supabase-postgres.git / summary / log / commit / refs
commit 01978ef405269c1db5d35fb8210e1e7df1f558f2
Author: Bobbie Soedirgo <31685197+soedirgo@users.noreply.github.com>
Commit: GitHub <noreply@github.com>
Date: Wed Mar 19 08:45:12 2025 +0000
feat: reland vault w/o pgsodium (#1452)
* Reapply "feat: vault sans pgsodium"
This reverts commit 447f4492258babcc57ca0307588814016835d24e.
* chore: update schema snapshots
* chore: print regress diffs for easier debugging
* chore: remove pgsodium priv checks
* fix: move it out of if else
* chore: bump version
* chore: bump version
.../pg_upgrade_scripts/complete.sh | 37 ++++++++++
ansible/files/postgresql_config/postgresql.conf.j2 | 2 +-
.../supabase_vault/after-create.sql | 3 +
ansible/files/sodium_extension.sql | 6 --
ansible/tasks/test-image.yml | 23 ++++++-
ansible/vars.yml | 4 +-
ebssurrogate/files/unit-tests/unit-test-01.sql | 10 +--
flake.nix | 78 ++++++++++++----------
migrations/schema-15.sql | 67 -------------------
migrations/schema-orioledb-17.sql | 67 -------------------
migrations/schema.sql | 67 -------------------
migrations/tests/database/privs.sql | 4 --
nix/ext/vault.nix | 13 ++--
nix/tests/expected/security.out | 4 +-
nix/tests/expected/z_15_ext_interface.out | 16 ++++-
nix/tests/expected/z_17_ext_interface.out | 16 ++++-
nix/tests/postgresql.conf.in | 3 +-
17 files changed, 149 insertions(+), 271 deletions(-)
diff --git a/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh b/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh
index 515c490f..cd6c1f06 100755
--- a/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh
+++ b/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh
@@ -152,6 +152,43 @@ EOF
run_sql -c "update pg_extension set extowner = 'postgres'::regrole where extname = 'pgmq';"
fi
+ # Patch to handle upgrading to pgsodium-less Vault
+ REENCRYPT_VAULT_SECRETS_QUERY=$(cat <<EOF
+ DO \$\$
+ BEGIN
+ IF EXISTS (SELECT FROM pg_available_extension_versions WHERE name = 'supabase_vault' AND version = '0.3.0')
+ AND EXISTS (SELECT FROM pg_extension WHERE extname = 'supabase_vault')
+ THEN
+ IF (SELECT extversion FROM pg_extension WHERE extname = 'supabase_vault') != '0.2.8' THEN
+ GRANT USAGE ON SCHEMA vault TO postgres WITH GRANT OPTION;
+ GRANT SELECT, DELETE ON vault.secrets, vault.decrypted_secrets TO postgres WITH GRANT OPTION;
+ GRANT EXECUTE ON FUNCTION vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt TO postgres WITH GRANT OPTION;
+ END IF;
+ -- Do an explicit IF EXISTS check to avoid referencing pgsodium objects if the project already migrated away from using pgsodium.
