Compute per-row editability and deletability from a table's row-level
security policies and return them as synthetic columns so clients can
hide edit/delete affordances for rows the user cannot change.
- Introspect pg_policies and relrowsecurity at schema-cache load and
combine the UPDATE/DELETE USING qualifiers per table (permissive OR,
restrictive AND).
- Store the combined qualifiers on Table and inject can_edit/can_delete
as computed select fields when expanding `select *`, only for
RLS-enabled tables with a matching policy (COALESCE'd to a boolean).
- Keep the computed columns out of the OpenAPI spec so they are not
rendered as regular fields.
- Add a cfExpression field to CoercibleField to carry raw SQL
expressions through the planner to SqlFragment.
Add unique constraint and many-to-many relationship metadata to the
generated OpenAPI spec so clients can render them.
- Store unique constraints on Table as tableUniqueCols (mirroring
tablePKCols) instead of denormalizing them onto each Column.
- Compute unique constraints via a per-table tbl_unique_cols CTE in
tablesSqlQuery.
- Annotate unique columns and composite unique constraints in property
descriptions, and emit m2m markers in table descriptions.
We had just 3 tests remaining in test_io.py. This commit moves them to
their modules. So we have:
* test_graceful_shutdown.py
* test_zero_downtime.py
* test_pg_internal.py
Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
(cherry picked from commit 02d83d1c01)
When running `postgrest-test-io`, pytest raises a `InsecureKeyLengthWarning`
for a test. To clear that warning, this commit increases the key length to
more than 32 characters.
Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
Adds the `url_use_legacy_target_names` config.
Enabled (default):
* It allows using the resource name in filters,
orders or limits when it has an alias, e.g.
`table?select=alias:target(*)&target.id=eq.1`
* Logs a WARNING with a hint to use the alias
* Returns a Warning header in the response
Disabled:
* It returns an error, only the alias is allowed
* No warnings returned
This feature is deprecated
BREAKING CHANGE
Breaks the string comparison operators implemented in #3813. Those can
be replaced with regex searches using JSON Path `search()` function.
Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
This change ensures PostgREST starts listening on a server socket only after it loaded the schema cache and is ready to handle requests. It is no longer going to return 503 errors during startup until the schema cache is loaded.
This is useful when multiple instances run on the same machine, for
example behind a proxy. Unix sockets for web and admin servers can then
be put in the same folder for each instance.
Can be helpful when writing tests as well.
The `if response` check a few rows down would not actually work without
initializing the variable first. It'd throw:
```
E UnboundLocalError: cannot access local variable 'response' where
it is not associated with a value
```
retryingSchemaCacheLoad should not clear existing schema cache upon failure - there is no reason to do that. If there is a communication issue with the database server or db is down, clients are going to get 502 anyway. If it was a glitch when loading the schema cache - the clients are going to use old (stale) schema cache for some time until next retry re-loads it successfully.
There was an oversight on d556cea, `timeout_authenticator` doesn't have
any privileges on the tables so it shouldn't be making requests to the
API server or it will end up with 401 responses.
Replaces the `Maybe [Text]` with `[Text]`. The `Maybe` is unnecessary
because we handle `Just []` and `Nothing` the same way.
Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
The PGRST000 database connection error message was "Database connection
error. Retrying the connection.", but reconnection attempts are already
logged separately by the reconnection observation, and on fatal errors
(e.g. authentication failure) PostgREST does not retry at all. Drop the
"Retrying the connection." part, leaving "Database connection error.".
The config dump in Config.hs listed db-config, db-pre-config and the
db-pool-* settings out of alphabetical order, while the rest of the dump
was sorted. Now the whole dump is consistently alphabetical and update
the expected IO test configs to match.
Config variables are tested already via reading the config files in
the `configs/` directory.
If more are to be tested, it should be done via adding a file in
`configs/` and compare it with its associated file in `configs/expected/`.
Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
Remove internal schema cache load and relationship load sleep settings plus
the delay wrappers they enabled. Drop IO tests that depended on the removed
settings.
Add an IO test that drops a table while schema cache reload is delayed. It verifies the stale cache path returns PostgreSQL 42P01 and the refreshed cache returns PGRST205.
jimmy
Taimoor Zaeem