Skip to content

PG-1605, PG-1606 Remove grant/revoke helper functions #381

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 3, 2025

Conversation

jeltz
Copy link
Collaborator

@jeltz jeltz commented May 30, 2025

These helper functions were tricky to use correctly and did not add much vaule. Emulating a role this way does not really work in PostgreSQL. If people want this behavior they should use a real role.

Copy link
Collaborator

@dutow dutow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a documentation question: don't we allow pg_tde_is_encrypted and some other informational functions by default? Because now the documentation states that everything is locked down.

(and maybe we could enable more readonly/informational functions by default?)

@jeltz
Copy link
Collaborator Author

jeltz commented Jun 2, 2025

Yeah, we should make the documentation more clear but not sure if iut is in the scope of this ticket or not.

@jeltz jeltz force-pushed the tde/rm-grant-revoke branch from da1f839 to f85c2d1 Compare June 2, 2025 18:46
@codecov-commenter
Copy link

codecov-commenter commented Jun 2, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.39%. Comparing base (225a23c) to head (d5bbb20).

❌ Your project status has failed because the head coverage (85.39%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files
@@                Coverage Diff                 @@
##           TDE_REL_17_STABLE     #381   +/-   ##
==================================================
  Coverage              85.39%   85.39%           
==================================================
  Files                     22       22           
  Lines                   2602     2602           
  Branches                 393      393           
==================================================
  Hits                    2222     2222           
  Misses                   304      304           
  Partials                  76       76           
Components Coverage Δ
access 84.20% <ø> (ø)
catalog 88.20% <ø> (ø)
common 91.80% <ø> (ø)
encryption 73.45% <ø> (ø)
keyring 72.00% <ø> (ø)
src 91.40% <ø> (ø)
smgr 97.41% <ø> (ø)
transam ∅ <ø> (∅)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@AndersAstrand
Copy link
Collaborator

I'm all for this! Honestly the only way I see these grant function being usable is if it was meant to grant to a non-login role that was then granted to whoever should have it. Since we can't control roles it would only be a helper for superusers pretty much. The list of grants that makes sense could just as well be in the documentation ofc.

These helper functions were tricky to use correctly and did not add much
vaule. Emulating a role this way does not really work in PostgreSQL. If
people want this behavior they should use a real role.
@jeltz jeltz force-pushed the tde/rm-grant-revoke branch from f85c2d1 to d5bbb20 Compare June 3, 2025 08:03
@jeltz
Copy link
Collaborator Author

jeltz commented Jun 3, 2025

It could be added to the documentation but I am not sure it should. I do not want to encourage people to blindly run grants without understanding why.

@jeltz jeltz merged commit ad8a0f0 into percona:TDE_REL_17_STABLE Jun 3, 2025
16 checks passed
@jeltz jeltz deleted the tde/rm-grant-revoke branch June 4, 2025 10:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants