2 -- Test access privileges
4 -- Clean up in case a prior regression run failed
5 -- Suppress NOTICE messages when users/groups don't exist
6 SET client_min_messages TO 'error';
7 DROP ROLE IF EXISTS regressgroup1;
8 DROP ROLE IF EXISTS regressgroup2;
9 DROP ROLE IF EXISTS regressuser1;
10 DROP ROLE IF EXISTS regressuser2;
11 DROP ROLE IF EXISTS regressuser3;
12 DROP ROLE IF EXISTS regressuser4;
13 DROP ROLE IF EXISTS regressuser5;
14 RESET client_min_messages;
15 -- test proper begins here
16 CREATE USER regressuser1;
17 CREATE USER regressuser2;
18 CREATE USER regressuser3;
19 CREATE USER regressuser4;
20 CREATE USER regressuser5;
21 CREATE USER regressuser5; -- duplicate
22 ERROR: role "regressuser5" already exists
23 CREATE GROUP regressgroup1;
24 CREATE GROUP regressgroup2 WITH USER regressuser1, regressuser2;
25 ALTER GROUP regressgroup1 ADD USER regressuser4;
26 ALTER GROUP regressgroup2 ADD USER regressuser2; -- duplicate
27 NOTICE: role "regressuser2" is already a member of role "regressgroup2"
28 ALTER GROUP regressgroup2 DROP USER regressuser2;
29 ALTER GROUP regressgroup2 ADD USER regressuser4;
30 -- test owner privileges
31 SET SESSION AUTHORIZATION regressuser1;
32 SELECT session_user, current_user;
33 session_user | current_user
34 --------------+--------------
35 regressuser1 | regressuser1
38 CREATE TABLE atest1 ( a int, b text );
44 INSERT INTO atest1 VALUES (1, 'one');
46 UPDATE atest1 SET a = 1 WHERE b = 'blech';
49 LOCK atest1 IN ACCESS EXCLUSIVE MODE;
51 REVOKE ALL ON atest1 FROM PUBLIC;
57 GRANT ALL ON atest1 TO regressuser2;
58 GRANT SELECT ON atest1 TO regressuser3, regressuser4;
64 CREATE TABLE atest2 (col1 varchar(10), col2 boolean);
65 GRANT SELECT ON atest2 TO regressuser2;
66 GRANT UPDATE ON atest2 TO regressuser3;
67 GRANT INSERT ON atest2 TO regressuser4;
68 GRANT TRUNCATE ON atest2 TO regressuser5;
69 SET SESSION AUTHORIZATION regressuser2;
70 SELECT session_user, current_user;
71 session_user | current_user
72 --------------+--------------
73 regressuser2 | regressuser2
76 -- try various combinations of queries on atest1 and atest2
77 SELECT * FROM atest1; -- ok
82 SELECT * FROM atest2; -- ok
87 INSERT INTO atest1 VALUES (2, 'two'); -- ok
88 INSERT INTO atest2 VALUES ('foo', true); -- fail
89 ERROR: permission denied for relation atest2
90 INSERT INTO atest1 SELECT 1, b FROM atest1; -- ok
91 UPDATE atest1 SET a = 1 WHERE a = 2; -- ok
92 UPDATE atest2 SET col2 = NOT col2; -- fail
93 ERROR: permission denied for relation atest2
94 SELECT * FROM atest1 FOR UPDATE; -- ok
101 SELECT * FROM atest2 FOR UPDATE; -- fail
102 ERROR: permission denied for relation atest2
103 DELETE FROM atest2; -- fail
104 ERROR: permission denied for relation atest2
105 TRUNCATE atest2; -- fail
106 ERROR: permission denied for relation atest2
108 LOCK atest2 IN ACCESS EXCLUSIVE MODE; -- fail
109 ERROR: permission denied for relation atest2
111 COPY atest2 FROM stdin; -- fail
112 ERROR: permission denied for relation atest2
113 GRANT ALL ON atest1 TO PUBLIC; -- fail
114 WARNING: no privileges were granted for "atest1"
115 -- checks in subquery, both ok
