bump version to 13.0.8

Updates configurator-pg to version 0.2.11. This resolves #4386.

Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>

.github/actions/cache-on-main/action.yaml

@@ -19,14 +19,14 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       if: ${{ startsWith(github.ref, 'refs/heads/') || (inputs.save-prs && startsWith(github.ref, 'refs/pull/')) }}
       with:
         path: ${{ inputs.path }}
         key: ${{ runner.os }}-${{ inputs.prefix }}-${{ inputs.suffix }}
         restore-keys: |
           ${{ runner.os }}-${{ inputs.prefix }}-
-    - uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+    - uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       if: ${{ !startsWith(github.ref, 'refs/heads/') && !(inputs.save-prs && startsWith(github.ref, 'refs/pull/'))  }}
       with:
         path: ${{ inputs.path }}

.github/actions/setup-nix/action.yaml

@@ -11,7 +11,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: nixbuild/nix-quick-install-action@63ca48f939ee3b8d835f4126562537df0fee5b91 # v32
+    - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34
       with:
         nix_conf: |-
           always-allow-substitutes = true

.github/workflows/build.yaml

@@ -60,7 +60,7 @@ jobs:
 
   macos:
     name: Nix - MacOS
-    runs-on: macos-14
+    runs-on: macos-15
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Setup Nix Environment
@@ -127,7 +127,7 @@ jobs:
     runs-on: ${{ matrix.runs-on }}
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: haskell-actions/setup@7909071ceec0344debcc968c6c7a96a52e8dd0d7 # v2.8.1
+      - uses: haskell-actions/setup@82e8b5066385702e477d9dc98f287070493e8abd # v2.8.2
         with:
           # This must match the version in stack.yaml's resolver
           ghc-version: 9.6.7
@@ -186,7 +186,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: haskell-actions/setup@7909071ceec0344debcc968c6c7a96a52e8dd0d7 # v2.8.1
+      - uses: haskell-actions/setup@82e8b5066385702e477d9dc98f287070493e8abd # v2.8.2
         with:
           ghc-version: ${{ matrix.ghc }}
       - name: Cache .cabal

.github/workflows/release.yaml

@@ -148,7 +148,7 @@ jobs:
         with:
           name: postgrest-ubuntu-aarch64
       - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
-      - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+      - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           username: ${{ vars.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASS }}
@@ -195,7 +195,7 @@ jobs:
       github.ref == 'refs/tags/devel'
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77 # v4.0.2
+      - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
         with:
           username: ${{ vars.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASS }}

.github/workflows/test.yaml

@@ -49,7 +49,7 @@ jobs:
       - name: Run coverage (IO tests and Spec tests against PostgreSQL 15)
         run: postgrest-coverage
       - name: Upload coverage to codecov
-        uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
         with:
           files: ./coverage/codecov.json
           token: ${{ secrets.CODECOV_TOKEN }}

CHANGELOG.md

@@ -5,6 +5,29 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
+## [13.0.8] - 2025-10-24
+
+### Fixed
+
+- Fix loading utf-8 config files with `ASCII` locale set by @taimoorzaeem in #4386
+
+## [13.0.7] - 2025-09-14
+
+### Added
+
+- Improve the `PGRST106` error when the requested schema is invalid by @laurenceisla in #4089
+  + It now shows the invalid schema in the `message` field.
+  + The exposed schemas are now listed in the `hint` instead of the `message` field.
+- Improve error details of `PGRST301` error by @taimoorzaeem in #4051
+
+## [13.0.6] - 2025-08-30
+
+### Fixed
+
+- Fix logging the Haskell type instead of the listener error message directly by @laurenceisla in #3588
+- Fix format of `IPv6` address logged at PostgREST startup by @taimoorzaeem in #4291
+- Fix empty enum in `preferParams` OpenAPI parameter by @laurenceisla in #4292
+
 ## [13.0.5] - 2025-08-24
 
 ### Fixed

Dockerfile

@@ -2,7 +2,7 @@
 # The x86-64 is a single-static-binary image built via Nix, see:
 # nix/tools/docker/README.md
 
-FROM ubuntu:noble@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9 AS postgrest
+FROM ubuntu:noble@sha256:66460d557b25769b102175144d538d88219c077c678a49af4afca6fbfc1b5252 AS postgrest
 
