Skip to content

fix: dump and diff RLS enabled on partitioned tables (#471) #490

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tianzhou merged 1 commit into from
Jun 23, 2026
Merged

fix: dump and diff RLS enabled on partitioned tables (#471) #490

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ir/queries/queries.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -775,7 +775,7 @@ WHERE
n.nspname NOT IN ('information_schema', 'pg_catalog', 'pg_toast')
AND n.nspname NOT LIKE 'pg_temp_%'
AND n.nspname NOT LIKE 'pg_toast_temp_%'
AND c.relkind = 'r'
AND c.relkind IN ('r', 'p') -- ordinary and partitioned tables (issue #471)
AND c.relrowsecurity = true
ORDER BY n.nspname, c.relname;

Expand Down Expand Up @@ -837,7 +837,7 @@ FROM pg_catalog.pg_class c
JOIN pg_catalog.pg_namespace n ON c.relnamespace = n.oid
WHERE
n.nspname = $1
AND c.relkind = 'r'
AND c.relkind IN ('r', 'p') -- ordinary and partitioned tables (issue #471)
AND c.relrowsecurity = true
ORDER BY n.nspname, c.relname;

Expand Down
4 changes: 2 additions & 2 deletions ir/queries/queries.sql.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions testdata/diff/create_policy/enable_rls_partitioned/diff.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
ALTER TABLE events ENABLE ROW LEVEL SECURITY;

CREATE POLICY events_org_isolation ON events TO PUBLIC USING (org_id = (NULLIF(current_setting('app.current_org_id', true), ''::text))::uuid);
14 changes: 14 additions & 0 deletions testdata/diff/create_policy/enable_rls_partitioned/new.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
CREATE TABLE events (
id uuid NOT NULL,
org_id uuid NOT NULL,
created_at timestamptz NOT NULL,
PRIMARY KEY (created_at, id)
) PARTITION BY RANGE (created_at);

-- RLS is now enabled with a policy on a partitioned table (issue #471)
ALTER TABLE events ENABLE ROW LEVEL SECURITY;

CREATE POLICY events_org_isolation ON events
FOR ALL
TO PUBLIC
USING (org_id = NULLIF(current_setting('app.current_org_id', true), '')::uuid);
Comment on lines +1 to +14

@greptile-apps greptile-apps Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Missing dump regression test for the fix

The PR title and description both claim to fix "dump and diff", but only a testdata/diff/ test is added. The dump command uses the same GetRLSTablesForSchema query (fixed here), so a partitioned table with RLS enabled was also silently omitted from schema dumps. Without a corresponding testdata/dump/issue_471_*/ test (with raw.sql, pgschema.sql, etc.), a future regression that re-breaks dump output for partitioned RLS tables would go undetected.

8 changes: 8 additions & 0 deletions testdata/diff/create_policy/enable_rls_partitioned/old.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
CREATE TABLE events (
id uuid NOT NULL,
org_id uuid NOT NULL,
created_at timestamptz NOT NULL,
PRIMARY KEY (created_at, id)
) PARTITION BY RANGE (created_at);

-- RLS is not enabled
26 changes: 26 additions & 0 deletions testdata/diff/create_policy/enable_rls_partitioned/plan.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
{
"version": "1.0.0",
"pgschema_version": "1.11.1",
"created_at": "1970-01-01T00:00:00Z",
"source_fingerprint": {
"hash": "2432fe99d3b1ab277b6fff72041a7c4400ada76e7e1ef6dbb04874d87dbc6129"
},
"groups": [
{
"steps": [
{
"sql": "ALTER TABLE events ENABLE ROW LEVEL SECURITY;",
"type": "table.rls",
"operation": "create",
"path": "public.events"
},
{
"sql": "CREATE POLICY events_org_isolation ON events TO PUBLIC USING (org_id = (NULLIF(current_setting('app.current_org_id', true), ''::text))::uuid);",
"type": "table.policy",
"operation": "create",
"path": "public.events.events_org_isolation"
}
]
}
]
}
3 changes: 3 additions & 0 deletions testdata/diff/create_policy/enable_rls_partitioned/plan.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
ALTER TABLE events ENABLE ROW LEVEL SECURITY;

CREATE POLICY events_org_isolation ON events TO PUBLIC USING (org_id = (NULLIF(current_setting('app.current_org_id', true), ''::text))::uuid);
16 changes: 16 additions & 0 deletions testdata/diff/create_policy/enable_rls_partitioned/plan.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
Plan: 1 to modify.

Summary by type:
tables: 1 to modify

Tables:
~ events
+ events_org_isolation (policy)
+ events (rls)

DDL to be executed:
--------------------------------------------------

ALTER TABLE events ENABLE ROW LEVEL SECURITY;

CREATE POLICY events_org_isolation ON events TO PUBLIC USING (org_id = (NULLIF(current_setting('app.current_org_id', true), ''::text))::uuid);