Horton
Menu

Re: running logical replication as the subscription owner

Jelte Fennema <postgres@jeltef.nl>

View thread
From: Jelte Fennema <postgres@jeltef.nl>
To: Masahiko Sawada <sawada.mshk@gmail.com>
Cc: Ajin Cherian <itsajin@gmail.com>, Amit Kapila <amit.kapila16@gmail.com>, Robert Haas <robertmhaas@gmail.com>, Noah Misch <noah@leadboat.com>, Jeff Davis <pgsql@j-davis.com>, "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>, Andres Freund <andres@anarazel.de>
Date: 2023-05-15T13:54:14Z
Lists: pgsql-hackers 
On Mon, 15 May 2023 at 14:47, Masahiko Sawada <sawada.mshk@gmail.com> wrote:
> Thank you for the patch! I think we might want to have tests for it.

Yes, code looks good. But indeed some tests would be great. It seems
we forgot to actually do:

On Fri, 12 May 2023 at 13:55, Ajin Cherian <itsajin@gmail.com> wrote:
> CREATE ROLE regress_alice NOSUPERUSER LOGIN;
> CREATE ROLE regress_admin SUPERUSER LOGIN;
> ...
>
> What I see is that as part of tablesync, the trigger invokes an
> updates admin_audit which it shouldn't, as the table owner
> of alice.test should not have access to the
> table admin_audit. This means the table copy is being invoked as the
> subscription owner and not the table owner.

I think having this as a tap/regress test would be very useful.

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. Honor run_as_owner option in tablesync worker.

  2. Document new pg_subscription columns.

  3. Add a run_as_owner option to subscriptions.

  4. Perform logical replication actions as the table owner.

  5. Add new predefined role pg_create_subscription.

  6. Respect permissions within logical replication.

  7. Empty search_path in logical replication apply worker and walsender.

  8. Empty search_path in Autovacuum and non-psql/pgbench clients.