""

test/io-tests/configs/expected/boolean-string.config

@@ -12,6 +12,7 @@ db-schemas = "required"
 db-config = "false"
 db-tx-end = "commit"
 db-uri = "required"
+db-embed-default-join = "left"
 jwt-aud = ""
 jwt-role-claim-key = ".\"role\""
 jwt-secret = ""

test/io-tests/configs/expected/defaults.config

@@ -12,6 +12,7 @@ db-schemas = "required"
 db-config = "false"
 db-tx-end = "commit"
 db-uri = "required"
+db-embed-default-join = "left"
 jwt-aud = ""
 jwt-role-claim-key = ".\"role\""
 jwt-secret = ""

test/io-tests/configs/expected/no-defaults-with-db-other-authenticator.config

@@ -12,6 +12,7 @@ db-schemas = "test,other_tenant1,other_tenant2"
 db-config = "true"
 db-tx-end = "rollback-allow-override"
 db-uri = "<REPLACED_WITH_DB_URI>"
+db-embed-default-join = "inner"
 jwt-aud = "https://otherexample.org"
 jwt-role-claim-key = ".\"other\".\"role\""
 jwt-secret = "ODERREALLYREALLYREALLYREALLYVERYSAFE"

test/io-tests/configs/expected/no-defaults-with-db.config

@@ -12,6 +12,7 @@ db-schemas = "test,tenant1,tenant2"
 db-config = "true"
 db-tx-end = "commit-allow-override"
 db-uri = "<REPLACED_WITH_DB_URI>"
+db-embed-default-join = "inner"
 jwt-aud = "https://example.org"
 jwt-role-claim-key = ".\"a\".\"role\""
 jwt-secret = "OVERRIDEREALLYREALLYREALLYREALLYVERYSAFE"

test/io-tests/configs/expected/no-defaults.config

@@ -12,6 +12,7 @@ db-schemas = "multi,tenant,setup"
 db-config = "false"
 db-tx-end = "rollback-allow-override"
 db-uri = "tmp_db"
+db-embed-default-join = "inner"
 jwt-aud = "https://postgrest.org"
 jwt-role-claim-key = ".\"user\"[0].\"real-role\""
 jwt-secret = "c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5"

test/io-tests/configs/expected/types.config

@@ -12,6 +12,7 @@ db-schemas = "required"
 db-config = "true"
 db-tx-end = "commit"
 db-uri = "required"
+db-embed-default-join = "left"
 jwt-aud = ""
 jwt-role-claim-key = ".\"role\""
 jwt-secret = ""

test/io-tests/configs/no-defaults-env.yaml

@@ -14,6 +14,7 @@ PGRST_DB_SCHEMAS: multi,   tenant,setup
 PGRST_DB_CONFIG: false
 PGRST_DB_TX_END: rollback-allow-override
 PGRST_DB_URI: tmp_db
+PGRST_DB_EMBED_DEFAULT_JOIN: inner
 PGRST_JWT_AUD: 'https://postgrest.org'
 PGRST_JWT_ROLE_CLAIM_KEY: '.user[0]."real-role"'
 PGRST_JWT_SECRET: c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5

test/io-tests/configs/no-defaults.config

@@ -12,6 +12,7 @@ db-schemas = "multi,   tenant,setup"
 db-config = "false"
 db-tx-end = "rollback-allow-override"
 db-uri = "tmp_db"
+db-embed-default-join = "inner"
 jwt-aud = "https://postgrest.org"
 jwt-role-claim-key = ".user[0].\"real-role\""
 jwt-secret = "c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5"

test/io-tests/fixtures.yaml

@@ -179,3 +179,8 @@ invalidopenapimodes:
   - 'follow-'
   - 'ignore-'
   - '.#$$%&$%/'
+
+invalidjointypes:
+  - 'left!'
+  - 'right'
+  - '.#$$%&$%/'

test/io-tests/test_io.py

@@ -440,6 +440,21 @@ def test_invalid_openapi_mode(invalidopenapimodes, defaultenv):
                 print(line)
 
 
+@pytest.mark.parametrize("invalidjointypes", FIXTURES["invalidjointypes"])
+def test_invalid_db_embed_default_join(invalidjointypes, defaultenv):
+    "Given an invalid db-embed-default-join, Postgrest should exit with a non-zero exit code."
+    env = {
+        **defaultenv,
+        "PGRST_DB_EMBED_DEFAULT_JOIN": invalidjointypes,
+    }
+
+    with pytest.raises(PostgrestError):
+        dump = dumpconfig(CONFIGSDIR / "defaults.config", env=env)
+        for line in dump.split("\n"):
+            if line.startswith("db-embed-default-join"):
+                print(line)
+
+
 def test_iat_claim(defaultenv):
     """
     A claim with an 'iat' (issued at) attribute should be successful.