Skip to content

Commit 4464303

Browse files
alvherrealvherre
committed
Support default ACLs in get_object_address
In the spirit of 890192e, this time add support for the things living in the pg_default_acl catalog. These are not really "objects", but they show up as such in event triggers. There is no "DROP DEFAULT PRIVILEGES" or similar command, so it doesn't look like the new representation given would be useful anywhere else, so I didn't try to use it outside objectaddress.c. (That might be a bug in itself, but that would be material for another commit.) Reviewed by Stephen Frost.
1 parent d4d7777 commit 4464303

File tree

7 files changed

+158
-11
lines changed

7 files changed

+158
-11
lines changed

‎src/backend/catalog/objectaddress.c

Lines changed: 129 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -522,7 +522,7 @@ ObjectTypeMap[] =
522522
/* OCLASS_USER_MAPPING */
523523
{ "user mapping", OBJECT_USER_MAPPING },
524524
/* OCLASS_DEFACL */
525-
{ "default acl", -1 }, /* unmapped */
525+
{ "default acl", OBJECT_DEFACL },
526526
/* OCLASS_EXTENSION */
527527
{ "extension", OBJECT_EXTENSION },
528528
/* OCLASS_EVENT_TRIGGER */
@@ -557,6 +557,8 @@ static ObjectAddress get_object_address_opcf(ObjectType objtype, List *objname,
557557
List *objargs, bool missing_ok);
558558
static ObjectAddress get_object_address_usermapping(List *objname,
559559
List *objargs, bool missing_ok);
560+
static ObjectAddress get_object_address_defacl(List *objname, List *objargs,
561+
bool missing_ok);
560562
static const ObjectPropertyType *get_object_property_data(Oid class_id);
561563

562564
static void getRelationDescription(StringInfo buffer, Oid relid);
@@ -775,6 +777,10 @@ get_object_address(ObjectType objtype, List *objname, List *objargs,
775777
address = get_object_address_usermapping(objname, objargs,
776778
missing_ok);
777779
break;
780+
case OBJECT_DEFACL:
781+
address = get_object_address_defacl(objname, objargs,
782+
missing_ok);
783+
break;
778784
default:
779785
elog(ERROR, "unrecognized objtype: %d", (int) objtype);
780786
/* placate compiler, in case it thinks elog might return */
@@ -1447,6 +1453,113 @@ get_object_address_usermapping(List *objname, List *objargs, bool missing_ok)
14471453
return address;
14481454
}
14491455

