Skip to content

Commit 8582003

Browse files
samrosesamrose
authored
feat: turn pg_graphql off by default for new projects (#2119)
* feat: pg_graphql off by default * fix: no down migration * fix: cli pg_grapqhl off by default * fix: regress test order by * chore: bump version to release
1 parent 942d095 commit 8582003

11 files changed

Lines changed: 287 additions & 205 deletions

‎.github/workflows/cli-release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -330,7 +330,7 @@ jobs:
330330
./bin/psql -p 54322 -h 127.0.0.1 -U supabase_admin -d postgres -v ON_ERROR_STOP=1 -c "\dx" | tee extensions.log
331331
332332
# Check for required extensions
333-
for ext in pg_graphql pgcrypto uuid-ossp supabase_vault; do
333+
for ext in pgcrypto uuid-ossp supabase_vault; do
334334
if ! grep -q "$ext" extensions.log; then
335335
echo "Required extension $ext not found"
336336
exit 1

‎ansible/vars.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ postgres_major:
1010

1111
# Full version strings for each major version
1212
postgres_release:
13-
postgresorioledb-17: "17.6.0.067-orioledb"
14-
postgres17: "17.6.1.110"
15-
postgres15: "15.14.1.110"
13+
postgresorioledb-17: "17.6.0.068-orioledb"
14+
postgres17: "17.6.1.111"
15+
postgres15: "15.14.1.111"
1616

1717
# Non Postgres Extensions
1818
pgbouncer_release: 1.25.1

‎migrations/db/migrations/20260421000000_pg_graphql-off-by-default.sql‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-- migrate:up
2+
drop extension if exists pg_graphql;
3+
4+
-- migrate:down

‎migrations/db/migrations/20260421000001_rescope_pg_graphql_access_trigger.sql‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
-- migrate:up
2+
3+
create or replace function extensions.grant_pg_graphql_access()
4+
returns event_trigger
5+
language plpgsql
6+
as $func$
7+
begin
8+
if not exists (
9+
select 1
10+
from pg_event_trigger_ddl_commands() ev
11+
join pg_catalog.pg_extension e on ev.objid = e.oid
12+
where e.extname = 'pg_graphql'
13+
) then
14+
return;
15+
end if;
16+
17+
drop function if exists graphql_public.graphql;
18+
create or replace function graphql_public.graphql(
19+
"operationName" text default null,
20+
query text default null,
21+
variables jsonb default null,
22+
extensions jsonb default null
23+
)
24+
returns jsonb
25+
language sql
26+
as $$
27+
select graphql.resolve(
28+
query := query,
29+
variables := coalesce(variables, '{}'),
30+
"operationName" := "operationName",
31+
extensions := extensions
32+
);
33+
$$;
34+
35+
-- Attach the wrapper to the extension so DROP EXTENSION cascades to it,
36+
-- which in turn triggers set_graphql_placeholder to reinstall the "not enabled" stub.
37+
alter extension pg_graphql add function graphql_public.graphql(text, text, jsonb, jsonb);
38+
39+
grant usage on schema graphql to postgres, anon, authenticated, service_role;
40+
grant execute on function graphql.resolve to postgres, anon, authenticated, service_role;
41+
grant usage on schema graphql to postgres with grant option;
42+
grant usage on schema graphql_public to postgres with grant option;
43+
end;
44+
$func$;
45+
46+
drop event trigger if exists issue_pg_graphql_access;
47+
create event trigger issue_pg_graphql_access
48+
on ddl_command_end
49+
when tag in ('CREATE EXTENSION')
50+
execute procedure extensions.grant_pg_graphql_access();
51+
52+
-- migrate:down

‎migrations/schema-15.sql‎

Lines changed: 71 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -74,20 +74,6 @@ CREATE SCHEMA storage;
7474
CREATE SCHEMA vault;
7575