+ IF EXISTS (SELECT FROM vault.secrets WHERE key_id IS NOT NULL) THEN
+ UPDATE vault.secrets s
+ SET
+ secret = encode(
+ vault._crypto_aead_det_encrypt(
+ message := pgsodium.crypto_aead_det_decrypt(decode(s.secret, 'base64'), convert_to(s.id || s.description || s.created_at || s.updated_at, 'utf8'), s.key_id, s.nonce),
+ additional := convert_to(s.id::text, 'utf8'),
+ key_id := 0,
+ context := 'pgsodium'::bytea,
+ nonce := s.nonce
+ ),
+ 'base64'
+ ),
+ key_id = NULL
+ WHERE
+ key_id IS NOT NULL;
+ END IF;
+ END IF;
+ END
+ \$\$;
+EOF
+ )
+ run_sql -c "$REENCRYPT_VAULT_SECRETS_QUERY"
+
run_sql -c "grant pg_read_all_data, pg_signal_backend to postgres"
}
diff --git a/ansible/files/postgresql_config/postgresql.conf.j2 b/ansible/files/postgresql_config/postgresql.conf.j2
index 6d2df607..5d423706 100644
--- a/ansible/files/postgresql_config/postgresql.conf.j2
+++ b/ansible/files/postgresql_config/postgresql.conf.j2
@@ -688,7 +688,7 @@ default_text_search_config = 'pg_catalog.english'
#local_preload_libraries = ''
#session_preload_libraries = ''
-shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter' # (change requires restart)
+shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter, supabase_vault' # (change requires restart)
jit_provider = 'llvmjit' # JIT library to use
# - Other Defaults -
diff --git a/ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql b/ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql
new file mode 100644
index 00000000..7ca37637
--- /dev/null
+++ b/ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql
@@ -0,0 +1,3 @@
+grant usage on schema vault to postgres with grant option;
+grant select, delete on vault.secrets, vault.decrypted_secrets to postgres with grant option;
+grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to postgres with grant option;
diff --git a/ansible/files/sodium_extension.sql b/ansible/files/sodium_extension.sql
deleted file mode 100644
index a19cabf7..00000000
--- a/ansible/files/sodium_extension.sql
+++ /dev/null
@@ -1,6 +0,0 @@
-create schema if not exists pgsodium;
-create extension if not exists pgsodium with schema pgsodium cascade;
-
-grant pgsodium_keyiduser to postgres with admin option;
-grant pgsodium_keyholder to postgres with admin option;
-grant pgsodium_keymaker to postgres with admin option;
diff --git a/ansible/tasks/test-image.yml b/ansible/tasks/test-image.yml
index 9a8d4fa2..c680ce68 100644
--- a/ansible/tasks/test-image.yml
+++ b/ansible/tasks/test-image.yml
@@ -11,17 +11,34 @@
# cmd: sed -i.bak -e "s/pg_net,\ pgsodium,\ timescaledb/pg_net,\ timescaledb/g" -e "s/pgsodium.getkey_script=/#pgsodium.getkey_script=/g" /etc/postgresql/postgresql.conf
# when: debpkg_mode or stage2_nix
-- name: Temporarily disable PG Sodium references in config
+- name: Temporarily disable PG Sodium and Supabase Vault references in config
become: yes
become_user: postgres
shell:
cmd: >
- sed -i.bak
- -e 's/\(shared_preload_libraries = '\''.*\)pgsodium,\(.*'\''\)/\1\2/'
+ sed -i.bak
+ -e 's/\(shared_preload_libraries = '\''.*\)pgsodium,\(.*'\''\)/\1\2/'
+ -e 's/\(shared_preload_libraries = '\''.*\)supabase_vault,\(.*'\''\)/\1\2/'
+ -e 's/\(shared_preload_libraries = '\''.*\), *supabase_vault'\''/\1'\''/'
-e 's/pgsodium.getkey_script=/#pgsodium.getkey_script=/'
/etc/postgresql/postgresql.conf
when: debpkg_mode or stage2_nix
+- name: Verify pgsodium and vault removal from config
+ become: yes
+ become_user: postgres
+ shell:
+ cmd: |
+ FOUND=$(grep -E "shared_preload_libraries.*pgsodium|shared_preload_libraries.*supabase_vault|^pgsodium\.getkey_script" /etc/postgresql/postgresql.conf)
+ if [ ! -z "$FOUND" ]; then
+ echo "Found unremoved references:"
+ echo "$FOUND"
+ exit 1
+ fi
+ register: verify_result
+ failed_when: verify_result.rc != 0
+ when: debpkg_mode or stage2_nix
+
- name: Start Postgres Database to load all extensions.
