Fix: allow safe update for postgres user

migrations/db/migrations/20261010094800_postgres-role-safeupdate.sql

@@ -0,0 +1,6 @@
+-- migrate:up
+ALTER ROLE postgres SET session_preload_libraries = supautils, safeupdate;
+
+ALTER ROLE postgres SET safeupdate.enabled = 0;
+
+-- migrate:down

nix/tests/expected/pg-safeupdate.out

@@ -10,3 +10,10 @@ update v.foo
 ERROR:  UPDATE requires a WHERE clause
 drop schema v cascade;
 NOTICE:  drop cascades to table v.foo
+alter role postgres in database postgres set safeupdate.enabled = 1;
+\c - postgres
+create temp table t(id int);
+update t set id = 1;
+ERROR:  UPDATE requires a WHERE clause
+\c - supabase_admin
+alter role postgres in database postgres reset safeupdate.enabled;

nix/tests/expected/roles.out

@@ -60,8 +60,8 @@ select
 from pg_roles r
 where rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
 order by rolname;
-          rolname           |                                        rolconfig                                         
-----------------------------+------------------------------------------------------------------------------------------
+          rolname           |                                                       rolconfig                                                       
+----------------------------+-----------------------------------------------------------------------------------------------------------------------
  anon                       | {statement_timeout=3s}
  authenticated              | {statement_timeout=8s}
  authenticator              | {"session_preload_libraries=supautils, safeupdate",statement_timeout=8s,lock_timeout=8s}
@@ -83,7 +83,7 @@ order by rolname;
  pgsodium_keyiduser         | 
  pgsodium_keymaker          | 
  pgtle_admin                | 
- postgres                   | {"search_path=\"\\$user\", public, extensions"}
+ postgres                   | {"search_path=\"\\$user\", public, extensions","session_preload_libraries=supautils, safeupdate",safeupdate.enabled=0}
  service_role               | 
  supabase_admin             | {"search_path=\"$user\", public, auth, extensions",log_statement=none}
  supabase_auth_admin        | {search_path=auth,idle_in_transaction_session_timeout=60000,log_statement=none}

nix/tests/expected/z_multigres-orioledb-17_roles.out

@@ -57,8 +57,8 @@ select
 from pg_roles r
 where rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
 order by rolname;
-          rolname           |                                        rolconfig                                         
-----------------------------+------------------------------------------------------------------------------------------
+          rolname           |                                                       rolconfig                                                       
+----------------------------+-----------------------------------------------------------------------------------------------------------------------
  anon                       | {statement_timeout=3s}
  authenticated              | {statement_timeout=8s}
  authenticator              | {"session_preload_libraries=supautils, safeupdate",statement_timeout=8s,lock_timeout=8s}
@@ -77,7 +77,7 @@ order by rolname;
  pg_write_server_files      | 
  pgbouncer                  | 
  pgtle_admin                | 
- postgres                   | {"search_path=\"\\$user\", public, extensions"}
+ postgres                   | {"search_path=\"\\$user\", public, extensions","session_preload_libraries=supautils, safeupdate",safeupdate.enabled=0}
  service_role               | 
  supabase_admin             | {"search_path=\"\\$user\", public, auth, extensions",log_statement=none}
  supabase_auth_admin        | {search_path=auth,idle_in_transaction_session_timeout=60000,log_statement=none}

nix/tests/sql/pg-safeupdate.sql

@@ -13,3 +13,13 @@ update v.foo
   set val = 'bar';
 
 drop schema v cascade;
+
+alter role postgres in database postgres set safeupdate.enabled = 1;
+
+\c - postgres
+create temp table t(id int);
+
+update t set id = 1;
+
+\c - supabase_admin
+alter role postgres in database postgres reset safeupdate.enabled;