chore: bump version to 14.14

Admin server was crashing silently and requests hang indefinitely.
With this fix, we are now logging the admin server exceptions and also
close the socket afterwards so admin request don't hang.

Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>

.cirrus.yml

@@ -1,42 +0,0 @@
-freebsd_instance:
-  image_family: freebsd-14-3
-
-build_task:
-  # Don't change this name without adjusting .github/workflows/build.yaml
-  name: Build FreeBSD (Stack)
-  install_script: pkg install -y postgresql16-client hs-stack git
-
-  only_if: |
-    $CIRRUS_TAG != '' || $CIRRUS_BRANCH == 'main' || $CIRRUS_BRANCH =~ 'v*' ||
-    changesInclude(
-      '.github/workflows/build.yaml',
-      '.github/actions/artifact-from-cirrus/**',
-      '.cirrus.yml',
-      'postgrest.cabal',
-      'stack.yaml*',
-      '**.hs'
-    )
-
-  stack_cache:
-    folders: /.stack
-    fingerprint_script:
-      - echo $CIRRUS_OS
-      - stack --version
-      - md5sum postgrest.cabal
-      - md5sum stack.yaml.lock
-
-  stack_work_cache:
-    folders: .stack-work
-    fingerprint_script:
-      - echo $CIRRUS_OS
-      - stack --version
-      - md5sum postgrest.cabal
-      - md5sum stack.yaml.lock
-      - find main src -type f -iname '*.hs' -exec md5sum "{}" +
-
-  build_script: |
-    stack build -j 1 --local-bin-path . --copy-bins
-    strip postgrest
-
-  bin_artifacts:
-    path: postgrest

.github/actionlint.yml

@@ -5,3 +5,4 @@ self-hosted-runner:
     - macos-15-intel
     - macos-26
     - ubuntu-24.04-arm
+    - ubuntu-slim

.github/actions/artifact-from-cirrus/action.yaml

@@ -1,119 +0,0 @@
-name: Artifact from Cirrus
-
-description: Waits for a specific Cirrus CI run to complete, then downloads the artifact and uploads it to the current workflow. This will silently succeed if Cirrus CI did not schedule a task within 2 minutes.
-
-inputs:
-  download:
-    description: Name of Artifact to download from Cirrus CI
-    required: true
-  task:
-    description: Name of Cirrus Task
-    required: true
-  token:
-    description: GitHub Token
-    required: true
-  upload:
-    description: Name of Artifact to upload on GitHub Actions
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - shell: bash
-      run: echo "GH_TOKEN=${{ inputs.token }}" >> "$GITHUB_ENV"
-    - name: Wait for Check Suite to be created
-      id: check-suite
-      env:
-        # GITHUB_SHA does weird things for pull request, so we roll our own:
-        COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
-      shell: bash
-      run: |
-        get_check_runs_url() {
-          gh api "repos/{owner}/{repo}/commits/${COMMIT}/check-suites" \
-            | jq -r '.check_suites[] | select(.app.slug == "cirrus-ci") | .check_runs_url'
-        }
-        for _ in $(seq 1 12); do
-          check_runs_url="$(get_check_runs_url)"
-          if [ -z "$check_runs_url" ]; then
-            echo "Cirrus CI task has not started, yet. Waiting..."
-            sleep 10
-          else
-            echo "check_runs_url=$check_runs_url" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-        done
-        >&2 echo "Cirrus CI check suite not found. Is Cirrus CI enabled for this repo?"
-    - name: Find task by name
-      id: find-task
-      if: steps.check-suite.outputs.check_runs_url
-      shell: bash
-      run: |
-        get_number_of_tasks() {
-          gh api "${{ steps.check-suite.outputs.check_runs_url }}" \
-            | jq -r '.check_runs | map(select(.name == "${{ inputs.task }}")) | length'
-        }
-        tasks="$(get_number_of_tasks)"
-        case "$tasks" in
-          0)
-            echo "Task not found, assuming it's skipped intentionally..."
-            exit 0
-            ;;
-          1)
-            echo "task_found=1" >> "$GITHUB_OUTPUT"
-            exit 0
-            ;;
-          *)
-            >&2 echo "More than 1 task with the same name found. Don't know what to do..."
-            exit 1
-            ;;
-        esac
-    - name: Wait for Cirrus CI to complete task
-      if: steps.find-task.outputs.task_found
-      shell: bash
-      run: |
-        get_conclusion() {
-          gh api "${{ steps.check-suite.outputs.check_runs_url }}" \
-            | jq -r '.check_runs[] | select(.name == "${{ inputs.task }}" and .status == "completed") | .conclusion'
-        }
-        while true; do
-          conclusion="$(get_conclusion)"
-          if [ -z "$conclusion" ]; then
-            echo "Cirrus CI task has not completed, yet. Waiting..."
-            sleep 30
-          else
-            if [ "$conclusion" == "success" ]; then
-              break
-            else
-              exit 1
-            fi
-          fi
-        done
-    - name: Download artifact from Cirrus CI
-      if: steps.find-task.outputs.task_found
-      id: download
-      shell: bash
-      run: |
-        get_external_id() {
-          gh api "${{ steps.check-suite.outputs.check_runs_url }}" \
-            | jq -er '.check_runs[] | select(.name == "${{ inputs.task }}") | .external_id'
-        }
-        archive="$(mktemp)"
-        artifacts="$(mktemp -d)"
-        until curl --no-progress-meter --fail -o "${archive}" \
-                "https://api.cirrus-ci.com/v1/artifact/task/$(get_external_id)/${{ inputs.download }}.zip"
-        do
-          # This happens when a tag is pushed on the same commit. In this case the
-          # job is immediately marked as "completed" for us, so we end up here after a few
-          # seconds - but the actual Cirrus CI task is still running and didn't produce its artifact, yet.
-          echo "Artifact not found on Cirrus CI, yet. Waiting..."
-          sleep 30
-        done
-        unzip "${archive}" -d "${artifacts}"
-        echo "artifacts=${artifacts}" >> "$GITHUB_OUTPUT"
-    - name: Save artifact to GitHub Actions
-      if: steps.find-task.outputs.task_found
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      with:
-        name: ${{ inputs.upload }}
-        path: ${{ steps.download.outputs.artifacts }}
-        if-no-files-found: error

.github/actions/cache-on-main/action.yaml

@@ -19,14 +19,14 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       if: ${{ startsWith(github.ref, 'refs/heads/') || (inputs.save-prs && startsWith(github.ref, 'refs/pull/')) }}
       with:
         path: ${{ inputs.path }}
         key: ${{ runner.os }}-${{ inputs.prefix }}-${{ inputs.suffix }}
         restore-keys: |
           ${{ runner.os }}-${{ inputs.prefix }}-
-    - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       if: ${{ !startsWith(github.ref, 'refs/heads/') && !(inputs.save-prs && startsWith(github.ref, 'refs/pull/'))  }}
       with:
         path: ${{ inputs.path }}

.github/actions/run-anywhere/action.yaml

@@ -0,0 +1,35 @@
+name: Run anywhere
+
+description: Runs the same code either in a VM or on the bare machine
+
+inputs:
+  vm:
+    description: Which VM to run on.
+  envs:
+    description: List of relevant environment variables, which might need to be copied into the VM.
+  prepare:
+    description: Code to run in a prepare step, e.g. installing dependencies.
+  run:
+    description: Code to run as the main action.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - if: ${{ inputs.vm == 'freebsd' }}
+      uses: vmactions/freebsd-vm@5a72679103d223925653750faa878a143340fbd0 # v1.5.0
+      with:
+        envs: ${{ inputs.envs }}
+        prepare: ${{ inputs.prepare }}
+        # Work around https://github.com/vmactions/freebsd-vm/issues/59
+        run: |
+          pw user add -n action -m
+          su action -c '${{ inputs.run }}'
+    - if: ${{ inputs.vm == '' }}
+      name: Prepare
+      shell: ${{ runner.os == 'Windows' && 'pwsh' || 'bash' }}
+      run: ${{ inputs.prepare }}
+    - if: ${{ inputs.vm == '' }}
+      name: Run
+      shell: ${{ runner.os == 'Windows' && 'pwsh' || 'bash' }}
+      run: ${{ inputs.run }}

.github/actions/setup-nix/action.yaml

@@ -11,7 +11,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34
+    - uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35
       with:
         nix_conf: |-
           always-allow-substitutes = true

