diff --git a/sql/pg_net--0.20.5--0.20.6.sql b/sql/pg_net--0.20.5--0.20.6.sql new file mode 100644 index 00000000..06a6ca98 --- /dev/null +++ b/sql/pg_net--0.20.5--0.20.6.sql @@ -0,0 +1,14 @@ +revoke update on all sequences in schema net to PUBLIC; + +revoke insert on all tables in schema net to PUBLIC; +revoke update on all tables in schema net to PUBLIC; + +revoke delete on all tables in schema net to PUBLIC; +grant delete on net.http_request_queue to PUBLIC; + +revoke truncate on all tables in schema net to PUBLIC; +grant truncate on net.http_request_queue to PUBLIC; + +revoke references on all tables in schema net to PUBLIC; +revoke trigger on all tables in schema net to PUBLIC; +revoke maintain on all tables in schema net to PUBLIC; diff --git a/sql/pg_net.sql b/sql/pg_net.sql index b0acd86a..01a63bc6 100644 --- a/sql/pg_net.sql +++ b/sql/pg_net.sql @@ -353,5 +353,11 @@ end; $$; grant usage on schema net to PUBLIC; -grant all on all sequences in schema net to PUBLIC; -grant all on all tables in schema net to PUBLIC; + +grant usage on all sequences in schema net to PUBLIC; +grant select on all sequences in schema net to PUBLIC; + +grant select on all tables in schema net to PUBLIC; + +grant delete on net.http_request_queue to PUBLIC; +grant truncate on net.http_request_queue to PUBLIC; diff --git a/test/test_engine.py b/test/test_engine.py index af8f1450..349e19dc 100644 --- a/test/test_engine.py +++ b/test/test_engine.py @@ -2,4 +2,4 @@ def test_connect(conn): """Sanity test verifying connection to postgres works""" conn.execute("select 1") - assert [(1, )] == conn.execute("select 1").fetchall() + assert [(1,)] == conn.execute("select 1").fetchall() diff --git a/test/test_privileges.py b/test/test_privileges.py index e2b1be53..9fbb4ecb 100644 --- a/test/test_privileges.py +++ b/test/test_privileges.py @@ -1,5 +1,7 @@ from sqlalchemy import text from common import collect_response_sync, http_request +import pytest +import psycopg def test_net_on_postgres_role(sess): @@ -25,87 +27,66 @@ def test_net_on_postgres_role(sess): assert response["status"] == "SUCCESS" -def test_net_on_pre_existing_role(sess): - """Check that a pre existing role can use the net schema""" +def test_net_on_pre_existing_role(conn): + """Check permissions on pre-existing role""" - role = sess.execute(text("select current_user;")).fetchone() - assert role[0] == "postgres" + role = conn.execute("select current_user;").fetchall() + assert role[0][0] == "postgres" - sess.execute(text("set local role to pre_existing;")) - (request_id, current_user) = sess.execute( - text( + conn.execute("set local role to pre_existing;") + with pytest.raises( + psycopg.errors.InsufficientPrivilege, + match="permission denied for table http_request_queue", + ): + conn.execute( """ - select net.http_get( - 'http://localhost:8080/anything' - ), current_user; - """ + select net.http_get( + 'http://localhost:8080/anything' + ), current_user; + """ ) - ).fetchone() - assert request_id == 1 - assert current_user == "pre_existing" - # Commit to wakeup background worker - sess.commit() - - # Confirm that the request was retrievable - sess.execute(text("set local role to pre_existing;")) - response = collect_response_sync(sess, request_id) - current_user = sess.execute(text("select current_user;")).scalar() - assert response["status"] == "SUCCESS" - assert current_user == "pre_existing" + conn.rollback() + conn.execute("set local role to pre_existing;") + conn.execute("DELETE FROM net.http_request_queue WHERE 1 = 0;") + conn.execute("TRUNCATE net.http_request_queue;") -def test_net_on_new_role(sess): - """Check that a newly created role can use the net schema""" +def test_net_on_new_role(conn): + """Check permissions on newly created role""" - role = sess.execute(text("select current_user;")).fetchone() - assert role[0] == "postgres" + role = conn.execute("select current_user;").fetchall() + assert role[0][0] == "postgres" - sess.execute( - text(""" - create role another; - """) - ) - sess.execute(text("set local role to another;")) + conn.execute("create role another;") + conn.commit() + conn.execute("set local role to another;") - (request_id, current_user) = sess.execute( - text( + with pytest.raises( + psycopg.errors.InsufficientPrivilege, + match="permission denied for table http_request_queue", + ): + conn.execute( """ - select net.http_get( - 'http://localhost:8080/anything' - ), current_user; - """ + select net.http_get( + 'http://localhost:8080/anything' + ), current_user; + """ ) - ).fetchone() - assert request_id == 1 - assert current_user == "another" - # Commit to wakeup background worker - sess.commit() + conn.rollback() - # Confirm that the request was retrievable - sess.execute(text("set local role to another;")) - response = collect_response_sync(sess, request_id) - current_user = sess.execute(text("select current_user;")).scalar() - assert response["status"] == "SUCCESS" - assert current_user == "another" + conn.execute("set local role to another;") + conn.execute("DELETE FROM net.http_request_queue WHERE 1 = 0;") + conn.execute("TRUNCATE net.http_request_queue;") - sess.execute(text("set local role to another;")) + conn.execute("set local role to another;") # can use the net.worker_restart function - (res, current_user) = sess.execute( - text( - """ - select net.worker_restart(), current_user; - """ - ) - ).fetchone() - assert res - assert current_user == "another" - - sess.execute( - text(""" - select net.wait_until_running(); - set local role postgres; - drop role another; - """) - ) + res = conn.execute("select net.worker_restart(), current_user;").fetchone() + assert res[0] + assert res[1] == "another" + + conn.execute("select net.wait_until_running();") + + conn.execute("set local role postgres;") + conn.execute("drop role another;")