116 SELECT * FROM atest1 WHERE ( b IN ( SELECT col1 FROM atest2 ) );
121 SELECT * FROM atest2 WHERE ( col1 IN ( SELECT b FROM atest1 ) );
126 SET SESSION AUTHORIZATION regressuser3;
127 SELECT session_user, current_user;
128 session_user | current_user
129 --------------+--------------
130 regressuser3 | regressuser3
133 SELECT * FROM atest1; -- ok
140 SELECT * FROM atest2; -- fail
141 ERROR: permission denied for relation atest2
142 INSERT INTO atest1 VALUES (2, 'two'); -- fail
143 ERROR: permission denied for relation atest1
144 INSERT INTO atest2 VALUES ('foo', true); -- fail
145 ERROR: permission denied for relation atest2
146 INSERT INTO atest1 SELECT 1, b FROM atest1; -- fail
147 ERROR: permission denied for relation atest1
148 UPDATE atest1 SET a = 1 WHERE a = 2; -- fail
149 ERROR: permission denied for relation atest1
150 UPDATE atest2 SET col2 = NULL; -- ok
151 UPDATE atest2 SET col2 = NOT col2; -- fails; requires SELECT on atest2
152 ERROR: permission denied for relation atest2
153 UPDATE atest2 SET col2 = true FROM atest1 WHERE atest1.a = 5; -- ok
154 SELECT * FROM atest1 FOR UPDATE; -- fail
155 ERROR: permission denied for relation atest1
156 SELECT * FROM atest2 FOR UPDATE; -- fail
157 ERROR: permission denied for relation atest2
158 DELETE FROM atest2; -- fail
159 ERROR: permission denied for relation atest2
160 TRUNCATE atest2; -- fail
161 ERROR: permission denied for relation atest2
163 LOCK atest2 IN ACCESS EXCLUSIVE MODE; -- ok
165 COPY atest2 FROM stdin; -- fail
166 ERROR: permission denied for relation atest2
167 -- checks in subquery, both fail
168 SELECT * FROM atest1 WHERE ( b IN ( SELECT col1 FROM atest2 ) );
169 ERROR: permission denied for relation atest2
170 SELECT * FROM atest2 WHERE ( col1 IN ( SELECT b FROM atest1 ) );
171 ERROR: permission denied for relation atest2
172 SET SESSION AUTHORIZATION regressuser4;
173 COPY atest2 FROM stdin; -- ok
174 SELECT * FROM atest1; -- ok
182 SET SESSION AUTHORIZATION regressuser3;
183 CREATE TABLE atest3 (one int, two int, three int);
184 GRANT DELETE ON atest3 TO GROUP regressgroup2;
185 SET SESSION AUTHORIZATION regressuser1;
186 SELECT * FROM atest3; -- fail
187 ERROR: permission denied for relation atest3
188 DELETE FROM atest3; -- ok
190 SET SESSION AUTHORIZATION regressuser3;
191 CREATE VIEW atestv1 AS SELECT * FROM atest1; -- ok
192 /* The next *should* fail, but it's not implemented that way yet. */
193 CREATE VIEW atestv2 AS SELECT * FROM atest2;
194 CREATE VIEW atestv3 AS SELECT * FROM atest3; -- ok
195 SELECT * FROM atestv1; -- ok
202 SELECT * FROM atestv2; -- fail
203 ERROR: permission denied for relation atest2
204 GRANT SELECT ON atestv1, atestv3 TO regressuser4;
205 GRANT SELECT ON atestv2 TO regressuser2;
206 SET SESSION AUTHORIZATION regressuser4;
207 SELECT * FROM atestv1; -- ok
214 SELECT * FROM atestv2; -- fail
215 ERROR: permission denied for relation atestv2
216 SELECT * FROM atestv3; -- ok
221 CREATE VIEW atestv4 AS SELECT * FROM atestv3; -- nested view
222 SELECT * FROM atestv4; -- ok
227 GRANT SELECT ON atestv4 TO regressuser2;
228 SET SESSION AUTHORIZATION regressuser2;
229 -- Two complex cases:
230 SELECT * FROM atestv3; -- fail
231 ERROR: permission denied for relation atestv3
232 SELECT * FROM atestv4; -- ok (even though regressuser2 cannot access underlying atestv3)
237 SELECT * FROM atest2; -- ok
243 SELECT * FROM atestv2; -- fail (even though regressuser2 can access underlying atest2)
244 ERROR: permission denied for relation atest2
245 -- privileges on functions, languages
246 -- switch to superuser
248 REVOKE ALL PRIVILEGES ON LANGUAGE sql FROM PUBLIC;
249 GRANT USAGE ON LANGUAGE sql TO regressuser1; -- ok
250 GRANT USAGE ON LANGUAGE c TO PUBLIC; -- fail
251 ERROR: language "c" is not trusted
252 HINT: Only superusers can use untrusted languages.
253 SET SESSION AUTHORIZATION regressuser1;
254 GRANT USAGE ON LANGUAGE sql TO regressuser2; -- fail
255 WARNING: no privileges were granted for "sql"
256 CREATE FUNCTION testfunc1(int) RETURNS int AS 'select 2 * $1;' LANGUAGE sql;
257 CREATE FUNCTION testfunc2(int) RETURNS int AS 'select 3 * $1;' LANGUAGE sql;
258 REVOKE ALL ON FUNCTION testfunc1(int), testfunc2(int) FROM PUBLIC;
259 GRANT EXECUTE ON FUNCTION testfunc1(int), testfunc2(int) TO regressuser2;
260 GRANT USAGE ON FUNCTION testfunc1(int) TO regressuser3; -- semantic error
261 ERROR: invalid privilege type USAGE for function
262 GRANT ALL PRIVILEGES ON FUNCTION testfunc1(int) TO regressuser4;
263 GRANT ALL PRIVILEGES ON FUNCTION testfunc_nosuch(int) TO regressuser4;
264 ERROR: function testfunc_nosuch(integer) does not exist
265 CREATE FUNCTION testfunc4(boolean) RETURNS text
266 AS 'select col1 from atest2 where col2 = $1;'
267 LANGUAGE sql SECURITY DEFINER;
268 GRANT EXECUTE ON FUNCTION testfunc4(boolean) TO regressuser3;
269 SET SESSION AUTHORIZATION regressuser2;
270 SELECT testfunc1(5), testfunc2(5); -- ok
271 testfunc1 | testfunc2
272 -----------+-----------
276 CREATE FUNCTION testfunc3(int) RETURNS int AS 'select 2 * $1;' LANGUAGE sql; -- fail
277 ERROR: permission denied for language sql
278 SET SESSION AUTHORIZATION regressuser3;
279 SELECT testfunc1(5); -- fail
280 ERROR: permission denied for function testfunc1
281 SELECT col1 FROM atest2 WHERE col2 = true; -- fail
282 ERROR: permission denied for relation atest2
283 SELECT testfunc4(true); -- ok
289 SET SESSION AUTHORIZATION regressuser4;
290 SELECT testfunc1(5); -- ok
296 DROP FUNCTION testfunc1(int); -- fail
297 ERROR: must be owner of function testfunc1
299 DROP FUNCTION testfunc1(int); -- ok
301 GRANT ALL PRIVILEGES ON LANGUAGE sql TO PUBLIC;
303 SET SESSION AUTHORIZATION regressuser5;
304 TRUNCATE atest2; -- ok
305 TRUNCATE atest3; -- fail
306 ERROR: permission denied for relation atest3
307 -- has_table_privilege function
309 select has_table_privilege(NULL,'pg_authid','select');
311 ---------------------
315 select has_table_privilege('pg_shad','select');
316 ERROR: relation "pg_shad" does not exist
317 select has_table_privilege('nosuchuser','pg_authid','select');
318 ERROR: role "nosuchuser" does not exist
319 select has_table_privilege('pg_authid','sel');
320 ERROR: unrecognized privilege type: "sel"
321 select has_table_privilege(-999999,'pg_authid','update');
322 ERROR: role with OID 4293967297 does not exist
323 select has_table_privilege(1,'select');
324 ERROR: relation with OID 1 does not exist
327 select has_table_privilege(current_user,'pg_authid','select');
329 ---------------------
333 select has_table_privilege(current_user,'pg_authid','insert');