.github/workflows/backport.yaml

@@ -9,7 +9,7 @@ on:
 jobs:
   backport:
     name: Backport
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-slim
     # It triggers only when PR is already merged on either:
     #
     # - The merge event itself (action != labeled) or
@@ -30,7 +30,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ vars.POSTGREST_CI_APP_ID }}
+          client-id: ${{ vars.POSTGREST_CI_APP_ID }}
           private-key: ${{ secrets.POSTGREST_CI_PRIVATE_KEY }}
           permission-contents: write
           permission-pull-requests: write
@@ -38,7 +38,7 @@ jobs:
 
       # This is required for backport action to cherry-pick the PR
       - name: Fetch PR ref
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/build.yaml

@@ -16,6 +16,7 @@ on:
       - .github/*
       - '*.nix'
       - nix/**
+      - flake.lock
       - .cirrus.yml
       - cabal.project*
       - postgrest.cabal
@@ -33,7 +34,7 @@ jobs:
     name: Nix - Linux x86-64 static
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Nix Environment
         uses: ./.github/actions/setup-nix
         with:
@@ -62,24 +63,19 @@ jobs:
     name: Nix - MacOS
     runs-on: macos-26
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Nix Environment
         uses: ./.github/actions/setup-nix
         with:
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-      - name: Install gnu sed
-        run: brew install gnu-sed
+      - name: Install nix-build-uncached
+        run: nix-env -f default.nix -iA nix-build-uncached
 
-      - name: Build everything
-        run: |
-          # The --dry-run will give us a list of derivations to download from cachix and
-          # derivations to build. We only take those that would have to be built and then build
-          # those explicitly. This has the advantage that pure verification will not include
-          # a download anymore, making it much faster. If something needs to be built, only
-          # the dependencies required to do so will be downloaded, but not everything.
-          nix-build --dry-run 2>&1 \
-            | gsed -e '1,/derivations will be built:$/d' -e '/paths will be fetched/Q' \
-            | xargs nix-build
+      - name: Build everything (default.nix)
+        run: nix-build-uncached
+
+      - name: Build everything (shell.nix)
+        run: nix-build-uncached shell.nix
 
 
   stack:
@@ -87,73 +83,69 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          - name: FreeBSD x86-64
+            runs-on: ubuntu-24.04
+            vm: freebsd
+            artifact: postgrest-freebsd-x86-64
+            deps: pkg install -y postgresql16-client hs-stack
+
           - name: Linux aarch64
             runs-on: ubuntu-24.04-arm
-            cache: |
-              ~/.stack/pantry
-              ~/.stack/snapshots
-              ~/.stack/stack.sqlite3
             artifact: postgrest-ubuntu-aarch64
             deps: sudo apt-get update && sudo apt-get install libpq-dev
 
           - name: MacOS aarch64
             runs-on: macos-14
-            cache: |
-              ~/.stack/pantry
-              ~/.stack/snapshots
-              ~/.stack/stack.sqlite3
             artifact: postgrest-macos-aarch64
             deps: brew link --force libpq
 
           - name: MacOS x86-64
             runs-on: macos-15-intel
-            cache: |
-              ~/.stack/pantry
-              ~/.stack/snapshots
-              ~/.stack/stack.sqlite3
             artifact: postgrest-macos-x86-64
             deps: brew link --force libpq
 
           - name: Windows
             runs-on: windows-2022
-            cache: |
-              C:\sr\pantry
-              C:\sr\snapshots
-              C:\sr\stack.sqlite3
             deps: Add-Content $env:GITHUB_PATH $env:PGBIN
             artifact: postgrest-windows-x86-64
 
     name: Stack - ${{ matrix.name }}
     runs-on: ${{ matrix.runs-on }}
+    env:
+      # Putting .stack in the working directory helps with moving this in and out of the FreeBSD VM.
+      STACK_ROOT: ${{ github.workspace }}/.stack
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - if: ${{ !matrix.vm }}
+        uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2.11.0
         with:
           # This must match the version in stack.yaml's resolver
           ghc-version: 9.6.7
           enable-stack: true
           stack-no-global: true
           stack-setup-ghc: true
-      - name: Cache ~/.stack
+      - name: Cache .stack
         uses: ./.github/actions/cache-on-main
         with:
-          path: ${{ matrix.cache }}
-          prefix: stack
+          path: .stack
+          prefix: ${{ matrix.vm }}${{ matrix.vm && '-' }}stack
           suffix: ${{ hashFiles('postgrest.cabal', 'stack.yaml.lock') }}
       - name: Cache .stack-work
         uses: ./.github/actions/cache-on-main
         with:
           path: .stack-work
           save-prs: true
-          prefix: stack-work-${{ hashFiles('postgrest.cabal', 'stack.yaml.lock') }}
+          prefix: ${{ matrix.vm }}${{ matrix.vm && '-' }}stack-work-${{ hashFiles('postgrest.cabal', 'stack.yaml.lock') }}
           suffix: ${{ hashFiles('main/**/*.hs', 'src/**/*.hs') }}
-      - name: Install dependencies
-        if: matrix.deps
-        run: ${{ matrix.deps }}
       - name: Build with Stack
-        run: stack build --lock-file error-on-write --local-bin-path result --copy-bins
-      - name: Strip Executable
-        run: strip result/postgrest*
+        uses: ./.github/actions/run-anywhere
+        with:
+          vm: ${{ matrix.vm }}
+          envs: STACK_ROOT
+          prepare: ${{ matrix.deps }}
+          run: |
+            stack build --lock-file error-on-write --local-bin-path result --copy-bins
+            strip result/postgrest*
       - name: Save built executable as artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -164,19 +156,6 @@ jobs:
           if-no-files-found: error
 
 
-  freebsd:
-    name: Stack - FreeBSD from CirrusCI
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/artifact-from-cirrus
-        with:
-          token: ${{ github.token }}
-          task: Build FreeBSD (Stack)
-          download: bin
-          upload: postgrest-freebsd-x86-64
-
-
   cabal:
     strategy:
       matrix:
@@ -185,7 +164,7 @@ jobs:
     name: Cabal - Linux x86-64 - GHC ${{ matrix.ghc }}
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2.11.0
         with:
           ghc-version: ${{ matrix.ghc }}

.github/workflows/check.yaml

@@ -20,7 +20,7 @@ jobs:
     name: Lint & Style
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Nix Environment
         uses: ./.github/actions/setup-nix
         with:
@@ -36,7 +36,7 @@ jobs:
     name: Commit
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 100  # fetch history (last 100 commits) instead of default shallow clone history, this is deemed enough for a PR history
       - name: Setup Nix Environment

.github/workflows/ci.yaml

@@ -43,13 +43,13 @@ jobs:
       group: ci-tag-${{ (github.ref == 'refs/heads/main' && github.ref) || github.run_id }}
       cancel-in-progress: true
     if: vars.RELEASE_ENABLED
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-slim
     needs:
       - docs
       - test
       - build
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ssh-key: ${{ secrets.POSTGREST_SSH_KEY }}
       - name: Tag latest commit

.github/workflows/docs.yaml

@@ -14,6 +14,7 @@ on:
       - .github/actions/setup-nix/**
       - default.nix
       - nix/**
+      - flake.lock
       - docs/**
       - '!**.md'
 
@@ -27,7 +28,7 @@ jobs:
     name: Build
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - name: Setup Nix Environment
       uses: ./.github/actions/setup-nix
       with:
@@ -41,7 +42,7 @@ jobs:
     name: Spellcheck
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - name: Setup Nix Environment
       uses: ./.github/actions/setup-nix
       with:

.github/workflows/linkcheck.yaml

@@ -10,7 +10,7 @@ jobs:
     name: Linkcheck
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - name: Setup Nix Environment
       uses: ./.github/actions/setup-nix
       with:
@@ -27,7 +27,7 @@ jobs:
       if: ${{ failure() && steps.linkcheck.outcome == 'failure' }} # only create the token on linkcheck failure
       uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       with:
-        app-id: ${{ vars.POSTGREST_CI_APP_ID }}
+        client-id: ${{ vars.POSTGREST_CI_APP_ID }}
         private-key: ${{ secrets.POSTGREST_CI_PRIVATE_KEY }}
         permission-issues: write # required for commenting on issues
 

.github/workflows/release.yaml

@@ -19,13 +19,15 @@ jobs:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
 
-  prepare:
-    name: Prepare
-    runs-on: ubuntu-24.04
+  github:
+    name: GitHub
+    permissions:
+      contents: write
+    runs-on: ubuntu-slim
     needs:
       - build
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Check the version to be released
         run: |
           cabal_version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
@@ -47,23 +49,7 @@ jobs:
 
           echo "Relevant extract from CHANGELOG.md:"
           cat CHANGES.md
-      - name: Save CHANGES.md as artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: release-changes
-          path: CHANGES.md
-          if-no-files-found: error
 
