Skip to content

Commit e653fdd

Browse files
steve-chavezsteve-chavez
committed
test: regression for storage schema
tests the following aspects: * storage schema owner * storage tables with owners and rls policies * storage functions with owners * storage indexes with owners * roles which have USAGE and CREATE on the storage schema * attributes of the supabase_storage_admin role
1 parent f13a462 commit e653fdd

File tree

2 files changed

+295
-0
lines changed

2 files changed

+295
-0
lines changed

‎nix/tests/expected/storage.out

+174
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
-- storage schema owner
2+
select
3+
n.nspname as schema_name,
4+
r.rolname as owner
5+
from
6+
pg_namespace n
7+
join
8+
pg_roles r on n.nspowner = r.oid
9+
where
10+
n.nspname = 'storage';
11+
schema_name | owner
12+
-------------+----------------
13+
storage | supabase_admin
14+
(1 row)
15+
16+
-- attributes of the supabase_storage_admin
17+
select
18+
rolcreaterole ,
19+
rolcanlogin ,
20+
rolsuper ,
21+
rolinherit ,
22+
rolcreatedb ,
23+
rolreplication ,
24+
rolconnlimit ,
25+
rolbypassrls ,
26+
rolvaliduntil
27+
from pg_roles r
28+
where r.rolname = 'supabase_storage_admin';
29+
rolcreaterole | rolcanlogin | rolsuper | rolinherit | rolcreatedb | rolreplication | rolconnlimit | rolbypassrls | rolvaliduntil
30+
---------------+-------------+----------+------------+-------------+----------------+--------------+--------------+---------------
31+
t | t | f | f | f | f | -1 | f |
32+
(1 row)
33+
34+
select
35+
rolconfig
36+
from pg_roles r
37+
where r.rolname = 'supabase_storage_admin';
38+
rolconfig
39+
------------------------------------------
40+
{search_path=storage,log_statement=none}
41+
(1 row)
42+
43+
-- storage schema tables with owners and rls policies
44+
select
45+
ns.nspname as schema_name,
46+
c.relname as table_name,
47+
r.rolname as owner,
48+
c.relrowsecurity as rls_enabled,
49+
string_agg(p.polname, ', ' order by p.polname) as rls_policies
50+
from
51+
pg_class c
52+
join
53+
pg_namespace ns on c.relnamespace = ns.oid
54+
join
55+
pg_roles r on c.relowner = r.oid
56+
left join
57+
pg_policy p on p.polrelid = c.oid
58+
where
59+
ns.nspname = 'storage'
60+
and c.relkind = 'r'
61+
group by
62+
ns.nspname, c.relname, r.rolname, c.relrowsecurity
63+
order by
64+
c.relname;
65+
schema_name | table_name | owner | rls_enabled | rls_policies
66+
-------------+------------+------------------------+-------------+--------------
67+
storage | buckets | supabase_storage_admin | f |
68+
storage | migrations | supabase_storage_admin | f |
69+
storage | objects | supabase_storage_admin | t |
70+
(3 rows)
71+
72+
-- storage indexes with owners
73+
select
74+
ns.nspname as table_schema,
75+
t.relname as table_name,
76+
i.relname as index_name,
77+
r.rolname as index_owner
78+
from
79+
pg_class t
80+
join
81+
pg_namespace ns on t.relnamespace = ns.oid
82+
join
83+
pg_index idx on t.oid = idx.indrelid
84+
join
85+
pg_class i on idx.indexrelid = i.oid
86+
join
87+
pg_roles r on i.relowner = r.oid
88+
where
89+
ns.nspname = 'storage'
90+
order by
91+
t.relname, i.relname;
92+
table_schema | table_name | index_name | index_owner
93+
--------------+------------+---------------------+------------------------
94+
storage | buckets | bname | supabase_storage_admin
95+
storage | buckets | buckets_pkey | supabase_storage_admin
96+
storage | migrations | migrations_name_key | supabase_storage_admin
97+
storage | migrations | migrations_pkey | supabase_storage_admin
98+
storage | objects | bucketid_objname | supabase_storage_admin
99+
storage | objects | name_prefix_search | supabase_storage_admin
100+
storage | objects | objects_pkey | supabase_storage_admin
101+
(7 rows)
102+
103+
-- storage schema functions with owners
104+
select
105+
n.nspname as schema_name,
106+
p.proname as function_name,
107+
r.rolname as owner
108+
from
109+
pg_proc p
110+
join
111+
pg_namespace n on p.pronamespace = n.oid
112+
join
113+
pg_roles r on p.proowner = r.oid
114+
where
115+
n.nspname = 'storage'
116+
order by
117+
p.proname;
118+
schema_name | function_name | owner
119+
-------------+---------------+------------------------
120+
storage | extension | supabase_storage_admin
121+
storage | filename | supabase_storage_admin
122+
storage | foldername | supabase_storage_admin
123+
storage | search | supabase_storage_admin
124+
(4 rows)
125+
126+
-- roles which have USAGE on the storage schema
127+
select
128+
n.nspname as schema_name,
129+
r.rolname as role_name,
130+
a.privilege_type
131+
from
132+
pg_namespace n
133+
cross join lateral aclexplode(n.nspacl) as a
134+
join
135+
pg_roles r on a.grantee = r.oid
136+
where
137+
n.nspname = 'storage'
138+
and a.privilege_type = 'USAGE'
139+
order by
140+
r.rolname;
141+
schema_name | role_name | privilege_type
142+
-------------+------------------------+----------------
143+
storage | anon | USAGE
144+
storage | authenticated | USAGE
145+
storage | dashboard_user | USAGE
146+
storage | postgres | USAGE
147+
storage | service_role | USAGE
148+
storage | supabase_admin | USAGE
149+
storage | supabase_storage_admin | USAGE
150+
(7 rows)
151+
152+
-- roles which have CREATE on the storage schema
153+
select
154+
n.nspname as schema_name,
155+
r.rolname as role_name,
156+
a.privilege_type
157+
from
158+
pg_namespace n
159+
cross join lateral aclexplode(n.nspacl) as a
160+
join
161+
pg_roles r on a.grantee = r.oid
162+
where
163+
n.nspname = 'storage'
164+
and a.privilege_type = 'CREATE'
165+
order by
166+
r.rolname;
167+
schema_name | role_name | privilege_type
168+
-------------+------------------------+----------------
169+
storage | dashboard_user | CREATE
170+
storage | postgres | CREATE
171+
storage | supabase_admin | CREATE
172+
storage | supabase_storage_admin | CREATE
173+
(4 rows)
174+

