fix: Make OPTIONS consider view instead of triggers (#1824)

src/PostgREST/App.hs

@@ -358,11 +358,18 @@ handleInfo identifier RequestContext{..} =
     allOrigins = ("Access-Control-Allow-Origin", "*")
     allowH table =
       ( HTTP.hAllow
-      , if tableInsertable table then "GET,POST,PATCH,DELETE" else "GET"
+      , BS8.intercalate "," $
+          ["OPTIONS,GET,HEAD"]
+          ++ ["POST" | tableInsertable table]
+          ++ ["PUT" | tableInsertable table && tableUpdatable table && hasPK]
+          ++ ["PATCH" | tableUpdatable table]
+          ++ ["DELETE" | tableDeletable table]
       )
     tableMatches table =
       tableName table == qiName identifier
       && tableSchema table == qiSchema identifier
+    hasPK =
+      not $ null $ tablePKCols ctxDbStructure (qiSchema identifier) (qiName identifier)
 
 handleInvoke :: InvokeMethod -> ProcDescription -> RequestContext -> DbHandler Wai.Response
 handleInvoke invMethod proc context@RequestContext{..} = do

src/PostgREST/DbStructure.hs

@@ -136,6 +136,8 @@ decodeTables =
                  <*> column HD.text
                  <*> nullableColumn HD.text
                  <*> column HD.bool
+                 <*> column HD.bool
+                 <*> column HD.bool
 