-
-  github:
-    name: GitHub
-    permissions:
-      contents: write
-    runs-on: ubuntu-24.04
-    needs:
-      - prepare
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Download all artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -115,14 +101,14 @@ jobs:
             gh release edit devel \
               -t devel \
               --verify-tag \
-              -F artifacts/release-changes/CHANGES.md \
+              -F CHANGES.md \
               --prerelease
             gh release upload --clobber devel release-bundle/*
           else
             gh release create "${GITHUB_REF_NAME}" \
               -t "${GITHUB_REF_NAME}" \
               --verify-tag \
-              -F artifacts/release-changes/CHANGES.md \
+              -F CHANGES.md \
               release-bundle/*
           fi
 
@@ -131,13 +117,13 @@ jobs:
     name: Docker Hub
     runs-on: ubuntu-24.04-arm
     needs:
-      - prepare
+      - github
     if: |
       vars.DOCKER_REPO && vars.DOCKER_USER
     env:
       DOCKER_REPO: ${{ vars.DOCKER_REPO }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Download x86-64 Docker image
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -146,8 +132,8 @@ jobs:
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: postgrest-ubuntu-aarch64
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ vars.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASS }}
@@ -185,16 +171,9 @@ jobs:
             echo "Skipping push to 'latest' tag for pre-release..."
           fi
 
-
-  docker-description:
-    name: Docker Hub Description
-    runs-on: ubuntu-24.04
-    if: |
-      vars.DOCKER_REPO && vars.DOCKER_USER &&
-      github.ref == 'refs/tags/devel'
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
+        if: github.ref == 'refs/tags/devel'
+        name: Docker Hub Description
         with:
           username: ${{ vars.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASS }}

.github/workflows/test.yaml

@@ -17,6 +17,7 @@ on:
       - .github/actions/setup-nix/**
       - default.nix
       - nix/**
+      - flake.lock
       - .stylish-haskell.yaml
       - cabal.project
       - postgrest.cabal
@@ -39,7 +40,7 @@ jobs:
         # https://github.com/actions/runner/issues/241#issuecomment-842566950
         shell: script -qec "bash --noprofile --norc -eo pipefail {0}"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Nix Environment
         uses: ./.github/actions/setup-nix
         with:
@@ -51,7 +52,7 @@ jobs:
       - name: Run coverage (IO tests and Spec tests against PostgreSQL 15)
         run: postgrest-coverage
       - name: Upload coverage to codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ./coverage/codecov.json
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -69,7 +70,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        pgVersion: [13, 14, 15, 16, 17]
+        # Latest version is tested via `coverage` above.
+        pgVersion: [13, 14, 15, 16]
     name: PG ${{ matrix.pgVersion }}
     runs-on: ubuntu-24.04
     defaults:
@@ -78,7 +80,7 @@ jobs:
         # https://github.com/actions/runner/issues/241#issuecomment-842566950
         shell: script -qec "bash --noprofile --norc -eo pipefail {0}"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Nix Environment
         uses: ./.github/actions/setup-nix
         with:
@@ -108,7 +110,7 @@ jobs:
     name: Memory
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Nix Environment
         uses: ./.github/actions/setup-nix
         with:
@@ -123,12 +125,13 @@ jobs:
 
   loadtest:
     strategy:
+      fail-fast: false
       matrix:
         kind: ['mixed', 'jwt-hs', 'jwt-hs-cache', 'jwt-hs-cache-worst', 'jwt-rsa', 'jwt-rsa-cache', 'jwt-rsa-cache-worst']
     name: Loadtest
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Setup Nix Environment
@@ -163,7 +166,7 @@ jobs:
     name: Flake Check
     runs-on: ${{ matrix.runs-on }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Setup Nix Environment

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file. From versio
 
 ## Unreleased
 
+## [14.14] - 2026-06-29
+
+### Fixed
+
+- Fix admin server not logging cause of failure by @taimoorzaeem in #5012
+
+## [14.13] - 2026-06-04
+
+### Fixed
+
+- Fix connection retrying message in `PGRST000` error by @netqo in #4980
+  + Remove redundant "Retrying the connection." from message because it is logged separately
+- Fix request failures when `work_mem` is set on a role by @laurenceisla in #4955
+
 ## [14.12] - 2026-05-20
 
 ### Fixed

Dockerfile

@@ -2,7 +2,7 @@
 # The x86-64 is a single-static-binary image built via Nix, see:
 # nix/tools/docker/README.md
 
-FROM ubuntu:resolute@sha256:f3d28607ddd78734bb7f71f117f3c6706c666b8b76cbff7c9ff6e5718d46ff64 AS postgrest
+FROM ubuntu:resolute@sha256:53958ec7b67c2c9355df922dd08dbf0360611f8c3cdb656875e81873db9ffdba AS postgrest
 
 RUN apt-get update -y \
     && apt install -y --no-install-recommends libpq-dev zlib1g-dev jq gcc libnuma-dev \

default.nix

@@ -108,6 +108,9 @@ rec {
       inherit (pkgs.haskell.packages."${compiler}") ghcWithPackages;
     };
 
+  # Used by CI on MacOS
+  inherit (pkgs) nix-build-uncached;
+
   ### Tools
 
   cabalTools =

docs/integrations/postgis.rst

@@ -3,7 +3,7 @@
 PostGIS
 =======
 
-You can use the string representation for `PostGIS <https://postgis.net/>`_ data types such as ``geometry`` or ``geography`` (you need to `install PostGIS <https://postgis.net/documentation/getting_started/>`_ first).
+To work with `PostGIS <https://postgis.net/>`_ data types such as ``geometry`` or ``geography``, you'll need to `install PostGIS <https://postgis.net/documentation/getting_started/>`_ first.
 
 .. code-block:: postgres
 
@@ -16,20 +16,16 @@ You can use the string representation for `PostGIS <https://postgis.net/>`_ data
     area geometry
   );
 
-To add areas in polygon format, you can use string representation:
+  insert into coverage (id, name, area) values
+    (1, 'small', ST_GeomFromText('POLYGON((0 0, 1 0, 1 1, 0 1, 0 0))',4326)),
+    (2, 'big', ST_GeomFromText('POLYGON((0 0, 10 0, 10 10, 0 10, 0 0))', 4326);
 
-.. code-block:: bash
+.. _application/geo+json:
 
-  curl "http://localhost:3000/coverage" \
-    -X POST -H "Content-Type: application/json" \
-    -d @- << EOF
-    [
-      { "id": 1, "name": "small", "area": "SRID=4326;POLYGON((0 0, 1 0, 1 1, 0 1, 0 0))" },
-      { "id": 2, "name": "big", "area": "SRID=4326;POLYGON((0 0, 10 0, 10 10, 0 10, 0 0))" }
-    ]
-  EOF
+``application/geo+json``
+------------------------
 
-Now, when you request the information, PostgREST will automatically cast the ``area`` column into a ``Polygon`` geometry type. Although this is useful, you may need the whole output to be in `GeoJSON <https://geojson.org/>`_ format out of the box, which can be done by including the ``Accept: application/geo+json`` in the request. This will work for PostGIS versions 3.0.0 and up and will return the output as a `FeatureCollection Object <https://www.rfc-editor.org/rfc/rfc7946#section-3.3>`_:
+PostgREST supports the `standard <https://www.iana.org/assignments/media-types/application/geo+json>`_ ``application/geo+json`` media type which can be used to get the output in `GeoJSON <https://geojson.org/>`_ format. This will work for PostGIS versions 3.0.0 and up and will return the output as a `FeatureCollection Object <https://www.rfc-editor.org/rfc/rfc7946#section-3.3>`_:
 
 .. code-block:: bash
 
@@ -70,6 +66,9 @@ Now, when you request the information, PostgREST will automatically cast the ``a
     ]
   }
 
+Using generated columns
+-----------------------
+
 If you need to add an extra property, like the area in square units by using ``st_area(area)``, you could add a generated column to the table and it will appear in the ``properties`` key of each ``Feature``.
 