‎nix/tests/sql/storage.sql

+121
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
-- storage schema owner
2+
select
3+
n.nspname as schema_name,
4+
r.rolname as owner
5+
from
6+
pg_namespace n
7+
join
8+
pg_roles r on n.nspowner = r.oid
9+
where
10+
n.nspname = 'storage';
11+
12+
-- attributes of the supabase_storage_admin
13+
select
14+
rolcreaterole ,
15+
rolcanlogin ,
16+
rolsuper ,
17+
rolinherit ,
18+
rolcreatedb ,
19+
rolreplication ,
20+
rolconnlimit ,
21+
rolbypassrls ,
22+
rolvaliduntil
23+
from pg_roles r
24+
where r.rolname = 'supabase_storage_admin';
25+
26+
select
27+
rolconfig
28+
from pg_roles r
29+
where r.rolname = 'supabase_storage_admin';
30+
31+
-- storage schema tables with owners and rls policies
32+
select
33+
ns.nspname as schema_name,
34+
c.relname as table_name,
35+
r.rolname as owner,
36+
c.relrowsecurity as rls_enabled,
37+
string_agg(p.polname, ', ' order by p.polname) as rls_policies
38+
from
39+
pg_class c
40+
join
41+
pg_namespace ns on c.relnamespace = ns.oid
42+
join
43+
pg_roles r on c.relowner = r.oid
44+
left join
45+
pg_policy p on p.polrelid = c.oid
46+
where
47+
ns.nspname = 'storage'
48+
and c.relkind = 'r'
49+
group by
50+
ns.nspname, c.relname, r.rolname, c.relrowsecurity
51+
order by
52+
c.relname;
53+
54+
-- storage indexes with owners
55+
select
56+
ns.nspname as table_schema,
57+
t.relname as table_name,
58+
i.relname as index_name,
59+
r.rolname as index_owner
60+
from
61+
pg_class t
62+
join
63+
pg_namespace ns on t.relnamespace = ns.oid
64+
join
65+
pg_index idx on t.oid = idx.indrelid
66+
join
67+
pg_class i on idx.indexrelid = i.oid
68+
join
69+
pg_roles r on i.relowner = r.oid
70+
where
71+
ns.nspname = 'storage'
72+
order by
73+
t.relname, i.relname;
74+
75+
-- storage schema functions with owners
76+
select
77+
n.nspname as schema_name,
78+
p.proname as function_name,
79+
r.rolname as owner
80+
from
81+
pg_proc p
82+
join
83+
pg_namespace n on p.pronamespace = n.oid
84+
join
85+
pg_roles r on p.proowner = r.oid
86+
where
87+
n.nspname = 'storage'
88+
order by
89+
p.proname;
90+
91+
-- roles which have USAGE on the storage schema
92+
select
93+
n.nspname as schema_name,
94+
r.rolname as role_name,
95+
a.privilege_type
96+
from
97+
pg_namespace n
98+
cross join lateral aclexplode(n.nspacl) as a
99+
join
100+
pg_roles r on a.grantee = r.oid
101+
where
102+
n.nspname = 'storage'
103+
and a.privilege_type = 'USAGE'
104+
order by
105+
r.rolname;
106+
107+
-- roles which have CREATE on the storage schema
108+
select
109+
n.nspname as schema_name,
110+
r.rolname as role_name,
111+
a.privilege_type
112+
from
113+
pg_namespace n
114+
cross join lateral aclexplode(n.nspacl) as a
115+
join
116+
pg_roles r on a.grantee = r.oid
117+
where
118+
n.nspname = 'storage'
119+
and a.privilege_type = 'CREATE'
120+
order by
121+
r.rolname;

0 commit comments

Comments
 (0)