fix: revoke execute on pgque.uninstall() from PUBLIC (#60)

pgque.uninstall() was revoked from pgque_admin, but PUBLIC execute was
left at the PostgreSQL default for SECURITY DEFINER functions. Any role
that could connect to the database could call pgque.uninstall() and
drop the entire pgque schema. The README and docs/reference.md both
claimed the function was "superuser only"; reality was that every
login role had it.

Add `revoke execute on function pgque.uninstall() from public;` in
sql/pgque-additions/roles.sql alongside the existing pgque_admin
revoke. Rebuild sql/pgque.sql. Extend tests/test_pgque_roles.sql to
assert that pgque_admin, pgque_writer, and pgque_reader all lack
execute on uninstall() — catches any future regression.

Found during the functional review of PR #59 (docs restructure). The
docs PR tightened the wording to match pre-fix reality and pointed at
this PR as the follow-up hardening; once this merges, the docs claim
becomes true by default.

Co-authored-by: Nik Samokhvalov <nik@niks-mbp.lan>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 3 people

sql/pgque-additions/roles.sql

@@ -77,5 +77,8 @@ grant all on all tables in schema pgque to pgque_admin;
 grant all on all sequences in schema pgque to pgque_admin;
 grant execute on all functions in schema pgque to pgque_admin;
 
--- uninstall() drops the entire schema — only superuser / schema owner should run it
+-- uninstall() drops the entire schema — only superuser / schema owner should run it.
+-- SECURITY DEFINER functions default to PUBLIC execute; revoke both PUBLIC and
+-- pgque_admin so the function really is superuser-only.
+revoke execute on function pgque.uninstall() from public;
 revoke execute on function pgque.uninstall() from pgque_admin;

sql/pgque.sql

@@ -4239,7 +4239,10 @@ grant all on all tables in schema pgque to pgque_admin;
 grant all on all sequences in schema pgque to pgque_admin;
 grant execute on all functions in schema pgque to pgque_admin;
 
--- uninstall() drops the entire schema — only superuser / schema owner should run it
+-- uninstall() drops the entire schema — only superuser / schema owner should run it.
+-- SECURITY DEFINER functions default to PUBLIC execute; revoke both PUBLIC and
+-- pgque_admin so the function really is superuser-only.
+revoke execute on function pgque.uninstall() from public;
 revoke execute on function pgque.uninstall() from pgque_admin;
 
 -- pgque-additions/dlq.sql

tests/test_pgque_roles.sql

@@ -41,5 +41,15 @@ begin
   assert has_function_privilege('pgque_writer', 'pgque.nack(bigint, pgque.message, interval, text)', 'EXECUTE'),
     'pgque_writer should have execute on nack(bigint, pgque.message, interval, text)';
 
+  -- uninstall() must be superuser-only: execute is revoked from both
+  -- pgque_admin and PUBLIC. Any non-superuser role (including pgque_admin,
+  -- pgque_writer, pgque_reader) should NOT be able to execute it.
+  assert not has_function_privilege('pgque_admin',  'pgque.uninstall()', 'EXECUTE'),
+    'pgque_admin should NOT have execute on uninstall() (revoked in roles.sql)';
+  assert not has_function_privilege('pgque_writer', 'pgque.uninstall()', 'EXECUTE'),
+    'pgque_writer should NOT have execute on uninstall() (inherits PUBLIC revoke)';
+  assert not has_function_privilege('pgque_reader', 'pgque.uninstall()', 'EXECUTE'),
+    'pgque_reader should NOT have execute on uninstall() (inherits PUBLIC revoke)';
+
   raise notice 'PASS: pgque_roles';
 end $$;