 .. code-block:: postgres
@@ -135,3 +134,21 @@ Now this query will return the same results:
       }
     ]
   }
+
+Using string representation
+---------------------------
+
+To insert areas in polygon format, you can use string representation:
+
+.. code-block:: bash
+
+  curl "http://localhost:3000/coverage" \
+    -X POST -H "Content-Type: application/json" \
+    -d @- << EOF
+    [
+      { "id": 3, "name": "strip", "area": "SRID=4326;POLYGON((0 0, 50 0, 50 2, 0 2, 0 0))" },
+      { "id": 4, "name": "diamond", "area": "SRID=4326;POLYGON((5 0, 10 5, 5 10, 0 5, 5 0))" }
+    ]
+  EOF
+
+PostgREST will automatically cast the ``area`` column into a ``Polygon`` geometry type. 

docs/references/api/resource_representation.rst

@@ -51,7 +51,7 @@ Builtin handlers are offered for common standard media types.
 
 * ``text/csv`` and ``application/json``, for all API endpoints. See :ref:`tables_views` and :ref:`functions`.
 * ``application/openapi+json``, for the root endpoint. See :ref:`open-api`.
-* ``application/geo+json``, see :ref:`ww_postgis`.
+* ``application/geo+json``, see :ref:`application/geo+json`.
 * ``*/*``, resolves to ``application/json`` for API endpoints and to ``application/openapi+json`` for the root endpoint.
 
 The following vendor media types handlers are also supported.

nix/tools/docs.nix

@@ -122,6 +122,8 @@ let
         workingDir = "/docs";
       }
       ''
+        echo "Checking spelling mistakes..."
+
         export LC_ALL=C
 
         FILES=$(find . -type f -iname '*.rst' | tr '\n' ' ')
@@ -144,6 +146,8 @@ let
         workingDir = "/docs";
       }
       ''
+        echo "Detecting obsolete dictionary entries..."
+
         export LC_ALL=C
 
         FILES=$(find . -type f -iname '*.rst' | tr '\n' ' ')

postgrest.cabal

@@ -1,5 +1,5 @@
 name:               postgrest
-version:            14.12
+version:            14.14
 synopsis:           REST API for any Postgres database
 description:        Reads the schema of a PostgreSQL database and creates RESTful routes
                     for tables, views, and functions, supporting all HTTP methods that security

src/PostgREST/Admin.hs

@@ -11,7 +11,8 @@ import Control.Monad.Extra       (whenJust)
 import Network.Socket            hiding (addrFamily)
 import Network.Socket.ByteString
 
-import PostgREST.AppState    (AppState)
+import PostgREST.AppState    (AppState, getConfig)
+import PostgREST.Config      (AppConfig (..))
 import PostgREST.MediaType   (MediaType (..), toContentType)
 import PostgREST.Metrics     (metricsToText)
 import PostgREST.Network     (resolveSocketToAddress)
@@ -24,13 +25,22 @@ import           Protolude
 
 runAdmin :: AppState -> Maybe NS.Socket -> NS.Socket -> Warp.Settings -> IO ()
 runAdmin appState maybeAdminSocket socketREST settings = do
+  conf <- getConfig appState
   whenJust maybeAdminSocket $ \adminSocket -> do
     address <- resolveSocketToAddress adminSocket
-    observer $ AdminStartObs address
-    void . forkIO $ Warp.runSettingsSocket settings adminSocket adminApp
+    void . forkIO $ handle (onError adminSocket) $
+      Warp.runSettingsSocket (adminServerSettings conf address) adminSocket adminApp
   where
     adminApp = admin appState socketREST
     observer = AppState.getObserver appState
+    adminServerSettings config addr =
+      settings
+        & Warp.setBeforeMainLoop (observer $ AdminStartObs addr)
+        & maybe identity Warp.setPort (configAdminServerPort config)
+
+    onError adminSock ex = do
+      observer $ AdminServerCrashedObs ex
+      NS.close adminSock -- we close the socket so request doesn't hang
 
 -- | PostgREST admin application
 admin :: AppState.AppState -> NS.Socket -> Wai.Application

src/PostgREST/Config.hs

@@ -119,8 +119,6 @@ data AppConfig = AppConfig
   , configRoleSettings             :: RoleSettings
   , configRoleIsoLvl               :: RoleIsolationLvl
   , configInternalSCQuerySleep     :: Maybe Int32
-  , configInternalSCLoadSleep      :: Maybe Int32
-  , configInternalSCRelLoadSleep   :: Maybe Int32
   }
 
 data LogLevel = LogCrit | LogError | LogWarn | LogInfo | LogDebug
@@ -304,8 +302,6 @@ parser optPath env dbSettings roleSettings roleIsolationLvl =
     <*> pure roleSettings
     <*> pure roleIsolationLvl
     <*> optInt "internal-schema-cache-query-sleep"
-    <*> optInt "internal-schema-cache-load-sleep"
-    <*> optInt "internal-schema-cache-relationship-load-sleep"
   where
     parseAppSettings :: C.Key -> C.Parser C.Config [(Text, Text)]
     parseAppSettings key = addFromEnv . fmap (fmap coerceText) <$> C.subassocs key C.value

src/PostgREST/Config/Database.hs

@@ -16,6 +16,7 @@ import Control.Arrow ((***))
 import PostgREST.Config.PgVersion (PgVersion (..), pgVersion150)
 
 import qualified Data.HashMap.Strict as HM
+import qualified Data.Text           as T
 
 import qualified Hasql.Decoders             as HD
 import qualified Hasql.Encoders             as HE
@@ -32,8 +33,8 @@ type RoleSettings     = (HM.HashMap ByteString (HM.HashMap ByteString ByteString
 type RoleIsolationLvl = HM.HashMap ByteString SQL.IsolationLevel
 type TimezoneNames    = Set Text -- cache timezone names for prefer timezone=
 
-toIsolationLevel :: (Eq a, IsString a) => a -> SQL.IsolationLevel
-toIsolationLevel a = case a of
+toIsolationLevel :: Text -> SQL.IsolationLevel
+toIsolationLevel a = case T.toLower a of
   "repeatable read" -> SQL.RepeatableRead
   "serializable"    -> SQL.Serializable
   _                 -> SQL.ReadCommitted
@@ -148,7 +149,7 @@ queryRoleSettings pgVer prepared =
         SELECT
           rolname,
           substr(setting, 1, strpos(setting, '=') - 1) as key,
-          lower(substr(setting, strpos(setting, '=') + 1)) as value
+          substr(setting, strpos(setting, '=') + 1) as value
         FROM role_setting
       ),
       iso_setting AS (

src/PostgREST/Error.hs

@@ -541,7 +541,7 @@ instance ErrorBody SQL.UsageError where
   code    (SQL.SessionUsageError (SQL.QueryError _ _ e)) = code e
   code    SQL.AcquisitionTimeoutUsageError               = "PGRST003"
 
-  message (SQL.ConnectionUsageError _) = "Database connection error. Retrying the connection."
+  message (SQL.ConnectionUsageError _) = "Database connection error."
   message (SQL.SessionUsageError (SQL.QueryError _ _ e)) = message e
   message SQL.AcquisitionTimeoutUsageError = "Timed out acquiring connection from connection pool."
 

src/PostgREST/Logger.hs

@@ -160,6 +160,8 @@ observationMessage :: Observation -> Text
 observationMessage = \case
   AdminStartObs address ->
     "Admin server listening on " <> address
+  AdminServerCrashedObs ex ->
+    "FAILURE: Admin server crashed unexpectedly: " <> (showOnSingleLine '\t' . show) ex
   AppStartObs ver ->
     "Starting PostgREST " <> T.decodeUtf8 ver <> "..."
   AppServerAddressObs address ->

src/PostgREST/Observation.hs

@@ -23,6 +23,7 @@ import Protolude hiding (toList)
 
 data Observation
   = AdminStartObs Text
+  | AdminServerCrashedObs SomeException
   | AppStartObs ByteString
   | AppServerAddressObs Text
   | ExitUnsupportedPgVersion PgVersion PgVersion

src/PostgREST/SchemaCache.hs

@@ -67,10 +67,9 @@ import PostgREST.SchemaCache.Table           (Column (..), ColumnMap,
 
 import qualified PostgREST.MediaType as MediaType
 
-import           Control.Arrow    ((&&&))
-import qualified Data.FuzzySet    as Fuzzy
+import           Control.Arrow ((&&&))
+import qualified Data.FuzzySet as Fuzzy
 import           Protolude
-import           System.IO.Unsafe (unsafePerformIO)
 
 type TablesFuzzyIndex = HM.HashMap Schema Fuzzy.FuzzySet
 
@@ -167,11 +166,9 @@ querySchemaCache conf@AppConfig{..} = do
   let tabsWViewsPks = addViewPrimaryKeys tabs keyDeps
       rels          = addInverseRels $ addM2MRels tabsWViewsPks $ addViewM2OAndO2ORels keyDeps m2oRels
 