7676

77-
--
78-
-- Name: pg_graphql; Type: EXTENSION; Schema: -; Owner: -
79-
--
80-
81-
CREATE EXTENSION IF NOT EXISTS pg_graphql WITH SCHEMA graphql;
82-
83-
84-
--
85-
-- Name: EXTENSION pg_graphql; Type: COMMENT; Schema: -; Owner: -
86-
--
87-
88-
COMMENT ON EXTENSION pg_graphql IS 'pg_graphql: GraphQL support';
89-
90-
9177
--
9278
-- Name: pg_stat_statements; Type: EXTENSION; Schema: -; Owner: -
9379
--
@@ -228,54 +214,43 @@ COMMENT ON FUNCTION extensions.grant_pg_cron_access() IS 'Grants access to pg_cr
228214
CREATE FUNCTION extensions.grant_pg_graphql_access() RETURNS event_trigger
229215
LANGUAGE plpgsql
230216
AS $_$
231-
DECLARE
232-
func_is_graphql_resolve bool;
233-
BEGIN
234-
func_is_graphql_resolve = (
235-
SELECT n.proname = 'resolve'
236-
FROM pg_event_trigger_ddl_commands() AS ev
237-
LEFT JOIN pg_catalog.pg_proc AS n
238-
ON ev.objid = n.oid
239-
);
240-
241-
IF func_is_graphql_resolve
242-
THEN
243-
-- Update public wrapper to pass all arguments through to the pg_graphql resolve func
244-
DROP FUNCTION IF EXISTS graphql_public.graphql;
245-
create or replace function graphql_public.graphql(
246-
"operationName" text default null,
247-
query text default null,
248-
variables jsonb default null,
249-
extensions jsonb default null
250-
)
251-
returns jsonb
252-
language sql
253-
as $$
254-
select graphql.resolve(
255-
query := query,
256-
variables := coalesce(variables, '{}'),
257-
"operationName" := "operationName",
258-
extensions := extensions
259-
);
260-
$$;
261-
262-
-- This hook executes when `graphql.resolve` is created. That is not necessarily the last
263-
-- function in the extension so we need to grant permissions on existing entities AND
264-
-- update default permissions to any others that are created after `graphql.resolve`
265-
grant usage on schema graphql to postgres, anon, authenticated, service_role;
266-
grant select on all tables in schema graphql to postgres, anon, authenticated, service_role;
267-
grant execute on all functions in schema graphql to postgres, anon, authenticated, service_role;
268-
grant all on all sequences in schema graphql to postgres, anon, authenticated, service_role;
269-
alter default privileges in schema graphql grant all on tables to postgres, anon, authenticated, service_role;
270-
alter default privileges in schema graphql grant all on functions to postgres, anon, authenticated, service_role;
271-
alter default privileges in schema graphql grant all on sequences to postgres, anon, authenticated, service_role;
272-
273-
-- Allow postgres role to allow granting usage on graphql and graphql_public schemas to custom roles
274-
grant usage on schema graphql_public to postgres with grant option;
275-
grant usage on schema graphql to postgres with grant option;
276-
END IF;
277-
278-
END;
217+
begin
218+
if not exists (
219+
select 1
220+
from pg_event_trigger_ddl_commands() ev
221+
join pg_catalog.pg_extension e on ev.objid = e.oid
222+
where e.extname = 'pg_graphql'
223+
) then
224+
return;
225+
end if;
226+
227+
drop function if exists graphql_public.graphql;
228+
create or replace function graphql_public.graphql(
229+
"operationName" text default null,
230+
query text default null,
231+
variables jsonb default null,
232+
extensions jsonb default null
233+
)
234+
returns jsonb
235+
language sql
236+
as $$
237+
select graphql.resolve(
238+
query := query,
239+
variables := coalesce(variables, '{}'),
240+
"operationName" := "operationName",
241+
extensions := extensions
242+
);
243+
$$;
244+
245+
-- Attach the wrapper to the extension so DROP EXTENSION cascades to it,
246+
-- which in turn triggers set_graphql_placeholder to reinstall the "not enabled" stub.
247+
alter extension pg_graphql add function graphql_public.graphql(text, text, jsonb, jsonb);
248+
249+
grant usage on schema graphql to postgres, anon, authenticated, service_role;
250+
grant execute on function graphql.resolve to postgres, anon, authenticated, service_role;
251+
grant usage on schema graphql to postgres with grant option;
252+
grant usage on schema graphql_public to postgres with grant option;
253+
end;
279254
$_$;
280255

281256

@@ -472,6 +447,39 @@ $_$;
472447
COMMENT ON FUNCTION extensions.set_graphql_placeholder() IS 'Reintroduces placeholder function for graphql_public.graphql';
473448

474449

450+
--
451+
-- Name: graphql(text, text, jsonb, jsonb); Type: FUNCTION; Schema: graphql_public; Owner: -
452+
--
453+
454+
CREATE FUNCTION graphql_public.graphql("operationName" text DEFAULT NULL::text, query text DEFAULT NULL::text, variables jsonb DEFAULT NULL::jsonb, extensions jsonb DEFAULT NULL::jsonb) RETURNS jsonb
455+
LANGUAGE plpgsql
456+
AS $$
457+
DECLARE
458+
server_version float;
459+
BEGIN
460+
server_version = (SELECT (SPLIT_PART((select version()), ' ', 2))::float);
461+
462+
IF server_version >= 14 THEN
463+
RETURN jsonb_build_object(
464+
'errors', jsonb_build_array(
465+
jsonb_build_object(
466+
'message', 'pg_graphql extension is not enabled.'
467+
)
468+
)
469+
);
470+
ELSE
471+
RETURN jsonb_build_object(
472+
'errors', jsonb_build_array(
473+
jsonb_build_object(
474+
'message', 'pg_graphql is only available on projects running Postgres 14 onwards.'
475+
)
476+
)
477+
);
478+
END IF;
479+
END;
480+
$$;
481+
482+
475483
--
476484
-- Name: get_auth(text); Type: FUNCTION; Schema: pgbouncer; Owner: -
477485
--
@@ -776,7 +784,7 @@ CREATE EVENT TRIGGER issue_pg_cron_access ON ddl_command_end
776784
--
777785

778786
CREATE EVENT TRIGGER issue_pg_graphql_access ON ddl_command_end
779-
WHEN TAG IN ('CREATE FUNCTION')
787+
WHEN TAG IN ('CREATE EXTENSION')
780788
EXECUTE FUNCTION extensions.grant_pg_graphql_access();
781789

782790

0 commit comments

Comments
 (0)