1456+
/*
1457+
* Find the ObjectAddress for a default ACL.
1458+
*/
1459+
static ObjectAddress
1460+
get_object_address_defacl(List *objname, List *objargs, bool missing_ok)
1461+
{
1462+
HeapTuple tp;
1463+
Oid userid;
1464+
Oid schemaid;
1465+
char *username;
1466+
char *schema;
1467+
char objtype;
1468+
char *objtype_str;
1469+
ObjectAddress address;
1470+
1471+
ObjectAddressSet(address, DefaultAclRelationId, InvalidOid);
1472+
1473+
/*
1474+
* First figure out the textual attributes so that they can be used for
1475+
* error reporting.
1476+
*/
1477+
username = strVal(linitial(objname));
1478+
if (list_length(objname) >= 2)
1479+
schema = (char *) strVal(lsecond(objname));
1480+
else
1481+
schema = NULL;
1482+
1483+
/*
1484+
* Decode defaclobjtype. Only first char is considered; the rest of the
1485+
* string, if any, is blissfully ignored.
1486+
*/
1487+
objtype = ((char *) strVal(linitial(objargs)))[0];
1488+
switch (objtype)
1489+
{
1490+
case DEFACLOBJ_RELATION:
1491+
objtype_str = "tables";
1492+
break;
1493+
case DEFACLOBJ_SEQUENCE:
1494+
objtype_str = "sequences";
1495+
break;
1496+
case DEFACLOBJ_FUNCTION:
1497+
objtype_str = "functions";
1498+
break;
1499+
case DEFACLOBJ_TYPE:
1500+
objtype_str = "types";
1501+
break;
1502+
default:
1503+
ereport(ERROR,
1504+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1505+
errmsg("unrecognized default ACL object type %c", objtype),
1506+
errhint("Valid object types are 'r', 'S', 'f', and 'T'.")));
1507+
}
1508+
1509+
/*
1510+
* Look up user ID. Behave as "default ACL not found" if the user doesn't
1511+
* exist.
1512+
*/
1513+
tp = SearchSysCache1(AUTHNAME,
1514+
CStringGetDatum(username));
1515+
if (!HeapTupleIsValid(tp))
1516+
goto not_found;
1517+
userid = HeapTupleGetOid(tp);
1518+
ReleaseSysCache(tp);
1519+
1520+
/*
1521+
* If a schema name was given, look up its OID. If it doesn't exist,
1522+
* behave as "default ACL not found".
1523+
*/
1524+
if (schema)
1525+
{
1526+
schemaid = get_namespace_oid(schema, true);
1527+
if (schemaid == InvalidOid)
1528+
goto not_found;
1529+
}
1530+
else
1531+
schemaid = InvalidOid;
1532+
1533+
/* Finally, look up the pg_default_acl object */
1534+
tp = SearchSysCache3(DEFACLROLENSPOBJ,
1535+
ObjectIdGetDatum(userid),
1536+
ObjectIdGetDatum(schemaid),
1537+
CharGetDatum(objtype));
1538+
if (!HeapTupleIsValid(tp))
1539+
goto not_found;
1540+
1541+
address.objectId = HeapTupleGetOid(tp);
1542+
ReleaseSysCache(tp);
1543+
1544+
return address;
1545+
1546+
not_found:
1547+
if (!missing_ok)
1548+
{
1549+
if (schema)
1550+
ereport(ERROR,
1551+
(errcode(ERRCODE_UNDEFINED_OBJECT),
1552+
errmsg("default ACL for user \"%s\" in schema \"%s\" on %s does not exist",
1553+
username, schema, objtype_str)));
1554+
else
1555+
ereport(ERROR,
1556+
(errcode(ERRCODE_UNDEFINED_OBJECT),
1557+
errmsg("default ACL for user \"%s\" on %s does not exist",
1558+
username, objtype_str)));
1559+
}
1560+
return address;
1561+
}
1562+
14501563
/*
14511564
* Convert an array of TEXT into a List of string Values, as emitted by the
14521565
* parser, which is what get_object_address uses as input.
@@ -1599,6 +1712,7 @@ pg_get_object_address(PG_FUNCTION_ARGS)
15991712
case OBJECT_OPFAMILY:
16001713
case OBJECT_CAST:
16011714
case OBJECT_USER_MAPPING:
1715+
case OBJECT_DEFACL:
16021716
if (list_length(args) != 1)
16031717
ereport(ERROR,
16041718
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
@@ -4024,10 +4138,8 @@ getObjectIdentityParts(const ObjectAddress *object,
40244138
SysScanDesc rcscan;
40254139
HeapTuple tup;
40264140
Form_pg_default_acl defacl;
4027-
4028-
/* no objname support */
4029-
if (objname)
4030-
*objname = NIL;
4141+
char *schema;
4142+
char *username;
40314143

40324144
defaclrel = heap_open(DefaultAclRelationId, AccessShareLock);
40334145

@@ -4047,19 +4159,20 @@ getObjectIdentityParts(const ObjectAddress *object,
40474159

40484160
defacl = (Form_pg_default_acl) GETSTRUCT(tup);
40494161

4162+
username = GetUserNameFromId(defacl->defaclrole);
40504163
appendStringInfo(&buffer,
40514164
"for role %s",
4052-
quote_identifier(GetUserNameFromId(defacl->defaclrole)));
4165+
quote_identifier(username));
40534166

40544167
if (OidIsValid(defacl->defaclnamespace))
40554168
{
4056-
char *schema;
4057-
40584169
schema = get_namespace_name(defacl->defaclnamespace);
40594170
appendStringInfo(&buffer,
40604171
" in schema %s",
40614172
quote_identifier(schema));
40624173
}
4174+
else
4175+
schema = NULL;
40634176

40644177
switch (defacl->defaclobjtype)
40654178
{
@@ -4081,6 +4194,14 @@ getObjectIdentityParts(const ObjectAddress *object,
40814194
break;
40824195
}
40834196

4197+
if (objname)
4198+
{
4199+
*objname = list_make1(username);
4200+
if (schema)
4201+
*objname = lappend(*objname, schema);
4202+
*objargs = list_make1(psprintf("%c", defacl->defaclobjtype));
4203+
}
4204+
40844205
systable_endscan(rcscan);
40854206
heap_close(defaclrel, AccessShareLock);
40864207
break;

‎src/backend/commands/event_trigger.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1065,6 +1065,7 @@ EventTriggerSupportsObjectType(ObjectType obtype)
10651065
case OBJECT_COLUMN:
10661066
case OBJECT_COLLATION:
10671067
case OBJECT_CONVERSION:
1068+
case OBJECT_DEFACL:
10681069
case OBJECT_DEFAULT:
10691070
case OBJECT_DOMAIN:
10701071
case OBJECT_DOMCONSTRAINT:

‎src/include/nodes/parsenodes.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1239,6 +1239,7 @@ typedef enum ObjectType
12391239
OBJECT_CONVERSION,
12401240
OBJECT_DATABASE,
12411241
OBJECT_DEFAULT,
1242+
OBJECT_DEFACL,
12421243
OBJECT_DOMAIN,
12431244
OBJECT_DOMCONSTRAINT,
12441245
OBJECT_EVENT_TRIGGER,

‎src/test/regress/expected/event_trigger.out

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,9 @@ create server useless_server foreign data wrapper useless;
116116
NOTICE: test_event_trigger: ddl_command_end CREATE SERVER
117117
create user mapping for regression_bob server useless_server;
118118
NOTICE: test_event_trigger: ddl_command_end CREATE USER MAPPING
119+
alter default privileges for role regression_bob
120+
revoke delete on tables from regression_bob;
121+
NOTICE: test_event_trigger: ddl_command_end ALTER DEFAULT PRIVILEGES
119122
-- alter owner to non-superuser should fail
120123
alter event trigger regress_event_trigger owner to regression_bob;
121124
ERROR: permission denied to change owner of event trigger "regress_event_trigger"
@@ -135,6 +138,7 @@ ERROR: event trigger "regress_event_trigger" does not exist
135138
drop role regression_bob;
136139
ERROR: role "regression_bob" cannot be dropped because some objects depend on it
137140
DETAIL: owner of event trigger regress_event_trigger3
141+
owner of default privileges on new relations belonging to role regression_bob
138142
owner of user mapping for regression_bob on server useless_server
139143
-- cleanup before next test
140144
-- these are all OK; the second one should emit a NOTICE

‎src/test/regress/expected/object_address.out

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ CREATE TRIGGER t BEFORE INSERT ON addr_nsp.gentable FOR EACH ROW EXECUTE PROCEDU
3030
CREATE POLICY genpol ON addr_nsp.gentable;
3131
CREATE SERVER "integer" FOREIGN DATA WRAPPER addr_fdw;
3232
CREATE USER MAPPING FOR regtest_addr_user SERVER "integer";
33+
ALTER DEFAULT PRIVILEGES FOR ROLE regtest_addr_user IN SCHEMA public GRANT ALL ON TABLES TO regtest_addr_user;
34+
ALTER DEFAULT PRIVILEGES FOR ROLE regtest_addr_user REVOKE DELETE ON TABLES FROM regtest_addr_user;
3335
-- test some error cases
3436
SELECT pg_get_object_address('stone', '{}', '{}');
3537
ERROR: unrecognized object type "stone"
@@ -77,7 +79,7 @@ BEGIN
7779
('operator'), ('operator class'), ('operator family'), ('rule'), ('trigger'),
7880
('text search parser'), ('text search dictionary'),
7981
('text search template'), ('text search configuration'),
80-
('policy'), ('user mapping')
82+
('policy'), ('user mapping'), ('default acl')
8183
LOOP
8284
FOR names IN VALUES ('{eins}'), ('{addr_nsp, zwei}'), ('{eins, zwei, drei}')
8385
LOOP
@@ -255,6 +257,12 @@ WARNING: error for user mapping,{addr_nsp,zwei},{}: argument list length must b
255257
WARNING: error for user mapping,{addr_nsp,zwei},{integer}: user mapping for user "addr_nsp" in server "integer" does not exist
256258
WARNING: error for user mapping,{eins,zwei,drei},{}: argument list length must be exactly 1
257259
WARNING: error for user mapping,{eins,zwei,drei},{integer}: user mapping for user "eins" in server "integer" does not exist
260+
WARNING: error for default acl,{eins},{}: argument list length must be exactly 1
261+
WARNING: error for default acl,{eins},{integer}: unrecognized default ACL object type i
262+
WARNING: error for default acl,{addr_nsp,zwei},{}: argument list length must be exactly 1
263+
WARNING: error for default acl,{addr_nsp,zwei},{integer}: unrecognized default ACL object type i
264+
WARNING: error for default acl,{eins,zwei,drei},{}: argument list length must be exactly 1
265+
WARNING: error for default acl,{eins,zwei,drei},{integer}: unrecognized default ACL object type i
258266
-- these object types cannot be qualified names
259267
SELECT pg_get_object_address('language', '{one}', '{}');
260268
ERROR: language "one" does not exist
@@ -341,6 +349,8 @@ WITH objects (type, name, args) AS (VALUES
341349
('foreign-data wrapper', '{addr_fdw}', '{}'),
342350
('server', '{addr_fserv}', '{}'),
343351
('user mapping', '{regtest_addr_user}', '{integer}'),
352+
('default acl', '{regtest_addr_user,public}', '{r}'),
353+
('default acl', '{regtest_addr_user}', '{r}'),
344354
-- extension
345355
-- event trigger
346356
('policy', '{addr_nsp, gentable, genpol}', '{}')
@@ -355,6 +365,8 @@ SELECT (pg_identify_object(addr1.classid, addr1.objid, addr1.subobjid)).*,
355365
ORDER BY addr1.classid, addr1.objid;
356366
type | schema | name | identity | ?column?
357367
---------------------------+------------+-------------------+----------------------------------------------------------------------+----------
368+
default acl | | | for role regtest_addr_user in schema public on tables | t
369+
default acl | | | for role regtest_addr_user on tables | t
358370
type | pg_catalog | _int4 | integer[] | t
359371
type | addr_nsp | gencomptype | addr_nsp.gencomptype | t
360372
type | addr_nsp | genenum | addr_nsp.genenum | t
@@ -391,11 +403,12 @@ SELECT (pg_identify_object(addr1.classid, addr1.objid, addr1.subobjid)).*,
391403
text search parser | addr_nsp | addr_ts_prs | addr_nsp.addr_ts_prs | t
392404
text search configuration | addr_nsp | addr_ts_conf | addr_nsp.addr_ts_conf | t
393405
text search template | addr_nsp | addr_ts_temp | addr_nsp.addr_ts_temp | t
394-
(36 rows)
406+
(38 rows)
395407

