Allow TAM chunk creation as non-owner #7913
Open
+140
−2
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
erimatnor
force-pushed
the
hypercore-fix-create-chunk-as-non-owner
branch
3 times, most recently
from
47545fd to
f4f6474
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #7913 +/- ##
==========================================
+ Coverage 80.06% 81.92% +1.85%
==========================================
Files 190 249 +59
Lines 37181 46147 +8966
Branches 9450 11569 +2119
==========================================
+ Hits 29770 37806 +8036
- Misses 2997 3784 +787
- Partials 4414 4557 +143 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
erimatnor
force-pushed
the
hypercore-fix-create-chunk-as-non-owner
branch
from
f4f6474 to
5fb5bef
Compare
When using Hypercore TAM on the hypertable, new chunks are created as hypercore chunks, including the compressed relation. This means that the compressed relation is created as the inserting user. However, if the inserting user is not the table owner, this operation failed. The reason it failed was because some toast settings were changed on the compressed chunk during its creation without switching to a role with proper permissions. This is easily fixed by extending the section of code that is executed under the permissive role.
erimatnor
force-pushed
the
hypercore-fix-create-chunk-as-non-owner
branch
from
5fb5bef to
b41204d
Compare
mkindahl
reviewed
Apr 7, 2025
| @@ -82,6 +82,7 @@ if mkdir ${TEST_OUTPUT_DIR}/.pg_init 2>/dev/null; then | |||
| ALTER USER ${TEST_ROLE_SUPERUSER} WITH SUPERUSER; | |||
| ALTER USER ${TEST_ROLE_CLUSTER_SUPERUSER} WITH SUPERUSER; | |||
| ALTER USER ${TEST_ROLE_DEFAULT_PERM_USER} WITH CREATEROLE; | |||
There was a problem hiding this comment.
AFAICT, the idea with the "default permissions user" is to have something that cannot do to much and test with that. If you allow it to create new roles, it is not a "default permission user". Can't you use a role with superuser privileges to create new roles?
Comment on lines
+1143
to
+1153
| -- An insert should create a new hypercore chunk, including the compressed chunk | ||
| insert into conditions values ('2024-01-02', 'school', 99.5); | ||
| select chunk, amname, cs.compress_relid | ||
| from show_chunks('conditions') as chunk | ||
| join pg_class on (pg_class.oid = chunk) | ||
| join pg_am on (relam = pg_am.oid) | ||
| join _timescaledb_catalog.compression_settings cs on (cs.relid = chunk); | ||
| chunk | amname | compress_relid | ||
| ------------------------------------------+-----------+-------------------------------------------------- | ||
| _timescaledb_internal._hyper_12_49_chunk | hypercore | _timescaledb_internal.compress_hyper_13_50_chunk | ||
| (1 row) |
There was a problem hiding this comment.
Can you also show the owner in result set (for both the compressed and non-compressed chunk)? I can imagine situations where you by mistake change the code so that inserts work well but the owner is not correct.
fabriziomello
approved these changes
Apr 7, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When using Hypercore TAM on the hypertable, new chunks are created as hypercore chunks, including the compressed relation. This means that the compressed relation is created as the inserting user. However, if the inserting user is not the table owner, this operation failed.
The reason it failed was because some toast settings were changed on the compressed chunk during its creation without switching to a role with proper permissions. This is easily fixed by extending the section of code that is executed under the permissive role.