From fa874071344cc4bdb87c4adb459c46dfd4d7c28e Mon Sep 17 00:00:00 2001 From: Julian Ladisch Date: Thu, 2 Apr 2026 13:06:03 +0200 Subject: [PATCH] RMB-1052: ERROR: 42501: permission denied for "CREATE SCHEMA IF NOT EXISTS" https://folio-org.atlassian.net/browse/RMB-1052 As a sysop I need to remove the CREATE privilege for the database from the postgres role an RMB based module uses (principle of least privileges). The CREATE privilege for the database is not needed after the tenant-module schema has been created. However, when upgrading a tenant to a new module version RMB executes `CREATE SCHEMA IF NOT EXISTS` that fails if the privilege has been removed, even if the schema exists: ``` ERROR: 42501: permission denied for database postgres ``` Fix: Skip that `CREATE SCHEMA` statement if the schema already exists. --- .../src/main/resources/templates/db_scripts/create.ftl | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/domain-models-runtime/src/main/resources/templates/db_scripts/create.ftl b/domain-models-runtime/src/main/resources/templates/db_scripts/create.ftl index 93510715a..ea7a0f2ab 100644 --- a/domain-models-runtime/src/main/resources/templates/db_scripts/create.ftl +++ b/domain-models-runtime/src/main/resources/templates/db_scripts/create.ftl @@ -12,7 +12,14 @@ BEGIN GRANT ${myuniversity}_${mymodule} TO CURRENT_USER; END $$; -CREATE SCHEMA IF NOT EXISTS ${myuniversity}_${mymodule} AUTHORIZATION ${myuniversity}_${mymodule}; +DO $$ +BEGIN + PERFORM FROM information_schema.schemata WHERE schema_name = '${myuniversity}_${mymodule}'; + IF FOUND THEN + RETURN; + END IF; + CREATE SCHEMA IF NOT EXISTS ${myuniversity}_${mymodule} AUTHORIZATION ${myuniversity}_${mymodule}; +END $$;