Cleanup users and roles in graph_table_rls test

This test leaves behind the roles and users it creates.
002_pg_upgrade test dumps and restore the regression when
PG_TEST_EXTRA contains regress_dump_restore.  The global objects such
as users and roles are not dumped by pg_dump.  But it still dumps the
policies associated with users, and commands to set the ownership.
Restoring these policies and the ownerships fails since the users and
roles do not exist.  To fix this failure we could use --no-owner, but
it does not exclude the policy objects associated with users.  Hence
drop the users, roles and policies that depend upon them at the end of
the test.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Reported-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://www.postgresql.org/message-id/flat/a855795d-e697-4fa5-8698-d20122126567@eisentraut.org

diff --git a/src/test/regress/expected/graph_table_rls.out b/src/test/regress/expected/graph_table_rls.out
index 5cbd69dab7b468a5bec25a5069881bc27cf34cd0..0e719c7ebd7fc7c2a205727c3312f2b0d7d38dee 100644 (file)
--- a/src/test/regress/expected/graph_table_rls.out
+++ b/src/test/regress/expected/graph_table_rls.out
@@ -771,4 +771,19 @@ ERROR:  query would be affected by row-level security policy for table "document
 HINT:  To disable the policy for the table's owner, use ALTER TABLE NO FORCE ROW LEVEL SECURITY.
 -- Clean up
 DEALLOCATE graph_rls_query;
--- leave objects behind for pg_upgrade/pg_dump tests
+-- leave as many objects behind for pg_upgrade/pg_dump tests as possible. The
+-- pg_dump test only dumps the regression database, not the global objects like
+-- users and roles. Reassign ownership of all objects to superuser and drop
+-- users and roles created in this test. Policies can not be reassigned, so drop
+-- them explicitly.
+RESET SESSION AUTHORIZATION;
+REASSIGN OWNED BY regress_graph_rls_alice TO current_user;
+DROP USER regress_graph_rls_alice;
+DROP USER regress_graph_rls_bob;
+DROP USER regress_graph_rls_carol;
+DROP USER regress_graph_rls_dave;
+DROP USER regress_graph_rls_exempt_user;
+DROP POLICY p3 ON document_people;
+DROP POLICY p4 ON document_people;
+DROP ROLE regress_graph_rls_group1;
+DROP ROLE regress_graph_rls_group2;

diff --git a/src/test/regress/sql/graph_table_rls.sql b/src/test/regress/sql/graph_table_rls.sql
index 044bc27ce9f480adbea0ea85873c13afd23b6a12..5837eac402e6e73353466ce6dfecfe8a95ad0610 100644 (file)
--- a/src/test/regress/sql/graph_table_rls.sql
+++ b/src/test/regress/sql/graph_table_rls.sql
@@ -360,4 +360,19 @@ EXECUTE graph_rls_query; -- error
 -- Clean up
 DEALLOCATE graph_rls_query;
 
--- leave objects behind for pg_upgrade/pg_dump tests
+-- leave as many objects behind for pg_upgrade/pg_dump tests as possible. The
+-- pg_dump test only dumps the regression database, not the global objects like
+-- users and roles. Reassign ownership of all objects to superuser and drop
+-- users and roles created in this test. Policies can not be reassigned, so drop
+-- them explicitly.
+RESET SESSION AUTHORIZATION;
+REASSIGN OWNED BY regress_graph_rls_alice TO current_user;
+DROP USER regress_graph_rls_alice;
+DROP USER regress_graph_rls_bob;
+DROP USER regress_graph_rls_carol;
+DROP USER regress_graph_rls_dave;
+DROP USER regress_graph_rls_exempt_user;
+DROP POLICY p3 ON document_people;
+DROP POLICY p4 ON document_people;
+DROP ROLE regress_graph_rls_group1;
+DROP ROLE regress_graph_rls_group2;