-  -- Add delay in loading schema cache when internal-schema-cache-load-sleep config is set
-  return $ delayEval configInternalSCLoadSleep $ removeInternal schemas $ SchemaCache {
+  return $ removeInternal schemas $ SchemaCache {
       dbTables = tabsWViewsPks
-    -- Add delay in loading relationships when internal-schema-cache-relationship-load-sleep config is set
-    , dbRelationships = delayEval configInternalSCRelLoadSleep $ getOverrideRelationshipsMap rels cRels
+    , dbRelationships = getOverrideRelationshipsMap rels cRels
     , dbRoutines = funcs
     , dbRepresentations = reps
     , dbMediaHandlers = HM.union mHdlers initialMediaHandlers -- the custom handlers will override the initial ones
@@ -185,7 +182,6 @@ querySchemaCache conf@AppConfig{..} = do
   where
     schemas = toList configDbSchemas
     prepared = configDbPreparedStatements
-    delayEval confDelay result = maybe result (unsafePerformIO . (($> result) . (threadDelay . (1000 *) . fromIntegral))) confDelay
 
 -- | overrides detected relationships with the computed relationships and gets the RelationshipsMap
 getOverrideRelationshipsMap :: [Relationship] -> [Relationship] -> RelationshipsMap
@@ -452,7 +448,7 @@ funcsSqlQuery = encodeUtf8 [trimming|
     bt.oid <> bt.base_type as rettype_is_composite_alias,
     p.provolatile,
     p.provariadic > 0 as hasvariadic,
-    lower((regexp_split_to_array((regexp_split_to_array(iso_config, '='))[2], ','))[1]) AS transaction_isolation_level,
+    (regexp_split_to_array((regexp_split_to_array(iso_config, '='))[2], ','))[1] AS transaction_isolation_level,
     coalesce(func_settings.kvs, '{}') as kvs
   FROM pg_proc p
   LEFT JOIN arguments a ON a.oid = p.oid

test/io/__snapshots__/test_cli/test_schema_cache_snapshot[dbRoutines].yaml

@@ -565,6 +565,23 @@
       pdSchema: public
       pdVolatility: Volatile
 
+- - qiName: get_work_mem
+    qiSchema: public
+  - - pdDescription: null
+      pdFuncSettings: []
+      pdHasVariadic: false
+      pdName: get_work_mem
+      pdParams: []
+      pdReturnType:
+        contents:
+          contents:
+            qiName: text
+            qiSchema: pg_catalog
+          tag: Scalar
+        tag: Single
+      pdSchema: public
+      pdVolatility: Volatile
+
 - - qiName: notify_do_nothing
     qiSchema: public
   - - pdDescription: null

test/io/fixtures/database.sql

@@ -0,0 +1,3 @@
+SET client_min_messages = WARNING; -- suppress "NOTICE: ..." messages which pollute the log
+SET check_function_bodies = false; -- to allow conditionals based on the pg version
+SET search_path = public;

test/io/fixtures/load.sql

@@ -1,300 +1,9 @@
+-- Load all IO tests fixtures for PostgREST
+
+\set ON_ERROR_STOP on
+
+\ir database.sql
 \ir db_config.sql
-
-set check_function_bodies = false; -- to allow conditionals based on the pg version
-set search_path to public;
-
-CREATE ROLE postgrest_test_anonymous;
-ALTER ROLE :"PGUSER" SET pgrst.db_anon_role = 'postgrest_test_anonymous';
-
-CREATE ROLE postgrest_test_author;
-
-CREATE ROLE postgrest_test_serializable;
-alter role postgrest_test_serializable set default_transaction_isolation = 'serializable';
-
-CREATE ROLE postgrest_test_repeatable_read;
-alter role postgrest_test_repeatable_read set default_transaction_isolation = 'REPEATABLE READ';
-
-CREATE ROLE postgrest_test_w_superuser_settings;
-alter role postgrest_test_w_superuser_settings set log_min_duration_statement = 1;
-alter role postgrest_test_w_superuser_settings set log_min_messages = 'fatal';
-
-DO $do$BEGIN
-  IF (SELECT current_setting('server_version_num')::INT >= 150000) THEN
-    ALTER ROLE postgrest_test_w_superuser_settings SET log_min_duration_sample = 12345;
-    GRANT SET ON PARAMETER log_min_duration_sample to "Postgrest_Test_Authenticator";
-  END IF;
-END$do$;
-
-GRANT
-  postgrest_test_anonymous, postgrest_test_author,
-  postgrest_test_serializable, postgrest_test_repeatable_read,
-  postgrest_test_w_superuser_settings TO :"PGUSER";
-
-CREATE SCHEMA v1;
-GRANT USAGE ON SCHEMA v1 TO postgrest_test_anonymous;
-
-CREATE SCHEMA test;
-GRANT USAGE ON SCHEMA test TO postgrest_test_anonymous;
-
-CREATE TABLE authors_only ();
-GRANT SELECT ON authors_only TO postgrest_test_author;
-
-CREATE TABLE projects AS SELECT FROM generate_series(1,5);
-GRANT SELECT ON projects TO postgrest_test_anonymous, postgrest_test_w_superuser_settings;
-
-create function get_guc_value(name text) returns text as $$
-  select nullif(current_setting(name), '')::text;
-$$ language sql;
-
-create function v1.get_guc_value(name text) returns text as $$
-  select nullif(current_setting(name), '')::text;
-$$ language sql;
-
-create function uses_prepared_statements() returns bool as $$
-  select count(name) > 0 from pg_catalog.pg_prepared_statements
-$$ language sql;
-
-create function change_max_rows_config(val int, notify bool default false) returns void as $_$
-begin
-  execute format($$
-    alter role "Postgrest_Test_Authenticator" set pgrst.db_max_rows = %L;
-  $$, val);
-  if notify then
-    perform pg_notify('pgrst', 'reload config');
-  end if;
-end $_$ volatile security definer language plpgsql ;
-
-create function reset_max_rows_config() returns void as $_$
-begin
-  alter role "Postgrest_Test_Authenticator" reset pgrst.db_max_rows;
-end $_$ volatile security definer language plpgsql ;
-
-create function change_db_schema_and_full_reload(schemas text) returns void as $_$
-begin
-  execute format($$
-    alter role "Postgrest_Test_Authenticator" set pgrst.db_schemas = %L;
-  $$, schemas);
-  perform pg_notify('pgrst', 'reload config');
-  perform pg_notify('pgrst', 'reload schema');
-end $_$ volatile security definer language plpgsql ;
-
-create function v1.reset_db_schema_config() returns void as $_$
-begin
-  alter role "Postgrest_Test_Authenticator" reset pgrst.db_schemas;
-  perform pg_notify('pgrst', 'reload config');
-  perform pg_notify('pgrst', 'reload schema');
-end $_$ volatile security definer language plpgsql ;
-
-create function invalid_role_claim_key_reload() returns void as $_$
-begin
-  alter role "Postgrest_Test_Authenticator" set pgrst.jwt_role_claim_key = 'test';
-  perform pg_notify('pgrst', 'reload config');
-end $_$ volatile security definer language plpgsql ;
-
-create function notify_do_nothing() returns void as $_$
-  notify pgrst, 'nothing';
-$_$ language sql;
-
-create function do_nothing() returns void as $_$
-$_$ language sql;
-
-create function reset_invalid_role_claim_key() returns void as $_$
-begin
-  alter role "Postgrest_Test_Authenticator" reset pgrst.jwt_role_claim_key;
-  perform pg_notify('pgrst', 'reload config');
-end $_$ volatile security definer language plpgsql ;
-
-create function reload_pgrst_config() returns void as $_$
-begin
-  perform pg_notify('pgrst', 'reload config');
-end $_$ language plpgsql ;
-
-create or replace function sleep(seconds double precision) returns void as $$
-  select pg_sleep(seconds);
-$$ language sql;
-
-create or replace function hello() returns text as $$
-  select 'hello'::text;
-$$ language sql;
-
-create table cats(id uuid primary key, name text);
-grant all on cats to postgrest_test_anonymous;
-
-create function drop_change_cats() returns void
-language sql security definer
-as $$
-  drop table cats;
-  create table cats(id bigint primary key, name text);
-  grant all on table cats to postgrest_test_anonymous;
-  notify pgrst, 'reload schema';
-$$;
-
-alter role postgrest_test_anonymous set statement_timeout to '2s';
-alter role postgrest_test_author set statement_timeout to '10s';
-
-create function change_role_statement_timeout(timeout text) returns void as $_$
-begin
-  execute format($$
-    alter role current_user set statement_timeout = %L;
-  $$, timeout);
-end $_$ volatile language plpgsql ;
-
-create table items as select x as id from generate_series(1,5) x;
-
-create view items_w_isolation_level as
-select
-  id,
-  current_setting('transaction_isolation', true) as isolation_level
-from items;
-
-grant all on items_w_isolation_level to postgrest_test_anonymous, postgrest_test_repeatable_read, postgrest_test_serializable;
-
-create function default_isolation_level()
-returns text as $$
-  select current_setting('transaction_isolation', true);
-$$
-language sql;
-
-create function serializable_isolation_level()
-returns text as $$
-  select current_setting('transaction_isolation', true);
-$$
-language sql set default_transaction_isolation = 'serializable';
-
-create function repeatable_read_isolation_level()
-returns text as $$
-  select current_setting('transaction_isolation', true);
-$$
-language sql set default_transaction_isolation = 'REPEATABLE READ';
-
-create or replace function create_function() returns void as $_$
-  drop function if exists mult_them(int, int);
-  create or replace function mult_them(a int, b int) returns int as $$
-    select a*b;
-  $$ language sql;
-  notify pgrst, 'reload schema';
-$_$ language sql security definer;
-
-create or replace function migrate_function() returns void as $_$
-  drop function if exists mult_them(int, int);
-  create or replace function mult_them(c int, d int) returns int as $$
-    select c*d;
-  $$ language sql;
-  notify pgrst, 'reload schema';
-$_$ language sql security definer;
-
-create or replace function get_pgrst_version() returns text
-  language sql
-as $$
-select application_name
-from pg_stat_activity
-where application_name ilike 'postgrest%'
-limit 1;
-$$;
-
-create function terminate_pgrst(appname text) returns setof record as $$
-select pg_terminate_backend(pid) from pg_stat_activity where application_name iLIKE '%' || appname || '%';
-$$ language sql security definer;
-
-create or replace function one_sec_timeout() returns void as $$
-  select pg_sleep(3);
-$$ language sql set statement_timeout = '1s';
-
-create or replace function four_sec_timeout() returns void as $$
-  select pg_sleep(3);
-$$ language sql set statement_timeout = '4s';
-
-create function get_postgres_version() returns int as $$
-  select current_setting('server_version_num')::int;
-$$ language sql;
-
-create or replace function rpc_work_mem() returns items as $$
-  select 1
-$$ language sql
-set work_mem = '6000';
-
-create or replace function rpc_with_one_hoisted() returns items as $$
-  select 1
-$$ language sql
-set work_mem = '3000'
-set statement_timeout = '7s';
-
-create or replace function rpc_with_two_hoisted() returns items as $$
-  select 1
-$$ language sql
-set work_mem = '5000'
-set statement_timeout = '10s';
-
-create function get_work_mem(items) returns text as $$
-  select current_setting('work_mem', true) as work_mem
-$$ language sql;
-
-create function get_statement_timeout(items) returns text as $$
-  select current_setting('statement_timeout', true) as statement_timeout
-$$ language sql;
-
-create function change_db_schemas_config() returns void as $_$
-begin
-  alter role "Postgrest_Test_Authenticator" set pgrst.db_schemas = 'test';
-end $_$ volatile security definer language plpgsql;
-
-create function reset_db_schemas_config() returns void as $_$
-begin
-  alter role "Postgrest_Test_Authenticator" reset pgrst.db_schemas;
-end $_$ volatile security definer language plpgsql ;
-
-create function test.get_current_schema() returns text as $$
-  select current_schema()::text;
-$$ language sql;
-
-create or replace function root() returns json as $_$
-  select '{"swagger": "2.0"}'::json;
-$_$ language sql;
-
-create view infinite_recursion as
-select * from projects;
-
-create or replace view infinite_recursion as
-select * from infinite_recursion;
-
-create or replace function "true"() returns boolean as $_$
-  select true;
-$_$ language sql;
-
-create or replace function notify_pgrst() returns void as $$
-  notify pgrst;
-$$ language sql;
-
--- directors and films table can be used for resource embedding tests
-create table directors (
-  id int primary key,
-  name text
-);
-
-create table films (
-  id int primary key,
-  title text,
-  director_id int,
-
-  constraint fk_director
-    foreign key (director_id) references directors (id)
-    on update cascade
-    on delete cascade
-);
-
--- data to test resource embedding
-truncate table directors cascade;
-insert into directors
-values (1, 'quentin tarantino'),
-       (2, 'christopher nolan'),
-       (3, 'yorgos lathinmos');
-
-truncate table films cascade;
-insert into films
-values (1, 'pulp fiction', 1),
-       (2, 'intersteller',2),
-       (3, 'dogtooth',3),
-       (4, 'reservoir dogs', 1);
-
-
-GRANT SELECT ON directors, films TO postgrest_test_anonymous, postgrest_test_w_superuser_settings;
+\ir roles.sql
+\ir schema.sql
+\ir privileges.sql