become: yes
become_user: postgres
diff --git a/ansible/vars.yml b/ansible/vars.yml
index d8e963b7..88fe8674 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -8,8 +8,8 @@ postgres_major:
# Full version strings for each major version
postgres_release:
- postgresorioledb-17: "17.0.1.049-orioledb"
- postgres15: "15.8.1.056"
+ postgresorioledb-17: "17.0.1.050-orioledb"
+ postgres15: "15.8.1.057"
# Non Postgres Extensions
pgbouncer_release: "1.19.0"
diff --git a/ebssurrogate/files/unit-tests/unit-test-01.sql b/ebssurrogate/files/unit-tests/unit-test-01.sql
index f3d47459..c466af12 100644
--- a/ebssurrogate/files/unit-tests/unit-test-01.sql
+++ b/ebssurrogate/files/unit-tests/unit-test-01.sql
@@ -17,7 +17,6 @@ BEGIN
extension_array := ARRAY[
'plpgsql',
'pg_stat_statements',
- 'pgsodium',
'pgtap',
'pg_graphql',
'pgcrypto',
@@ -30,7 +29,6 @@ BEGIN
extension_array := ARRAY[
'plpgsql',
'pg_stat_statements',
- 'pgsodium',
'pgtap',
'pg_graphql',
'pgcrypto',
@@ -44,7 +42,7 @@ BEGIN
PERFORM set_config('myapp.extensions', array_to_string(extension_array, ','), false);
END $$;
-SELECT plan(8);
+SELECT no_plan();
SELECT extensions_are(
string_to_array(current_setting('myapp.extensions'), ',')::text[]
@@ -56,9 +54,5 @@ SELECT has_schema('pg_catalog');
SELECT has_schema('information_schema');
SELECT has_schema('public');
-SELECT function_privs_are('pgsodium', 'crypto_aead_det_decrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
-SELECT function_privs_are('pgsodium', 'crypto_aead_det_encrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
-SELECT function_privs_are('pgsodium', 'crypto_aead_det_keygen', array[]::text[], 'service_role', array['EXECUTE']);
-
SELECT * FROM finish();
-ROLLBACK;
\ No newline at end of file
+ROLLBACK;
diff --git a/flake.nix b/flake.nix
index ba7ad70e..dadc5525 100644
--- a/flake.nix
+++ b/flake.nix
@@ -606,42 +606,49 @@
sqlTests = ./nix/tests/smoke;
pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP;
pg_regress = basePackages.pg_regress;
- getkey-script = pkgs.writeScriptBin "pgsodium-getkey" ''
- #!${pkgs.bash}/bin/bash
- set -euo pipefail
-
- TMPDIR_BASE=$(mktemp -d)
-
- if [[ "$(uname)" == "Darwin" ]]; then
- KEY_DIR="/private/tmp/pgsodium"
- else
- KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
- fi
- KEY_FILE="$KEY_DIR/pgsodium.key"
-
- if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
- echo "Error: Could not create key directory $KEY_DIR" >&2
- exit 1
- fi
- chmod 1777 "$KEY_DIR"
-
- if [[ ! -f "$KEY_FILE" ]]; then
- if ! (dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -A n -t x1 | tr -d ' \n' > "$KEY_FILE"); then
- if ! (openssl rand -hex 32 > "$KEY_FILE"); then
- echo "00000000000000000000000000000000" > "$KEY_FILE"
- echo "Warning: Using fallback key" >&2
+ getkey-script = pkgs.stdenv.mkDerivation {
+ name = "pgsodium-getkey";
+ buildCommand = ''
+ mkdir -p $out/bin
+ cat > $out/bin/pgsodium-getkey << 'EOF'
+ #!${pkgs.bash}/bin/bash
+ set -euo pipefail
+
+ TMPDIR_BASE=$(mktemp -d)
+
+ if [[ "$(uname)" == "Darwin" ]]; then
+ KEY_DIR="/private/tmp/pgsodium"
+ else
+ KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
+ fi
+ KEY_FILE="$KEY_DIR/pgsodium.key"
+
+ if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
+ echo "Error: Could not create key directory $KEY_DIR" >&2
+ exit 1
+ fi
+ chmod 1777 "$KEY_DIR"
+
+ if [[ ! -f "$KEY_FILE" ]]; then