 decodeColumns :: [Table] -> HD.Result [Column]
 decodeColumns tables =
@@ -329,22 +331,40 @@ accessibleTables =
       relname as table_name,
       d.description as table_description,
       (
-        c.relkind in ('r', 'v', 'f')
-        and (pg_relation_is_updatable(c.oid::regclass, false) & 8) = 8
-        -- The function `pg_relation_is_updateable` returns a bitmask where 8
-        -- corresponds to `1 << CMD_INSERT` in the PostgreSQL source code, i.e.
-        -- it's possible to insert into the relation.
-        or (exists (
-          select 1
-          from pg_trigger
-          where
+        c.relkind IN ('r', 'v','f')
+        AND (pg_relation_is_updatable(c.oid::regclass, FALSE) & 8) = 8
+        OR EXISTS (
+          SELECT 1
+          FROM pg_trigger
+          WHERE
             pg_trigger.tgrelid = c.oid
-            and (pg_trigger.tgtype::integer & 69) = 69)
-            -- The trigger type `tgtype` is a bitmask where 69 corresponds to
-            -- TRIGGER_TYPE_ROW + TRIGGER_TYPE_INSTEAD + TRIGGER_TYPE_INSERT
-            -- in the PostgreSQL source code.
+            AND (pg_trigger.tgtype::integer & 69) = 69
         )
-      ) as insertable
+      ) AS insertable,
+      (
+        c.relkind IN ('r', 'v','f')
+        AND (pg_relation_is_updatable(c.oid::regclass, FALSE) & 4) = 4
+        -- CMD_UPDATE
+        OR EXISTS (
+          SELECT 1
+          FROM pg_trigger
+          WHERE
+            pg_trigger.tgrelid = c.oid
+            and (pg_trigger.tgtype::integer & 81) = 81
+        )
+      ) as updatable,
+      (
+        c.relkind IN ('r', 'v','f')
+        AND (pg_relation_is_updatable(c.oid::regclass, FALSE) & 16) = 16
+        -- CMD_DELETE
+        OR EXISTS (
+          SELECT 1
+          FROM pg_trigger
+          WHERE
+            pg_trigger.tgrelid = c.oid
+            and (pg_trigger.tgtype::integer & 73) = 73
+        )
+      ) as deletable
     from
       pg_class c
       join pg_namespace n on n.oid = c.relnamespace
@@ -470,21 +490,61 @@ allTables =
       c.relname AS table_name,
       NULL AS table_description,
       (
-        c.relkind IN ('r', 'v','f')
-        AND (pg_relation_is_updatable(c.oid::regclass, FALSE) & 8) = 8
-        OR EXISTS (
-          SELECT 1
-          FROM pg_trigger
-          WHERE
-            pg_trigger.tgrelid = c.oid
+        c.relkind = 'r'
+        OR (
+          c.relkind in ('v','f')
+          AND (pg_relation_is_updatable(c.oid::regclass, FALSE) & 8) = 8
+          -- The function `pg_relation_is_updateable` returns a bitmask where 8
+          -- corresponds to `1 << CMD_INSERT` in the PostgreSQL source code, i.e.
+          -- it's possible to insert into the relation.
+          OR EXISTS (
+            SELECT 1
+            FROM pg_trigger
+            WHERE
+              pg_trigger.tgrelid = c.oid
             AND (pg_trigger.tgtype::integer & 69) = 69
+            -- The trigger type `tgtype` is a bitmask where 69 corresponds to
+            -- TRIGGER_TYPE_ROW + TRIGGER_TYPE_INSTEAD + TRIGGER_TYPE_INSERT
+            -- in the PostgreSQL source code.
+          )
         )
-      ) AS insertable
+      ) AS insertable,
+      (
+        c.relkind = 'r'
+        OR (
+          c.relkind in ('v','f')
+          AND (pg_relation_is_updatable(c.oid::regclass, FALSE) & 4) = 4
+          -- CMD_UPDATE
+          OR EXISTS (
+            SELECT 1
+            FROM pg_trigger
+            WHERE
+              pg_trigger.tgrelid = c.oid
+              and (pg_trigger.tgtype::integer & 81) = 81
+              -- TRIGGER_TYPE_ROW + TRIGGER_TYPE_INSTEAD + TRIGGER_TYPE_UPDATE
+          )
+        )
+      ) AS updatable,
+      (
+        c.relkind = 'r'
+        OR (
+          c.relkind in ('v','f')
+          AND (pg_relation_is_updatable(c.oid::regclass, FALSE) & 16) = 16
+          -- CMD_DELETE
+          OR EXISTS (
+            SELECT 1
+            FROM pg_trigger
+            WHERE
+              pg_trigger.tgrelid = c.oid
+              and (pg_trigger.tgtype::integer & 73) = 73
+              -- TRIGGER_TYPE_ROW + TRIGGER_TYPE_INSTEAD + TRIGGER_TYPE_DELETE
+          )
+        )
+      ) AS deletable
     FROM pg_class c
     JOIN pg_namespace n ON n.oid = c.relnamespace
     WHERE c.relkind IN ('v','r','m','f')
       AND n.nspname NOT IN ('pg_catalog', 'information_schema')
-    GROUP BY table_schema, table_name, insertable
     ORDER BY table_schema, table_name |]
 
 allColumns :: [Table] -> Bool -> H.Statement [Schema] [Column]

src/PostgREST/DbStructure/Table.hs

@@ -21,7 +21,10 @@ data Table = Table
   { tableSchema      :: Schema
   , tableName        :: TableName
   , tableDescription :: Maybe Text
+    -- The following fields identify what can be done on the table/view, they're not related to the privileges granted to it
   , tableInsertable  :: Bool
+  , tableUpdatable   :: Bool
+  , tableDeletable   :: Bool
   }
   deriving (Show, Ord, Generic, JSON.ToJSON)
 

src/PostgREST/OpenAPI.hs

@@ -218,7 +218,7 @@ makeRowFilters :: Text -> [Column] -> [(Text, Param)]
 makeRowFilters tn = fmap (makeRowFilter tn)
 
 makePathItem :: (Table, [Column], [Text]) -> (FilePath, PathItem)
-makePathItem (t, cs, _) = ("/" ++ T.unpack tn, p $ tableInsertable t)
+makePathItem (t, cs, _) = ("/" ++ T.unpack tn, p $ tableInsertable t || tableUpdatable t || tableDeletable t)
   where
     -- Use first line of table description as summary; rest as description (if present)
     -- We strip leading newlines from description so that users can include a blank line between summary and description