test/io/fixtures/privileges.sql

@@ -0,0 +1,9 @@
+GRANT USAGE ON SCHEMA v1 TO postgrest_test_anonymous;
+GRANT USAGE ON SCHEMA test TO postgrest_test_anonymous;
+
+GRANT SELECT ON authors_only TO postgrest_test_author;
+GRANT SELECT ON projects TO postgrest_test_anonymous, postgrest_test_w_superuser_settings;
+GRANT SELECT ON directors, films TO postgrest_test_anonymous, postgrest_test_w_superuser_settings;
+
+GRANT ALL ON cats TO postgrest_test_anonymous;
+GRANT ALL ON items_w_isolation_level TO postgrest_test_anonymous, postgrest_test_repeatable_read, postgrest_test_serializable;

test/io/fixtures/roles.sql

@@ -0,0 +1,30 @@
+DROP ROLE IF EXISTS
+  postgrest_test_anonymous, postgrest_test_author,
+  postgrest_test_serializable, postgrest_test_repeatable_read,
+  postgrest_test_w_superuser_settings;
+
+CREATE ROLE postgrest_test_anonymous;
+CREATE ROLE postgrest_test_author;
+CREATE ROLE postgrest_test_serializable;
+CREATE ROLE postgrest_test_repeatable_read;
+CREATE ROLE postgrest_test_w_superuser_settings;
+CREATE ROLE postgrest_test_work_mem;
+
+GRANT
+  postgrest_test_anonymous, postgrest_test_author,
+  postgrest_test_serializable, postgrest_test_repeatable_read,
+  postgrest_test_w_superuser_settings, postgrest_test_work_mem TO :"PGUSER";
+
+GRANT postgrest_test_anonymous TO timeout_authenticator;
+
+ALTER ROLE :"PGUSER" SET pgrst.db_anon_role = 'postgrest_test_anonymous';
+ALTER ROLE postgrest_test_serializable SET default_transaction_isolation = 'serializable';
+ALTER ROLE postgrest_test_repeatable_read SET default_transaction_isolation = 'REPEATABLE READ';
+
+ALTER ROLE postgrest_test_w_superuser_settings SET log_min_duration_statement = 1;
+ALTER ROLE postgrest_test_w_superuser_settings SET log_min_messages = 'fatal';
+
+ALTER ROLE postgrest_test_anonymous SET statement_timeout TO '2s';
+ALTER ROLE postgrest_test_author SET statement_timeout TO '10s';
+
+ALTER ROLE postgrest_test_work_mem SET work_mem TO '3MB';

