Add insforge pg utils for role privileges

.github/workflows/build-postgres.yml

@@ -37,6 +37,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to GitHub Container Registry
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -58,7 +59,7 @@ jobs:
           context: ./postgres
           file: ./postgres/Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha

CLAUDE.md

@@ -16,6 +16,7 @@ The custom Postgres image includes:
 - **PostGIS 3** - Spatial database support
 - **pg_cron** - Job scheduling within PostgreSQL
 - **pgsql-http** - HTTP client for making requests from SQL
+- **insforge_pg_utils** - InsForge preload hook for scoped managed-table RLS policy administration
 
 ## Build Process
 

README.md

@@ -12,6 +12,7 @@ This image is based on **PostgreSQL 15.13** and includes the following extension
 - **[PostGIS 3](https://postgis.net/)** - Spatial and geographic objects support
 - **[pg_cron](https://github.com/citusdata/pg_cron)** - Job scheduling within PostgreSQL
 - **[pgsql-http](https://github.com/pramsey/pgsql-http)** - HTTP client for making requests from SQL
+- **insforge_pg_utils** - InsForge preload hook for scoped managed-table RLS policy administration (loaded via `shared_preload_libraries`, not `CREATE EXTENSION`)
 
 ## Quick Start
 

postgres/Dockerfile

@@ -38,6 +38,12 @@ RUN cd /tmp && \
     cd / && \
     rm -rf /tmp/pg_graphql
 
+# Build InsForge PostgreSQL utility hooks
+COPY insforge_pg_utils /tmp/insforge_pg_utils
+RUN make -C /tmp/insforge_pg_utils PG_CONFIG=/usr/lib/postgresql/15/bin/pg_config && \
+    make -C /tmp/insforge_pg_utils install PG_CONFIG=/usr/lib/postgresql/15/bin/pg_config && \
+    rm -rf /tmp/insforge_pg_utils
+
 # Build pg_net (async HTTP requests) - C extension using libcurl
 # Note: v0.14.0 has curl type warnings, disable -Werror for compatibility with newer compilers
 RUN apt-get update && apt-get install -y libcurl4-openssl-dev && \
@@ -85,6 +91,7 @@ COPY --from=builder /usr/share/postgresql/15/extension/pg_graphql* /usr/share/po
 # pg_net may create versioned .so files, copy all matching patterns
 COPY --from=builder /usr/lib/postgresql/15/lib/pg_net*.so /usr/lib/postgresql/15/lib/
 COPY --from=builder /usr/share/postgresql/15/extension/pg_net* /usr/share/postgresql/15/extension/
+COPY --from=builder /usr/lib/postgresql/15/lib/insforge_pg_utils.so /usr/lib/postgresql/15/lib/
 
 # Clean up unnecessary packages
 RUN apt-get purge -y lsb-release curl gnupg && \

postgres/insforge_pg_utils/Makefile

@@ -0,0 +1,6 @@
+MODULE_big = insforge_pg_utils
+OBJS = src/insforge_pg_utils.o
+
+PG_CONFIG ?= pg_config
+PGXS := $(shell $(PG_CONFIG) --pgxs)
+include $(PGXS)

postgres/insforge_pg_utils/README.md

@@ -0,0 +1,11 @@
+# insforge_pg_utils
+
+PostgreSQL shared-preload library for InsForge database permission hooks.
+
+The first hook lets `insforge.policy_grant_role` manage row-level-security
+policies on the comma-separated `insforge.policy_grant_tables` allowlist without
+making that role the table owner.
+
+This library must be installed into the Postgres image and listed in
+`shared_preload_libraries`. It does not currently need SQL-level
+`CREATE EXTENSION` installation because it exposes no SQL objects.