 RUN apt-get update -y \
     && apt install -y --no-install-recommends libpq-dev zlib1g-dev jq gcc libnuma-dev \

cabal.project.freeze

@@ -1 +1 @@
-index-state: hackage.haskell.org 2025-07-08T15:50:10Z
+index-state: hackage.haskell.org 2025-10-13T04:53:27Z

nix/overlays/haskell-packages.nix

@@ -50,6 +50,16 @@ let
       # jailbreak, because hspec limit for tests
       fuzzyset = prev.fuzzyset_0_2_4;
 
+      # TODO: Remove once available in nixpkgs haskellPackages
+      configurator-pg =
+        prev.callHackageDirect
+          {
+            pkg = "configurator-pg";
+            ver = "0.2.11";
+            sha256 = "sha256-mtGtNawDJgz2ZIEVca+IYXVu4oNw9xsfJiYWAqAbbgc=";
+          }
+          { };
+
       hasql-pool = lib.dontCheck (prev.callHackageDirect
         {
           pkg = "hasql-pool";

postgrest.cabal

@@ -1,5 +1,5 @@
 name:               postgrest
-version:            13.0.5
+version:            13.0.8
 synopsis:           REST API for any Postgres database
 description:        Reads the schema of a PostgreSQL database and creates RESTful routes
                     for tables, views, and functions, supporting all HTTP methods that security
@@ -100,7 +100,7 @@ library
                     , case-insensitive          >= 1.2 && < 1.3
                     , cassava                   >= 0.4.5 && < 0.6
                     , clock                     >= 0.8.3 && < 0.9.0
-                    , configurator-pg           >= 0.2 && < 0.3
+                    , configurator-pg           >= 0.2.11 && < 0.3
                     , containers                >= 0.5.7 && < 0.7
                     , cookie                    >= 0.4.2 && < 0.6
                     , directory                 >= 1.2.6 && < 1.4

src/PostgREST/ApiRequest.hs

@@ -207,7 +207,7 @@ getAction resource schema method =
 getSchema :: AppConfig -> RequestHeaders -> ByteString -> Either ApiRequestError (Schema, Bool)
 getSchema AppConfig{configDbSchemas} hdrs method = do
   case profile of
-    Just p | p `notElem` configDbSchemas -> Left $ UnacceptableSchema $ toList configDbSchemas
+    Just p | p `notElem` configDbSchemas -> Left $ UnacceptableSchema p $ toList configDbSchemas
            | otherwise                   -> Right (p, True)
     Nothing -> Right (defaultSchema, length configDbSchemas /= 1) -- if we have many schemas, assume the default schema was negotiated
   where

src/PostgREST/Auth.hs

@@ -50,7 +50,8 @@ import PostgREST.Auth.JwtCache (lookupJwtCache)
 import PostgREST.Auth.Types    (AuthResult (..))
 import PostgREST.Config        (AppConfig (..), FilterExp (..),
                                 JSPath, JSPathExp (..))
-import PostgREST.Error         (Error (..), JwtError (..))
+import PostgREST.Error         (Error (..), JwtClaimsError (..),
+                                JwtDecodeError (..), JwtError (..))
 
 import Protolude
 
@@ -58,7 +59,7 @@ import Protolude
 -- JSON object of JWT claims.
 parseToken :: AppConfig -> Maybe ByteString -> UTCTime -> ExceptT Error IO JSON.Value
 parseToken _ Nothing _ = return JSON.emptyObject
-parseToken _ (Just "") _ = throwE . JwtErr $ JwtDecodeError "Empty JWT is sent in Authorization header"
+parseToken _ (Just "") _ = throwE . JwtErr $ JwtDecodeErr EmptyAuthHeader
 parseToken AppConfig{..} (Just tkn) time = do
   secret <- liftEither . maybeToRight (JwtErr JwtSecretMissing) $ configJWKS
   tknWith3Parts <- liftEither $ hasThreeParts tkn
@@ -69,33 +70,33 @@ parseToken AppConfig{..} (Just tkn) time = do
       hasThreeParts :: ByteString -> Either Error ByteString
       hasThreeParts token = case length $ BS.split (BS.c2w '.') token of
         3 -> Right token
-        n -> Left $ JwtErr $ JwtDecodeError ("Expected 3 parts in JWT; got " <> show n)
+        n -> Left $ JwtErr $ JwtDecodeErr $ UnexpectedParts n
       jwtDecodeError :: JWT.JwtError -> JwtError
       -- The only errors we can get from JWT.decode function are:
       --   BadAlgorithm
       --   KeyError
       --   BadCrypto
-      jwtDecodeError (JWT.KeyError _)     = JwtDecodeError "No suitable key or wrong key type"
-      jwtDecodeError (JWT.BadAlgorithm _) = JwtDecodeError "Wrong or unsupported encoding algorithm"
-      jwtDecodeError JWT.BadCrypto        = JwtDecodeError "JWT cryptographic operation failed"
+      jwtDecodeError (JWT.KeyError m)     = JwtDecodeErr $ KeyError m
+      jwtDecodeError (JWT.BadAlgorithm m) = JwtDecodeErr $ BadAlgorithm m
+      jwtDecodeError JWT.BadCrypto        = JwtDecodeErr BadCrypto
       -- Control never reaches here, the decode function only returns the above three
-      jwtDecodeError _                    = JwtDecodeError "JWT couldn't be decoded"
+      jwtDecodeError _                    = JwtDecodeErr UnreachableDecodeError
 
       verifyClaims :: JWT.JwtContent -> Either JwtError JSON.Value
       verifyClaims (JWT.Jws (_, claims)) = case JSON.decodeStrict claims of
         Just jclaims@(JSON.Object mclaims) ->
-          verifyClaim mclaims "exp" isValidExpClaim "JWT expired" >>
-          verifyClaim mclaims "nbf" isValidNbfClaim "JWT not yet valid" >>
-          verifyClaim mclaims "iat" isValidIatClaim "JWT issued at future" >>
-          verifyClaim mclaims "aud" isValidAudClaim "JWT not in audience" >>
+          verifyClaim mclaims "exp" isValidExpClaim JWTExpired >>
+          verifyClaim mclaims "nbf" isValidNbfClaim JWTNotYetValid >>
+          verifyClaim mclaims "iat" isValidIatClaim JWTIssuedAtFuture >>
+          verifyClaim mclaims "aud" isValidAudClaim JWTNotInAudience >>
           return jclaims
-        _ -> Left $ JwtClaimsError "Parsing claims failed"
+        _ -> Left $ JwtClaimsErr ParsingClaimsFailed
       -- TODO: We could enable JWE support here (encrypted tokens)
-      verifyClaims _ = Left $ JwtDecodeError "Unsupported token type"
+      verifyClaims _ = Left $ JwtDecodeErr UnsupportedTokenType
 
       verifyClaim mclaims claim func err = do
         isValid <- maybe (Right True) func (KM.lookup claim mclaims)
-        unless isValid $ Left $ JwtClaimsError err
+        unless isValid $ Left $ JwtClaimsErr err
 
       allowedSkewSeconds = 30 :: Int64
       now = floor . nominalDiffTimeToSeconds $ utcTimeToPOSIXSeconds time
@@ -104,15 +105,15 @@ parseToken AppConfig{..} (Just tkn) time = do
 
       isValidExpClaim :: JSON.Value -> Either JwtError Bool
       isValidExpClaim (JSON.Number secs) = Right $ now <= (sciToInt secs + allowedSkewSeconds)
-      isValidExpClaim _ = Left $ JwtClaimsError "The JWT 'exp' claim must be a number"
+      isValidExpClaim _ = Left $ JwtClaimsErr ExpClaimNotNumber
 
       isValidNbfClaim :: JSON.Value -> Either JwtError Bool
       isValidNbfClaim (JSON.Number secs) = Right $ now >= (sciToInt secs - allowedSkewSeconds)
-      isValidNbfClaim _ = Left $ JwtClaimsError "The JWT 'nbf' claim must be a number"
+      isValidNbfClaim _ = Left $ JwtClaimsErr NbfClaimNotNumber
 
