fix: #19020 Check permissions using native Postgres functions to support GROUPs and ROLEs based access control #19021
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I hereby agree to the terms of the RisingWave Labs, Inc. Contributor License Agreement.
What's changed and what's your intention?
Update the SQL queries being run in the PostgresValidator to properly take into account GROUP and ROLE permissions.
This PR updates both the RDS Role check (for servers running in AWS) and the SELECT privilege check, to confirm that the PG user being used has those roles
Before, you had to GRANT the role to the user itself and explicitly GRANT SELECTs if the user wasn't the owner of the table.
See details in #19020
Checklist
./risedev check
(or alias,./risedev c
)Documentation
Release note
If this PR includes changes that directly affect users or other significant modifications relevant to the community, kindly draft a release note to provide a concise summary of these changes. Please prioritize highlighting the impact these changes will have on users.
The Postgres CDC source now fully supports GROUPs and ROLEs instead of requiring explicit permissions on USERs.