test/io/fixtures/schema.sql

@@ -0,0 +1,264 @@
+DROP SCHEMA IF EXISTS v1, test;
+
+CREATE SCHEMA v1;
+CREATE SCHEMA test;
+
+CREATE TABLE authors_only ();
+CREATE TABLE projects AS SELECT FROM generate_series(1,5);
+CREATE TABLE cats(id uuid primary key, name text);
+CREATE TABLE items AS SELECT x AS id FROM generate_series(1,5) x;
+
+-- directors and films table can be used for resource embedding tests
+CREATE TABLE directors (
+  id int primary key,
+  name text
+);
+
+CREATE TABLE films (
+  id int primary key,
+  title text,
+  director_id int,
+
+  constraint fk_director
+    foreign key (director_id) references directors (id)
+    on update cascade
+    on delete cascade
+);
+
+-- data to test resource embedding
+TRUNCATE TABLE directors CASCADE;
+INSERT INTO directors
+VALUES (1, 'quentin tarantino'),
+       (2, 'christopher nolan'),
+       (3, 'yorgos lathinmos');
+
+TRUNCATE TABLE films CASCADE;
+INSERT INTO films
+VALUES (1, 'pulp fiction', 1),
+       (2, 'intersteller',2),
+       (3, 'dogtooth',3),
+       (4, 'reservoir dogs', 1);
+
+DO $do$BEGIN
+  IF (SELECT current_setting('server_version_num')::INT >= 150000) THEN
+    ALTER ROLE postgrest_test_w_superuser_settings SET log_min_duration_sample = 12345;
+    GRANT SET ON PARAMETER log_min_duration_sample to "Postgrest_Test_Authenticator";
+  END IF;
+END$do$;
+
+create function get_guc_value(name text) returns text as $$
+  select nullif(current_setting(name), '')::text;
+$$ language sql;
+
+create function v1.get_guc_value(name text) returns text as $$
+  select nullif(current_setting(name), '')::text;
+$$ language sql;
+
+create function uses_prepared_statements() returns bool as $$
+  select count(name) > 0 from pg_catalog.pg_prepared_statements
+$$ language sql;
+
+create function change_max_rows_config(val int, notify bool default false) returns void as $_$
+begin
+  execute format($$
+    alter role "Postgrest_Test_Authenticator" set pgrst.db_max_rows = %L;
+  $$, val);
+  if notify then
+    perform pg_notify('pgrst', 'reload config');
+  end if;
+end $_$ volatile security definer language plpgsql ;
+
+create function reset_max_rows_config() returns void as $_$
+begin
+  alter role "Postgrest_Test_Authenticator" reset pgrst.db_max_rows;
+end $_$ volatile security definer language plpgsql ;
+
+create function change_db_schema_and_full_reload(schemas text) returns void as $_$
+begin
+  execute format($$
+    alter role "Postgrest_Test_Authenticator" set pgrst.db_schemas = %L;
+  $$, schemas);
+  perform pg_notify('pgrst', 'reload config');
+  perform pg_notify('pgrst', 'reload schema');
+end $_$ volatile security definer language plpgsql ;
+
+create function v1.reset_db_schema_config() returns void as $_$
+begin
+  alter role "Postgrest_Test_Authenticator" reset pgrst.db_schemas;
+  perform pg_notify('pgrst', 'reload config');
+  perform pg_notify('pgrst', 'reload schema');
+end $_$ volatile security definer language plpgsql ;
+
+create function invalid_role_claim_key_reload() returns void as $_$
+begin
+  alter role "Postgrest_Test_Authenticator" set pgrst.jwt_role_claim_key = 'test';
+  perform pg_notify('pgrst', 'reload config');
+end $_$ volatile security definer language plpgsql ;
+
+create function notify_do_nothing() returns void as $_$
+  notify pgrst, 'nothing';
+$_$ language sql;
+
+create function do_nothing() returns void as $_$
+$_$ language sql;
+
+create function reset_invalid_role_claim_key() returns void as $_$
+begin
+  alter role "Postgrest_Test_Authenticator" reset pgrst.jwt_role_claim_key;
+  perform pg_notify('pgrst', 'reload config');
+end $_$ volatile security definer language plpgsql ;
+
+create function reload_pgrst_config() returns void as $_$
+begin
+  perform pg_notify('pgrst', 'reload config');
+end $_$ language plpgsql ;
+
+create or replace function sleep(seconds double precision) returns void as $$
+  select pg_sleep(seconds);
+$$ language sql;
+
+create or replace function hello() returns text as $$
+  select 'hello'::text;
+$$ language sql;
+
+create function drop_change_cats() returns void
+language sql security definer
+as $$
+  drop table cats;
+  create table cats(id bigint primary key, name text);
+  grant all on table cats to postgrest_test_anonymous;
+  notify pgrst, 'reload schema';
+$$;
+
+create function change_role_statement_timeout(timeout text) returns void as $_$
+begin
+  execute format($$
+    alter role current_user set statement_timeout = %L;
+  $$, timeout);
+end $_$ volatile language plpgsql ;
+
+create view items_w_isolation_level as
+select
+  id,
+  current_setting('transaction_isolation', true) as isolation_level
+from items;
+
+create function default_isolation_level()
+returns text as $$
+  select current_setting('transaction_isolation', true);
+$$
+language sql;
+
+create function serializable_isolation_level()
+returns text as $$
+  select current_setting('transaction_isolation', true);
+$$
+language sql set default_transaction_isolation = 'serializable';
+
+create function repeatable_read_isolation_level()
+returns text as $$
+  select current_setting('transaction_isolation', true);
+$$
+language sql set default_transaction_isolation = 'REPEATABLE READ';
+
+create or replace function create_function() returns void as $_$
+  drop function if exists mult_them(int, int);
+  create or replace function mult_them(a int, b int) returns int as $$
+    select a*b;
+  $$ language sql;
+  notify pgrst, 'reload schema';
+$_$ language sql security definer;
+
+create or replace function migrate_function() returns void as $_$
+  drop function if exists mult_them(int, int);
+  create or replace function mult_them(c int, d int) returns int as $$
+    select c*d;
+  $$ language sql;
+  notify pgrst, 'reload schema';
+$_$ language sql security definer;
+
+create or replace function get_pgrst_version() returns text
+  language sql
+as $$
+select application_name
+from pg_stat_activity
+where application_name ilike 'postgrest%'
+limit 1;
+$$;
+
+create function terminate_pgrst(appname text) returns setof record as $$
+select pg_terminate_backend(pid) from pg_stat_activity where application_name iLIKE '%' || appname || '%';
+$$ language sql security definer;
+
+create or replace function one_sec_timeout() returns void as $$
+  select pg_sleep(3);
+$$ language sql set statement_timeout = '1s';
+
+create or replace function four_sec_timeout() returns void as $$
+  select pg_sleep(3);
+$$ language sql set statement_timeout = '4s';
+
+create function get_postgres_version() returns int as $$
+  select current_setting('server_version_num')::int;
+$$ language sql;
+
+create or replace function rpc_work_mem() returns items as $$
+  select 1
+$$ language sql
+set work_mem = '6000';
+
+create or replace function rpc_with_one_hoisted() returns items as $$
+  select 1
+$$ language sql
+set work_mem = '3000'
+set statement_timeout = '7s';
+
+create or replace function rpc_with_two_hoisted() returns items as $$
+  select 1
+$$ language sql
+set work_mem = '5000'
+set statement_timeout = '10s';
+
+create function get_work_mem(items) returns text as $$
+  select current_setting('work_mem', true) as work_mem
+$$ language sql;
+
+create function get_statement_timeout(items) returns text as $$
+  select current_setting('statement_timeout', true) as statement_timeout
+$$ language sql;
+
+create function change_db_schemas_config() returns void as $_$
+begin
+  alter role "Postgrest_Test_Authenticator" set pgrst.db_schemas = 'test';
+end $_$ volatile security definer language plpgsql;
+
+create function reset_db_schemas_config() returns void as $_$
+begin
+  alter role "Postgrest_Test_Authenticator" reset pgrst.db_schemas;
+end $_$ volatile security definer language plpgsql ;
+
+create function test.get_current_schema() returns text as $$
+  select current_schema()::text;
+$$ language sql;
+
+create or replace function root() returns json as $_$
+  select '{"swagger": "2.0"}'::json;
+$_$ language sql;
+
+create view infinite_recursion as
+select * from projects;
+
+create or replace view infinite_recursion as
+select * from infinite_recursion;
+
+create or replace function "true"() returns boolean as $_$
+  select true;
+$_$ language sql;
+
+create or replace function notify_pgrst() returns void as $$
+  notify pgrst;
+$$ language sql;
+
+create or replace function get_work_mem() returns text as $$
+  select current_setting('work_mem', true);
+$$ language sql;

test/io/test_io.py

@@ -29,6 +29,20 @@ from postgrest import (
 )
 