335 ---------------------
339 select has_table_privilege(t2.oid,'pg_authid','update')
340 from (select oid from pg_roles where rolname = current_user) as t2;
342 ---------------------
346 select has_table_privilege(t2.oid,'pg_authid','delete')
347 from (select oid from pg_roles where rolname = current_user) as t2;
349 ---------------------
353 -- 'rule' privilege no longer exists, but for backwards compatibility
354 -- has_table_privilege still recognizes the keyword and says FALSE
355 select has_table_privilege(current_user,t1.oid,'rule')
356 from (select oid from pg_class where relname = 'pg_authid') as t1;
358 ---------------------
362 select has_table_privilege(current_user,t1.oid,'references')
363 from (select oid from pg_class where relname = 'pg_authid') as t1;
365 ---------------------
369 select has_table_privilege(t2.oid,t1.oid,'select')
370 from (select oid from pg_class where relname = 'pg_authid') as t1,
371 (select oid from pg_roles where rolname = current_user) as t2;
373 ---------------------
377 select has_table_privilege(t2.oid,t1.oid,'insert')
378 from (select oid from pg_class where relname = 'pg_authid') as t1,
379 (select oid from pg_roles where rolname = current_user) as t2;
381 ---------------------
385 select has_table_privilege('pg_authid','update');
387 ---------------------
391 select has_table_privilege('pg_authid','delete');
393 ---------------------
397 select has_table_privilege('pg_authid','truncate');
399 ---------------------
403 select has_table_privilege(t1.oid,'select')
404 from (select oid from pg_class where relname = 'pg_authid') as t1;
406 ---------------------
410 select has_table_privilege(t1.oid,'trigger')
411 from (select oid from pg_class where relname = 'pg_authid') as t1;
413 ---------------------
418 SET SESSION AUTHORIZATION regressuser3;
419 select has_table_privilege(current_user,'pg_class','select');
421 ---------------------
425 select has_table_privilege(current_user,'pg_class','insert');
427 ---------------------
431 select has_table_privilege(t2.oid,'pg_class','update')
432 from (select oid from pg_roles where rolname = current_user) as t2;
434 ---------------------
438 select has_table_privilege(t2.oid,'pg_class','delete')
439 from (select oid from pg_roles where rolname = current_user) as t2;
441 ---------------------
445 select has_table_privilege(current_user,t1.oid,'references')
446 from (select oid from pg_class where relname = 'pg_class') as t1;
448 ---------------------
452 select has_table_privilege(t2.oid,t1.oid,'select')
453 from (select oid from pg_class where relname = 'pg_class') as t1,
454 (select oid from pg_roles where rolname = current_user) as t2;
456 ---------------------
460 select has_table_privilege(t2.oid,t1.oid,'insert')
461 from (select oid from pg_class where relname = 'pg_class') as t1,
462 (select oid from pg_roles where rolname = current_user) as t2;
464 ---------------------
468 select has_table_privilege('pg_class','update');
470 ---------------------
474 select has_table_privilege('pg_class','delete');
476 ---------------------
480 select has_table_privilege('pg_class','truncate');
482 ---------------------
486 select has_table_privilege(t1.oid,'select')
487 from (select oid from pg_class where relname = 'pg_class') as t1;
489 ---------------------
493 select has_table_privilege(t1.oid,'trigger')
