Correct openapi ignore mode to filter schemas

Also rename openapi-mode options

* follow-acl -> follow-privileges
* ignore-acl -> ignore-privileges

test/io-tests/configs/expected/aliases.config

@@ -17,7 +17,7 @@ jwt-role-claim-key = ".\"aliased\""
 jwt-secret = ""
 jwt-secret-is-base64 = true
 log-level = "error"
-openapi-mode = "follow-acl"
+openapi-mode = "follow-privileges"
 openapi-server-proxy-uri = ""
 raw-media-types = ""
 server-host = "!4"

test/io-tests/configs/expected/boolean-numeric.config

@@ -17,7 +17,7 @@ jwt-role-claim-key = ".\"role\""
 jwt-secret = ""
 jwt-secret-is-base64 = true
 log-level = "error"
-openapi-mode = "follow-acl"
+openapi-mode = "follow-privileges"
 openapi-server-proxy-uri = ""
 raw-media-types = ""
 server-host = "!4"

test/io-tests/configs/expected/boolean-string.config

@@ -17,7 +17,7 @@ jwt-role-claim-key = ".\"role\""
 jwt-secret = ""
 jwt-secret-is-base64 = true
 log-level = "error"
-openapi-mode = "follow-acl"
+openapi-mode = "follow-privileges"
 openapi-server-proxy-uri = ""
 raw-media-types = ""
 server-host = "!4"

test/io-tests/configs/expected/defaults.config

@@ -17,7 +17,7 @@ jwt-role-claim-key = ".\"role\""
 jwt-secret = ""
 jwt-secret-is-base64 = false
 log-level = "error"
-openapi-mode = "follow-acl"
+openapi-mode = "follow-privileges"
 openapi-server-proxy-uri = ""
 raw-media-types = ""
 server-host = "!4"

test/io-tests/configs/expected/no-defaults-with-db-other-authenticator.config

@@ -17,7 +17,7 @@ jwt-role-claim-key = ".\"other\".\"role\""
 jwt-secret = "ODERREALLYREALLYREALLYREALLYVERYSAFE"
 jwt-secret-is-base64 = true
 log-level = "info"
-openapi-mode = "ignore-acl"
+openapi-mode = "disabled"
 openapi-server-proxy-uri = "https://otherexample.org/api"
 raw-media-types = "application/vnd.pgrst.other-db-config"
 server-host = "0.0.0.0"

test/io-tests/configs/expected/no-defaults-with-db.config

@@ -17,7 +17,7 @@ jwt-role-claim-key = ".\"a\".\"role\""
 jwt-secret = "OVERRIDEREALLYREALLYREALLYREALLYVERYSAFE"
 jwt-secret-is-base64 = true
 log-level = "info"
-openapi-mode = "ignore-acl"
+openapi-mode = "ignore-privileges"
 openapi-server-proxy-uri = "https://example.org/api"
 raw-media-types = "application/vnd.pgrst.db-config"
 server-host = "0.0.0.0"

test/io-tests/configs/expected/no-defaults.config

@@ -17,7 +17,7 @@ jwt-role-claim-key = ".\"user\"[0].\"real-role\""
 jwt-secret = "c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5"
 jwt-secret-is-base64 = true
 log-level = "info"
-openapi-mode = "ignore-acl"
+openapi-mode = "ignore-privileges"
 openapi-server-proxy-uri = "https://postgrest.org"
 raw-media-types = "application/vnd.pgrst.config"
 server-host = "0.0.0.0"

test/io-tests/configs/expected/types.config

@@ -17,7 +17,7 @@ jwt-role-claim-key = ".\"role\""
 jwt-secret = ""
 jwt-secret-is-base64 = false
 log-level = "error"
-openapi-mode = "follow-acl"
+openapi-mode = "follow-privileges"
 openapi-server-proxy-uri = ""
 raw-media-types = ""
 server-host = "!4"

test/io-tests/configs/no-defaults-env.yaml

@@ -19,7 +19,7 @@ PGRST_JWT_ROLE_CLAIM_KEY: '.user[0]."real-role"'
 PGRST_JWT_SECRET: c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5
 PGRST_JWT_SECRET_IS_BASE64: true
 PGRST_LOG_LEVEL: info
-PGRST_OPENAPI_MODE: 'ignore-acl'
+PGRST_OPENAPI_MODE: 'ignore-privileges'
 PGRST_OPENAPI_SERVER_PROXY_URI: 'https://postgrest.org'
 PGRST_RAW_MEDIA_TYPES: application/vnd.pgrst.config
 PGRST_SERVER_HOST: 0.0.0.0

test/io-tests/configs/no-defaults.config

@@ -17,7 +17,7 @@ jwt-role-claim-key = ".user[0].\"real-role\""
 jwt-secret = "c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5"
 jwt-secret-is-base64 = true
 log-level = "info"
-openapi-mode = "ignore-acl"
+openapi-mode = "ignore-privileges"
 openapi-server-proxy-uri = "https://postgrest.org"
 raw-media-types = "application/vnd.pgrst.config"
 server-host = "0.0.0.0"

test/io-tests/fixtures.yaml

@@ -174,3 +174,8 @@ invalidroleclaimkeys:
   - '.my_role;;domain'
   - '.#$$%&$%/'
   - '1234'
+
+invalidopenapimodes:
+  - 'follow-'
+  - 'ignore-'
+  - '.#$$%&$%/'

test/io-tests/test_io.py

@@ -425,6 +425,21 @@ def test_invalid_role_claim_key(invalidroleclaimkey, defaultenv):
                 print(line)
 
 
+@pytest.mark.parametrize("invalidopenapimodes", FIXTURES["invalidopenapimodes"])
+def test_invalid_openapi_mode(invalidopenapimodes, defaultenv):
+    "Given an invalid openapi-mode, Postgrest should exit with a non-zero exit code."
+    env = {
+        **defaultenv,
+        "PGRST_OPENAPI_MODE": invalidopenapimodes,
+    }
+
+    with pytest.raises(PostgrestError):
+        dump = dumpconfig(CONFIGSDIR / "defaults.config", env=env)
+        for line in dump.split("\n"):
+            if line.startswith("openapi-mode"):
+                print(line)
+
+
 def test_iat_claim(defaultenv):
     """
     A claim with an 'iat' (issued at) attribute should be successful.