       isValidIatClaim :: JSON.Value -> Either JwtError Bool
       isValidIatClaim (JSON.Number secs) = Right $ now >= (sciToInt secs - allowedSkewSeconds)
-      isValidIatClaim _ = Left $ JwtClaimsError "The JWT 'iat' claim must be a number"
+      isValidIatClaim _ = Left $ JwtClaimsErr IatClaimNotNumber
 
       isValidAudClaim :: JSON.Value -> Either JwtError Bool
       isValidAudClaim JSON.Null = Right True -- {"aud": null} is valid for all audiences
@@ -120,7 +121,7 @@ parseToken AppConfig{..} (Just tkn) time = do
       isValidAudClaim (JSON.Array arr)
         | null arr = Right True              -- {"aud": []} is valid for all audiences
         | allStrings arr = Right $ maybe True (\a -> JSON.String a `elem` arr) configJwtAudience
-      isValidAudClaim _ = Left $ JwtClaimsError "The JWT 'aud' claim must be a string or an array of strings"
+      isValidAudClaim _ = Left $ JwtClaimsErr AudClaimNotStringOrArray
 
 parseClaims :: Monad m =>
   AppConfig -> JSON.Value -> ExceptT Error m AuthResult

src/PostgREST/Error.hs

@@ -14,6 +14,8 @@ module PostgREST.Error
   , PgError(..)
   , Error(..)
   , JwtError (..)
+  , JwtDecodeError(..)
+  , JwtClaimsError(..)
   , errorPayload
   , status
   ) where
@@ -86,7 +88,7 @@ data ApiRequestError
   | QueryParamError QPError
   | RelatedOrderNotToOne Text Text
   | UnacceptableFilter Text
-  | UnacceptableSchema [Text]
+  | UnacceptableSchema Text [Text]
   | UnsupportedMethod ByteString
   | GucHeadersError
   | GucStatusError
@@ -194,7 +196,7 @@ instance ErrorBody ApiRequestError where
   message (InvalidBody errorMessage)   = T.decodeUtf8 errorMessage
   message (InvalidRange _)             = "Requested range not satisfiable"
   message InvalidFilters               = "Filters must include all and only primary key columns with 'eq' operators"
-  message (UnacceptableSchema schemas) = "The schema must be one of the following: " <> T.intercalate ", " schemas
+  message (UnacceptableSchema sch _)   = "Invalid schema: " <> sch
   message (MediaTypeError cts)         = "None of these media types are available: " <> T.intercalate ", " (map T.decodeUtf8 cts)
   message (NotEmbedded resource)       = "'" <> resource <> "' is not an embedded resource in this request"
   message GucHeadersError              = "response.headers guc must be a JSON array composed of objects with a single key and a string value"
@@ -234,6 +236,7 @@ instance ErrorBody ApiRequestError where
   -- HINT: Maybe JSON.Value
   hint (NotEmbedded resource) = Just $ JSON.String $ "Verify that '" <> resource <> "' is included in the 'select' query parameter."
   hint (PGRSTParseError raiseErr) = Just $ JSON.String $ pgrstParseErrorHint raiseErr
+  hint (UnacceptableSchema _ schemas) = Just $ JSON.String $ "Only the following schemas are exposed: "  <> T.intercalate ", " schemas
 
   hint _ = Nothing
 
@@ -647,10 +650,32 @@ data Error
   deriving Show
 
 data JwtError
-  = JwtDecodeError Text
+  = JwtDecodeErr JwtDecodeError
   | JwtSecretMissing
   | JwtTokenRequired
-  | JwtClaimsError Text
+  | JwtClaimsErr JwtClaimsError
+  deriving Show
+
+data JwtDecodeError
+  = EmptyAuthHeader
+  | UnexpectedParts Int
+  | KeyError Text
+  | BadAlgorithm Text
+  | BadCrypto
+  | UnsupportedTokenType
+  | UnreachableDecodeError
+  deriving Show
+
+data JwtClaimsError
+  = JWTExpired
+  | JWTNotYetValid
+  | JWTIssuedAtFuture
+  | JWTNotInAudience
+  | ParsingClaimsFailed
+  | ExpClaimNotNumber
+  | NbfClaimNotNumber
+  | IatClaimNotNumber
+  | AudClaimNotStringOrArray
   deriving Show
 
 instance PgrstError Error where
@@ -696,14 +721,14 @@ instance ErrorBody Error where
   hint (PgErr err)           = hint err
 
 instance PgrstError JwtError where
-  status JwtDecodeError{} = HTTP.unauthorized401
+  status JwtDecodeErr{}   = HTTP.unauthorized401
   status JwtSecretMissing = HTTP.status500
   status JwtTokenRequired = HTTP.unauthorized401
-  status JwtClaimsError{} = HTTP.unauthorized401
+  status JwtClaimsErr{}   = HTTP.unauthorized401
 