494 from (select oid from pg_class where relname = 'pg_class') as t1;
496 ---------------------
500 select has_table_privilege(current_user,'atest1','select');
502 ---------------------
506 select has_table_privilege(current_user,'atest1','insert');
508 ---------------------
512 select has_table_privilege(t2.oid,'atest1','update')
513 from (select oid from pg_roles where rolname = current_user) as t2;
515 ---------------------
519 select has_table_privilege(t2.oid,'atest1','delete')
520 from (select oid from pg_roles where rolname = current_user) as t2;
522 ---------------------
526 select has_table_privilege(current_user,t1.oid,'references')
527 from (select oid from pg_class where relname = 'atest1') as t1;
529 ---------------------
533 select has_table_privilege(t2.oid,t1.oid,'select')
534 from (select oid from pg_class where relname = 'atest1') as t1,
535 (select oid from pg_roles where rolname = current_user) as t2;
537 ---------------------
541 select has_table_privilege(t2.oid,t1.oid,'insert')
542 from (select oid from pg_class where relname = 'atest1') as t1,
543 (select oid from pg_roles where rolname = current_user) as t2;
545 ---------------------
549 select has_table_privilege('atest1','update');
551 ---------------------
555 select has_table_privilege('atest1','delete');
557 ---------------------
561 select has_table_privilege('atest1','truncate');
563 ---------------------
567 select has_table_privilege(t1.oid,'select')
568 from (select oid from pg_class where relname = 'atest1') as t1;
570 ---------------------
574 select has_table_privilege(t1.oid,'trigger')
575 from (select oid from pg_class where relname = 'atest1') as t1;
577 ---------------------
582 SET SESSION AUTHORIZATION regressuser1;
583 CREATE TABLE atest4 (a int);
584 GRANT SELECT ON atest4 TO regressuser2 WITH GRANT OPTION;
585 GRANT UPDATE ON atest4 TO regressuser2;
586 GRANT SELECT ON atest4 TO GROUP regressgroup1 WITH GRANT OPTION;
587 SET SESSION AUTHORIZATION regressuser2;
588 GRANT SELECT ON atest4 TO regressuser3;
589 GRANT UPDATE ON atest4 TO regressuser3; -- fail
590 WARNING: no privileges were granted for "atest4"
591 SET SESSION AUTHORIZATION regressuser1;
592 REVOKE SELECT ON atest4 FROM regressuser3; -- does nothing
593 SELECT has_table_privilege('regressuser3', 'atest4', 'SELECT'); -- true
595 ---------------------
599 REVOKE SELECT ON atest4 FROM regressuser2; -- fail
600 ERROR: dependent privileges exist
601 HINT: Use CASCADE to revoke them too.
602 REVOKE GRANT OPTION FOR SELECT ON atest4 FROM regressuser2 CASCADE; -- ok
603 SELECT has_table_privilege('regressuser2', 'atest4', 'SELECT'); -- true
605 ---------------------
609 SELECT has_table_privilege('regressuser3', 'atest4', 'SELECT'); -- false
611 ---------------------
615 SELECT has_table_privilege('regressuser1', 'atest4', 'SELECT WITH GRANT OPTION'); -- true
617 ---------------------
623 DROP FUNCTION testfunc2(int);
624 DROP FUNCTION testfunc4(boolean);
627 -- this should cascade to drop atestv4
628 DROP VIEW atestv3 CASCADE;
629 NOTICE: drop cascades to view atestv4
630 -- this should complain "does not exist"
632 ERROR: view "atestv4" does not exist
637 DROP GROUP regressgroup1;
638 DROP GROUP regressgroup2;
639 REVOKE USAGE ON LANGUAGE sql FROM regressuser1;
640 DROP USER regressuser1;
641 DROP USER regressuser2;
642 DROP USER regressuser3;
643 DROP USER regressuser4;
644 DROP USER regressuser5;