 
+def psql_as_superuser(query):
+    subprocess.check_call(
+        [
+            "psql",
+            "--username",
+            "postgres",
+            "--set",
+            "ON_ERROR_STOP=1",
+            "-c",
+            query,
+        ]
+    )
+
+
 def test_connect_with_dburi(dburi, defaultenv):
     "Connecting with db-uri instead of LIPQ* environment variables should work."
     defaultenv_without_libpq = {
@@ -591,7 +605,7 @@ def test_admin_ready_includes_schema_cache_state(defaultenv, metapostgrest):
     env = {
         **defaultenv,
         "PGUSER": role,
-        "PGRST_DB_ANON_ROLE": role,
+        "PGRST_DB_ANON_ROLE": "postgrest_test_anonymous",
         "PGRST_INTERNAL_SCHEMA_CACHE_QUERY_SLEEP": "500",
     }
 
@@ -958,6 +972,61 @@ def test_notify_reloading_catalog_cache(defaultenv):
         assert response.status_code == 200
 
 
+def test_stale_schema_cache_dropped_table_returns_database_error(defaultenv):
+    "dropped table should return a database error while schema cache is stale"
+
+    internal_sleep = 2
+    env = {
+        **defaultenv,
+        "PGRST_DB_POOL": "2",
+        "PGRST_DB_CHANNEL_ENABLED": "true",
+        "PGRST_INTERNAL_SCHEMA_CACHE_QUERY_SLEEP": str(internal_sleep * 1000),
+    }
+
+    try:
+        psql_as_superuser(
+            """
+            drop table if exists stale_schema_cache_items;
+            create table stale_schema_cache_items(id int primary key);
+            insert into stale_schema_cache_items values (1);
+            grant select on stale_schema_cache_items to postgrest_test_anonymous;
+            """
+        )
+
+        with run(env=env, wait_max_seconds=10) as postgrest:
+            response = postgrest.session.get("/stale_schema_cache_items")
+            assert response.status_code == 200
+
+            psql_as_superuser(
+                """
+                drop table stale_schema_cache_items;
+                notify pgrst, 'reload schema';
+                """
+            )
+
+            response = postgrest.session.get("/stale_schema_cache_items")
+            payload = response.json()
+            assert response.status_code == 404
+            assert payload["code"] == "42P01"
+            assert (
+                payload["message"]
+                == 'relation "public.stale_schema_cache_items" does not exist'
+            )
+
+            time.sleep(internal_sleep + 0.3)
+
+            response = postgrest.session.get("/stale_schema_cache_items")
+            payload = response.json()
+            assert response.status_code == 404
+            assert payload["code"] == "PGRST205"
+            assert (
+                payload["message"]
+                == "Could not find the table 'public.stale_schema_cache_items' in the schema cache"
+            )
+    finally:
+        psql_as_superuser("drop table if exists stale_schema_cache_items;")
+
+
 def test_role_settings(defaultenv):
     "statement_timeout should be set per role"
 
@@ -1132,31 +1201,6 @@ def test_schema_cache_query_sleep_logs(defaultenv):
         assert 1000 < observed_ms < 2000
 
 
-def test_schema_cache_load_sleep_logs(defaultenv):
-    """Schema cache load sleep should be reflected in the logged load duration."""
-
-    env = {
-        **defaultenv,
-        "PGRST_INTERNAL_SCHEMA_CACHE_LOAD_SLEEP": "1000",
-    }
-    log_pattern = re.compile(r"Schema cache loaded in ([\d.]+) milliseconds")
-
-    with run(env=env, wait_max_seconds=3, no_startup_stdout=False) as postgrest:
-        observed_ms = None
-        collected = []
-
-        lines = postgrest.read_stdout(nlines=10)
-        collected.extend(lines)
-        for line in lines:
-            match = log_pattern.search(line)
-            if match:
-                observed_ms = float(match.group(1))
-                break
-
-        assert observed_ms is not None
-        assert 1000 < observed_ms < 2000
-
-
 @pytest.mark.parametrize("dburi_type", ["no_params", "no_params_qmark", "with_params"])
 def test_get_pgrst_version_with_uri_connection_string(dburi_type, dburi, defaultenv):
     "The fallback_application_name should be added to the db-uri if it has a URI format"
@@ -1712,6 +1756,15 @@ def test_log_listener_connection_start(defaultenv):
         )
 
 
+def test_connection_error_message_does_not_claim_retry(defaultenv):
+    "The connection error message should not claim retrying, since PostgREST stops on fatal errors."
+    uri = f'postgresql://?dbname={defaultenv["PGDATABASE"]}&host={defaultenv["PGHOST"]}&user=some_protected_user&password=invalid_pass'
+    env = {**defaultenv, "PGRST_DB_URI": uri}
+    with run(env=env, no_startup_stdout=False, wait_for=None) as postgrest:
+        output = postgrest.read_stdout(nlines=8)
+        assert any('"message":"Database connection error."' in line for line in output)
+
+
 def test_db_pre_config_with_pg_reserved_words(defaultenv):
     "The db-pre-config should not fail unexpectedly when function name is a postgres reserved word"
 
@@ -1738,54 +1791,6 @@ def test_db_pre_config_with_pg_reserved_words(defaultenv):
         )
 
 
-def test_requests_with_resource_embedding_wait_for_schema_cache_reload(defaultenv):
-    "requests that use the schema cache with resource embedding wait long for the schema cache to reload"
-
-    env = {
-        **defaultenv,
-        "PGRST_DB_POOL": "2",
-        "PGRST_INTERNAL_SCHEMA_CACHE_RELATIONSHIP_LOAD_SLEEP": "5100",
-    }
-
-    with run(env=env, wait_max_seconds=30) as postgrest:
-        # reload the schema cache
-        response = postgrest.session.get("/rpc/notify_pgrst")
-        assert response.status_code == 204
-
-        postgrest.wait_until_scache_starts_loading()
-
-        response = postgrest.session.get("/directors?select=id,name,films(title)")
-        assert response.status_code == 200
-
-        assert response.elapsed.total_seconds() > 5
-
-
-def test_requests_without_resource_embedding_wait_for_schema_cache_reload(defaultenv):
-    "requests that use the schema cache without resource embedding wait less for the schema cache to reload"
-
-    env = {
-        **defaultenv,
-        "PGRST_DB_POOL": "2",
-        "PGRST_INTERNAL_SCHEMA_CACHE_LOAD_SLEEP": "1100",
-        "PGRST_INTERNAL_SCHEMA_CACHE_RELATIONSHIP_LOAD_SLEEP": "5000",
-    }
-
-    with run(env=env, wait_max_seconds=30) as postgrest:
-        # reload the schema cache
-        response = postgrest.session.get("/rpc/notify_pgrst")
-        assert response.status_code == 204
-
-        postgrest.wait_until_scache_starts_loading()
-
-        response = postgrest.session.get("/films")
-        assert response.status_code == 200
-
-        assert (
-            response.elapsed.total_seconds() > 1
-            and response.elapsed.total_seconds() < 5
-        )
-
-
 def test_server_timing_transaction_duration(defaultenv, metapostgrest):
     "server-timing transaction duration should be accurate"
 
@@ -1828,3 +1833,19 @@ def test_positive_pool_metric(defaultenv):
                 ).group(1)
             )
             assert metrics >= 0
+
+
+def test_work_mem_in_role_settings(defaultenv):
+    "Should work when setting work_mem on a role. See https://github.com/PostgREST/postgrest/issues/4955"
+
+    env = {
+        **defaultenv,
+        "PGRST_JWT_SECRET": SECRET,
+    }
+
+    headers = jwtauthheader({"role": "postgrest_test_work_mem"}, SECRET)
+
+    with run(env=env) as postgrest:
+        response = postgrest.session.post("/rpc/get_work_mem", headers=headers)
+        assert response.status_code == 200
+        assert response.text == '"3MB"'

test/observability/ObsHelper.hs

@@ -114,8 +114,6 @@ baseCfg = let secret = encodeUtf8 "reallyreallyreallyreallyverysafe" in
   , configRoleSettings              = mempty
   , configRoleIsoLvl                = mempty
   , configInternalSCQuerySleep      = Nothing
-  , configInternalSCLoadSleep       = Nothing
-  , configInternalSCRelLoadSleep    = Nothing
   , configServerTimingEnabled       = True
   }
 

test/spec/SpecHelper.hs

@@ -157,8 +157,6 @@ baseCfg = let secret = encodeUtf8 "reallyreallyreallyreallyverysafe" in
   , configRoleSettings              = mempty
   , configRoleIsoLvl                = mempty
   , configInternalSCQuerySleep      = Nothing
-  , configInternalSCLoadSleep       = Nothing
-  , configInternalSCRelLoadSleep    = Nothing
   , configServerTimingEnabled       = True
   }