-  headers (JwtDecodeError m) = [invalidTokenHeader m]
+  headers e@(JwtDecodeErr _) = [invalidTokenHeader $ message e]
   headers JwtTokenRequired   = [requiredTokenHeader]
-  headers (JwtClaimsError m) = [invalidTokenHeader m]
+  headers e@(JwtClaimsErr _) = [invalidTokenHeader $ message e]
   headers _                  = mempty
 
 instance JSON.ToJSON JwtError where
@@ -711,16 +736,36 @@ instance JSON.ToJSON JwtError where
     (code err) (message err) (details err) (hint err)
 
 instance ErrorBody JwtError where
-  code JwtSecretMissing   = "PGRST300"
-  code (JwtDecodeError _) = "PGRST301"
-  code JwtTokenRequired   = "PGRST302"
-  code (JwtClaimsError _) = "PGRST303"
+  code JwtSecretMissing = "PGRST300"
+  code (JwtDecodeErr _) = "PGRST301"
+  code JwtTokenRequired = "PGRST302"
+  code (JwtClaimsErr _) = "PGRST303"
 
-  message JwtSecretMissing     = "Server lacks JWT secret"
-  message (JwtDecodeError msg) = msg
-  message JwtTokenRequired     = "Anonymous access is disabled"
-  message (JwtClaimsError msg) = msg
+  message JwtSecretMissing = "Server lacks JWT secret"
+  message (JwtDecodeErr e) = case e of
+    EmptyAuthHeader        -> "Empty JWT is sent in Authorization header"
+    UnexpectedParts n      -> "Expected 3 parts in JWT; got " <> show n
+    KeyError _             -> "No suitable key or wrong key type"
+    BadAlgorithm _         -> "Wrong or unsupported encoding algorithm"
+    BadCrypto              -> "JWT cryptographic operation failed"
+    UnsupportedTokenType   -> "Unsupported token type"
+    UnreachableDecodeError -> "JWT couldn't be decoded"
+  message JwtTokenRequired = "Anonymous access is disabled"
+  message (JwtClaimsErr e) = case e of
+    JWTExpired               -> "JWT expired"
+    JWTNotYetValid           -> "JWT not yet valid"
+    JWTIssuedAtFuture        -> "JWT issued at future"
+    JWTNotInAudience         -> "JWT not in audience"
+    ParsingClaimsFailed      -> "Parsing claims failed"
+    ExpClaimNotNumber        -> "The JWT 'exp' claim must be a number"
+    NbfClaimNotNumber        -> "The JWT 'nbf' claim must be a number"
+    IatClaimNotNumber        -> "The JWT 'iat' claim must be a number"
+    AudClaimNotStringOrArray -> "The JWT 'aud' claim must be a string or an array of strings"
 
+  details (JwtDecodeErr jde) = case jde of
+    KeyError dets     -> Just $ JSON.String dets
+    BadAlgorithm dets -> Just $ JSON.String dets
+    _                 -> Nothing
   details _ = Nothing
 
   hint _    = Nothing

src/PostgREST/Network.hs

@@ -13,5 +13,9 @@ resolveHost sock = do
   sn <- NS.getSocketName sock
   case sn of
     NS.SockAddrInet _ hostAddr ->  pure $ Just $ fromString $ show $ fromHostAddress hostAddr
-    NS.SockAddrInet6 _ _ hostAddr6 _ -> pure $ Just $ fromString $ show $ fromHostAddress6 hostAddr6
+    -- The IPv6 addresses are wrapped in [] brackets. This is done in accordance
+    -- to RFC 3986 (https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2).
+    -- In short, we did this to have a clear separation between the port and host
+    -- because the components of an IPv6 are separated with the ':' character.
+    NS.SockAddrInet6 _ _ hostAddr6 _ -> pure $ Just $ fromString $ "[" ++ show (fromHostAddress6 hostAddr6) ++ "]"
     _ -> pure Nothing

