fix: make get_queue_info reader-callable#267
Open
NikolayS wants to merge 2 commits into
Open
Conversation
Failing regression: a pgque_reader session calling pgque.get_queue_info() / get_queue_info(text) hits "permission denied for function seq_getval" because the function is SECURITY INVOKER but calls the admin-only pgque.seq_getval(text). Reproduces issue #265. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
get_queue_info(text) calls the admin-only pgque.seq_getval(text) but ships as SECURITY INVOKER, so a pgque_reader session -- the exact role it is granted to and documented for -- fails at runtime with "permission denied for function seq_getval". Promote both get_queue_info overloads to SECURITY DEFINER with SET search_path = pgque, pg_catalog (mandatory per CLAUDE.md), mirroring the sibling get_consumer_info / get_batch_info. Patch added to build/transform.sh and the generated sql/pgque.sql and sql/pgque-tle.sql regenerated so source and generated stay in sync. Grants no privilege beyond reading queue metadata. Fixes #265 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
pgque.get_queue_info()andpgque.get_queue_info(text)are granted topgque_readerand documented indocs/reference.md/docs/monitoring.mdas reader-usable monitoring functions, but apgque_readersession fails at runtime:Root cause
get_queue_infois inherited from upstream PgQ asSECURITY INVOKER. The 1-arg overload internally callspgque.seq_getval(text)to computeev_new, and that helper's ACL is admin-only ({postgres, pgque_admin}). A reader therefore cannot execute it. The sibling functionsget_consumer_infoandget_batch_infoareSECURITY DEFINERfor exactly this reason and work fine for readers —get_queue_infowas the odd one out.Fix
Promote both
get_queue_infooverloads toSECURITY DEFINERwithSET search_path = pgque, pg_catalog(mandatory for allSECURITY DEFINERper CLAUDE.md), mirroring the existingget_consumer_info/get_batch_infopattern. This grants no privilege beyond reading queue metadata plus the queue event sequence — the same surface the function already exposes to its (intended) readers.build/transform.sh(the source of truth for the generated installs), with a guard asserting exactly 2 overloads are promoted.sql/pgque.sqlandsql/pgque-tle.sqlso generated and source stay consistent. Rebuild is reproducible (re-runningtransform.shyields no diff).Audited the other reader-granted observability functions for the same trap: only
get_queue_infocallsseq_getvalunderSECURITY INVOKER.get_batch_info/get_consumer_infoare already DEFINER;status()is admin-only by design and left as-is.Test (red/green TDD)
New regression
tests/test_get_queue_info_reader.sql(registered intests/run_all.sql) creates a queue, ticks it, then underset role pgque_readercalls both overloads and asserts success + populatedev_new.permission denied for function seq_getval(verified).tests/run_all.sqlsuite passes on PostgreSQL 18.Manual verification
Fixes #265