396408
---
397409
--- Cleanup resources
398410
---
399411
DROP FOREIGN DATA WRAPPER addr_fdw CASCADE;
400412
DROP SCHEMA addr_nsp CASCADE;
413+
DROP OWNED BY regtest_addr_user;
401414
DROP USER regtest_addr_user;

‎src/test/regress/sql/event_trigger.sql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,8 @@ drop table event_trigger_fire1;
110110
create foreign data wrapper useless;
111111
create server useless_server foreign data wrapper useless;
112112
create user mapping for regression_bob server useless_server;
113+
alter default privileges for role regression_bob
114+
revoke delete on tables from regression_bob;
113115

114116
-- alter owner to non-superuser should fail
115117
alter event trigger regress_event_trigger owner to regression_bob;

‎src/test/regress/sql/object_address.sql

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ CREATE TRIGGER t BEFORE INSERT ON addr_nsp.gentable FOR EACH ROW EXECUTE PROCEDU
3434
CREATE POLICY genpol ON addr_nsp.gentable;
3535
CREATE SERVER "integer" FOREIGN DATA WRAPPER addr_fdw;
3636
CREATE USER MAPPING FOR regtest_addr_user SERVER "integer";
37+
ALTER DEFAULT PRIVILEGES FOR ROLE regtest_addr_user IN SCHEMA public GRANT ALL ON TABLES TO regtest_addr_user;
38+
ALTER DEFAULT PRIVILEGES FOR ROLE regtest_addr_user REVOKE DELETE ON TABLES FROM regtest_addr_user;
3739

3840
-- test some error cases
3941
SELECT pg_get_object_address('stone', '{}', '{}');
@@ -73,7 +75,7 @@ BEGIN
7375
('operator'), ('operator class'), ('operator family'), ('rule'), ('trigger'),
7476
('text search parser'), ('text search dictionary'),
7577
('text search template'), ('text search configuration'),
76-
('policy'), ('user mapping')
78+
('policy'), ('user mapping'), ('default acl')
7779
LOOP
7880
FOR names IN VALUES ('{eins}'), ('{addr_nsp, zwei}'), ('{eins, zwei, drei}')
7981
LOOP
@@ -156,6 +158,8 @@ WITH objects (type, name, args) AS (VALUES
156158
('foreign-data wrapper', '{addr_fdw}', '{}'),
157159
('server', '{addr_fserv}', '{}'),
158160
('user mapping', '{regtest_addr_user}', '{integer}'),
161+
('default acl', '{regtest_addr_user,public}', '{r}'),
162+
('default acl', '{regtest_addr_user}', '{r}'),
159163
-- extension
160164
-- event trigger
161165
('policy', '{addr_nsp, gentable, genpol}', '{}')
@@ -176,4 +180,5 @@ DROP FOREIGN DATA WRAPPER addr_fdw CASCADE;
176180

177181
DROP SCHEMA addr_nsp CASCADE;
178182

183+
DROP OWNED BY regtest_addr_user;
179184
DROP USER regtest_addr_user;

0 commit comments

Comments
 (0)