src/PostgREST/Observation.hs

@@ -108,11 +108,8 @@ observationMessage = \case
   DBListenStart channel -> do
     "Listening for database notifications on the " <> show channel <> " channel"
   DBListenFail channel listenErr ->
-    "Failed listening for database notifications on the " <> show channel <> " channel. " <> (
-      case listenErr of
-        Left err  -> show err
-        Right err -> showListenerError err
-    )
+    "Failed listening for database notifications on the " <> show channel <> " channel. " <>
+      either showListenerConnError showListenerException listenErr
   DBListenRetry delay ->
     "Retrying listening for database notifications in " <> (show delay::Text) <> " seconds..."
   DBListenerGotSCacheMsg channel ->
@@ -157,8 +154,11 @@ observationMessage = \case
 
     jsonMessage err = T.decodeUtf8 . LBS.toStrict . Error.errorPayload $ Error.PgError False err
 
-    showListenerError :: Either SomeException () -> Text
-    showListenerError (Right _) = "Failed getting notifications" -- should not happen as the listener will never finish (hasql-notifications uses `forever` internally) with a Right result
-    showListenerError (Left e)  =
-      let showOnSingleLine txt = T.intercalate " " $ T.filter (/= '\t') <$> T.lines txt in -- the errors from hasql-notifications come intercalated with "\t\n"
-      showOnSingleLine $ show e
+    showOnSingleLine txt = T.intercalate " " $ T.filter (/= '\t') <$> T.lines txt -- the errors from hasql-notifications come intercalated with "\t\n"
+
+    showListenerConnError :: SQL.ConnectionError -> Text
+    showListenerConnError = maybe "Connection error" (showOnSingleLine . T.decodeUtf8)
+
+    showListenerException :: Either SomeException () -> Text
+    showListenerException (Right _) = "Failed getting notifications" -- should not happen as the listener will never finish (hasql-notifications uses `forever` internally) with a Right result
+    showListenerException (Left e)  = showOnSingleLine $ show e

src/PostgREST/Response/OpenAPI.hs

@@ -171,8 +171,9 @@ makePreferParam ts =
   & schema .~ ParamOther ((mempty :: ParamOtherSchema)
     & in_ .~ ParamHeader
     & type_ ?~ SwaggerString
-    & enum_ .~ JSON.decode (JSON.encode $ foldl (<>) [] (val <$> ts)))
+    & enum_ .~ if null enu then Nothing else JSON.decode (JSON.encode enu))
   where
+    enu = foldl (<>) [] (val <$> ts)
     val :: Text -> [Text]
     val = \case
       "count"      -> ["count=none"]

stack.yaml

@@ -9,6 +9,7 @@ nix:
   pure: false
 
 extra-deps:
+  - configurator-pg-0.2.11
   - fuzzyset-0.2.4
   - hasql-pool-1.0.1
   - jose-jwt-0.10.0

stack.yaml.lock

@@ -4,6 +4,13 @@
 #   https://docs.haskellstack.org/en/stable/topics/lock_files
 
 packages:
+- completed:
+    hackage: configurator-pg-0.2.11@sha256:de0c56386591e85159436b0af04a8f15a4f4e156354e99709676c2c2ee959505,2850
+    pantry-tree:
+      sha256: 7b4daa4ea970335414f26b313a168cd12182b7b34ea8af2616c83d38699c4301
+      size: 2527
+  original:
+    hackage: configurator-pg-0.2.11
 - completed:
     hackage: fuzzyset-0.2.4@sha256:f1b6de8bf33277bf6255207541d65028f1f1ea93af5541b654c86b5674995485,1618
     pantry-tree:

test/io/configs/expected/utf-8.config

@@ -0,0 +1,40 @@
+db-aggregates-enabled = false
+db-anon-role = ""
+db-channel = "pgrst"
+db-channel-enabled = true
+db-extra-search-path = "public"
+db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
+db-max-rows = ""
+db-plan-enabled = false
+db-pool = 10
+db-pool-acquisition-timeout = 10
+db-pool-max-lifetime = 1800
+db-pool-max-idletime = 30
+db-pool-automatic-recovery = true
+db-pre-request = ""
+db-prepared-statements = true
+db-root-spec = ""
+db-schemas = "public"
+db-config = true
+db-pre-config = ""
+db-tx-end = "commit"
+db-uri = "postgresql://"
+jwt-aud = ""
+jwt-role-claim-key = ".\"role\""
+jwt-secret = ""
+jwt-secret-is-base64 = false
+jwt-cache-max-lifetime = 0
+log-level = "crit"
+log-query = "disabled"
+openapi-mode = "follow-privileges"
+openapi-security-active = false
+openapi-server-proxy-uri = ""
+server-cors-allowed-origins = ""
+server-host = "!4"
+server-port = 3000
+server-trace-header = ""
+server-timing-enabled = false
+server-unix-socket = ""
+server-unix-socket-mode = "660"
+admin-server-host = "!4"
+admin-server-port = ""

test/io/configs/utf-8.config

@@ -0,0 +1,2 @@
+# Commènt utf-8 chàrs
+log-level = "crit"

test/io/postgrest.py

@@ -96,7 +96,9 @@ def run(
         if port:
             env["PGRST_SERVER_PORT"] = str(port)
             env["PGRST_SERVER_HOST"] = host or "localhost"
-            baseurl = f"http://localhost:{port}"
+            # When constructing IPv6 address, host address should be bracketed like [host]
+            apihost = f"[{host}]" if host and is_ipv6(host) else "localhost"
+            baseurl = f"http://{apihost}:{port}"
         else:
             socketfile = pathlib.Path(tmpdir) / "postgrest.sock"
             env["PGRST_SERVER_UNIX_SOCKET"] = str(socketfile)
@@ -104,7 +106,8 @@ def run(
 
         adminport = freeport(port)
         env["PGRST_ADMIN_SERVER_PORT"] = str(adminport)
-        adminurl = f"http://localhost:{adminport}"
+        adminhost = f"[{host}]" if host and is_ipv6(host) else "localhost"
+        adminurl = f"http://{adminhost}:{adminport}"
 
         command = [POSTGREST_BIN]
         env["HPCTIXFILE"] = hpctixfile()
@@ -218,3 +221,11 @@ def sleep_pool_connection(url, seconds):
         session.get(url + f"/rpc/sleep?seconds={seconds}", timeout=0.1)
     except requests.exceptions.ReadTimeout:
         pass
+
+
+def is_ipv6(addr):
+    try:
+        socket.inet_pton(socket.AF_INET6, addr)
+        return True
+    except OSError:
+        return False

test/io/test_io.py

@@ -93,6 +93,9 @@ def test_jwt_errors(defaultenv):
         response = postgrest.session.get("/", headers=headers)
         assert response.status_code == 401
         assert response.json()["message"] == "No suitable key or wrong key type"
+        assert (
+            response.json()["details"] == "None of the keys was able to decode the JWT"
+        )
 
         headers = jwtauthheader({"role": "not_existing"}, SECRET)
         response = postgrest.session.get("/", headers=headers)
@@ -141,6 +144,10 @@ def test_jwt_errors(defaultenv):
         response = postgrest.session.get("/", headers=headers)
         assert response.status_code == 401
         assert response.json()["message"] == "Wrong or unsupported encoding algorithm"
+        assert (
+            response.json()["details"]
+            == "JWT is unsecured but expected 'alg' was not 'none'"
+        )
 
     env = {
         **defaultenv,
@@ -1355,9 +1362,9 @@ def test_log_postgrest_version(defaultenv):
         assert "Starting PostgREST %s..." % version in output[0]
 
 
-def test_log_postgrest_host_and_port(defaultenv):
+@pytest.mark.parametrize("host", ["127.0.0.1", "::1"])
+def test_log_postgrest_host_and_port(host, defaultenv):
     "PostgREST should output the host and port it is bound to."
-    host = "127.0.0.1"
     port = freeport()
 
     with run(
@@ -1365,7 +1372,10 @@ def test_log_postgrest_host_and_port(defaultenv):
     ) as postgrest:
         output = postgrest.read_stdout(nlines=10)
 
-        assert f"API server listening on {host}:{port}" in output[2]  # output-sensitive
+        if is_ipv6(host):  # IPv6
+            assert f"API server listening on [{host}]:{port}" in output[2]
+        else:  # IPv4
+            assert f"API server listening on {host}:{port}" in output[2]
 
 
 def test_succeed_w_role_having_superuser_settings(defaultenv):
@@ -1930,3 +1940,21 @@ def test_schema_cache_error_observation(defaultenv):
             "Failed to load the schema cache using db-schemas=public and db-extra-search-path=x"
             in output[7]
         )
+
+
+def test_log_listener_connection_errors(defaultenv):
+    "The logs should show the listener connection error message in a single line"
+
+    env = {
+        **defaultenv,
+        "PGHOST": "no_host",
+        "PGRST_DB_CHANNEL_ENABLED": "true",
+    }
+
+    with run(env=env, no_startup_stdout=False, wait_for_readiness=False) as postgrest:
+        output = postgrest.read_stdout(nlines=5)
+        assert any(
+            'Failed listening for database notifications on the "pgrst" channel. could not translate host name "no_host" to address:'
+            in line
+            for line in output
+        )

test/spec/Feature/OpenApi/OpenApiSpec.hs

@@ -1085,6 +1085,13 @@ spec = describe "OpenAPI" $ do
         immutableGet `shouldNotBe` Nothing
         immutablePost `shouldNotBe` Nothing
 
+    it "does not include empty enum in the preferParams parameter" $ do
+      r <- simpleBody <$> get "/"
+      let preferParams = r ^? key "parameters" . key "preferParams" . key "enum"
+
+      liftIO $ do
+        preferParams `shouldBe` Nothing
+
   describe "Security" $
     it "does not include security or security definitions by default" $ do
       r <- simpleBody <$> get "/"

test/spec/Feature/Query/MultipleSchemaSpec.hs

@@ -72,9 +72,9 @@ spec =
           , matchHeaders = []
           }
 
-      it "fails trying to read table from unkown schema" $
-        request methodGet "/parents" [("Accept-Profile", "unkown")] "" `shouldRespondWith`
-          [json|{"message":"The schema must be one of the following: v1, v2, SPECIAL \"@/\\#~_-","code":"PGRST106","details":null,"hint":null}|]
+      it "fails trying to read table from unknown schema" $
+        request methodGet "/parents" [("Accept-Profile", "unknown")] "" `shouldRespondWith`
+          [json|{"message":"Invalid schema: unknown","code":"PGRST106","details":null,"hint":"Only the following schemas are exposed: v1, v2, SPECIAL \"@/\\#~_-"}|]
           {
             matchStatus = 406
           }
@@ -151,7 +151,7 @@ spec =
         request methodPost "/children" [("Content-Profile", "unknown")]
           [json|{"name": "child 4", "parent_id": 4}|]
           `shouldRespondWith`
-          [json|{"message":"The schema must be one of the following: v1, v2, SPECIAL \"@/\\#~_-","code":"PGRST106","details":null,"hint":null}|]
+          [json|{"message":"Invalid schema: unknown","code":"PGRST106","details":null,"hint":"Only the following schemas are exposed: v1, v2, SPECIAL \"@/\\#~_-"}|]
           {
             matchStatus = 406
           }
@@ -389,9 +389,9 @@ spec =
           let def = simpleBody r ^? key "definitions" . key "another_table"
           def `shouldBe` Nothing
 
-      it "fails trying to read definitions from unkown schema" $
-        request methodGet "/" [("Accept-Profile", "unkown")] "" `shouldRespondWith`
-          [json|{"message":"The schema must be one of the following: v1, v2, SPECIAL \"@/\\#~_-","code":"PGRST106","details":null,"hint":null}|]
+      it "fails trying to read definitions from unknown schema" $
+        request methodGet "/" [("Accept-Profile", "unknown")] "" `shouldRespondWith`
+          [json|{"message":"Invalid schema: unknown","code":"PGRST106","details":null,"hint":"Only the following schemas are exposed: v1, v2, SPECIAL \"@/\\#~_-"}|]
           {
             matchStatus = 406
           }