+ if ! (dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -A n -t x1 | tr -d ' \n' > "$KEY_FILE"); then
+ if ! (openssl rand -hex 32 > "$KEY_FILE"); then
+ echo "00000000000000000000000000000000" > "$KEY_FILE"
+ echo "Warning: Using fallback key" >&2
+ fi
fi
+ chmod 644 "$KEY_FILE"
fi
- chmod 644 "$KEY_FILE"
- fi
-
- if [[ -f "$KEY_FILE" && -r "$KEY_FILE" ]]; then
- cat "$KEY_FILE"
- else
- echo "Error: Cannot read key file $KEY_FILE" >&2
- exit 1
- fi
- '';
+
+ if [[ -f "$KEY_FILE" && -r "$KEY_FILE" ]]; then
+ cat "$KEY_FILE"
+ else
+ echo "Error: Cannot read key file $KEY_FILE" >&2
+ exit 1
+ fi
+ EOF
+ chmod +x $out/bin/pgsodium-getkey
+ '';
+ };
# Use the shared setup but with a test-specific name
start-postgres-server-bin = makePostgresDevSetup {
@@ -710,6 +717,8 @@
echo "listen_addresses = '*'" >> "$PGTAP_CLUSTER"/postgresql.conf
echo "port = 5435" >> "$PGTAP_CLUSTER"/postgresql.conf
echo "host all all 127.0.0.1/32 trust" >> $PGTAP_CLUSTER/pg_hba.conf
+ echo "Checking shared_preload_libraries setting:"
+ grep -rn "shared_preload_libraries" "$PGTAP_CLUSTER"/postgresql.conf
# Remove timescaledb if running orioledb-17 check
echo "I AM ${pgpkg.version}===================================================="
if [[ "${pgpkg.version}" == *"17"* ]]; then
@@ -808,6 +817,7 @@
--user=supabase_admin \
${builtins.concatStringsSep " " sortedTestList}; then
echo "pg_regress tests failed"
+ cat $out/regression_output/regression.diffs
exit 1
fi
diff --git a/migrations/schema-15.sql b/migrations/schema-15.sql
index 33bba060..802fbae7 100644
--- a/migrations/schema-15.sql
+++ b/migrations/schema-15.sql
@@ -44,27 +44,6 @@ CREATE SCHEMA graphql_public;
CREATE SCHEMA pgbouncer;
---
--- Name: pgsodium; Type: SCHEMA; Schema: -; Owner: -
---
-
-CREATE SCHEMA pgsodium;
-
-
---
--- Name: pgsodium; Type: EXTENSION; Schema: -; Owner: -
---
-
-CREATE EXTENSION IF NOT EXISTS pgsodium WITH SCHEMA pgsodium;
-
-
---
--- Name: EXTENSION pgsodium; Type: COMMENT; Schema: -; Owner: -
---
-
-COMMENT ON EXTENSION pgsodium IS 'Pgsodium is a modern cryptography library for Postgres.';
-
-
--
-- Name: realtime; Type: SCHEMA; Schema: -; Owner: -
--
@@ -582,28 +561,6 @@ END
$$;
---
--- Name: secrets_encrypt_secret_secret(); Type: FUNCTION; Schema: vault; Owner: -
---
-
-CREATE FUNCTION vault.secrets_encrypt_secret_secret() RETURNS trigger
- LANGUAGE plpgsql
- AS $$
- BEGIN
- new.secret = CASE WHEN new.secret IS NULL THEN NULL ELSE
- CASE WHEN new.key_id IS NULL THEN NULL ELSE pg_catalog.encode(
- pgsodium.crypto_aead_det_encrypt(
- pg_catalog.convert_to(new.secret, 'utf8'),
- pg_catalog.convert_to((new.id::text || new.description::text || new.created_at::text || new.updated_at::text)::text, 'utf8'),
- new.key_id::uuid,
- new.nonce
- ),
- 'base64') END END;
- RETURN new;
- END;
- $$;
-
-
SET default_tablespace = '';
SET default_table_access_method = heap;
@@ -790,30 +747,6 @@ CREATE TABLE storage.objects (
);
---
--- Name: decrypted_secrets; Type: VIEW; Schema: vault; Owner: -
---
-
-CREATE VIEW vault.decrypted_secrets AS
- SELECT secrets.id,
- secrets.name,
- secrets.description,
- secrets.secret,
- CASE
- WHEN (secrets.secret IS NULL) THEN NULL::text
- ELSE
- CASE
- WHEN (secrets.key_id IS NULL) THEN NULL::text
- ELSE convert_from(pgsodium.crypto_aead_det_decrypt(decode(secrets.secret, 'base64'::text), convert_to(((((secrets.id)::text || secrets.description) || (secrets.created_at)::text) || (secrets.updated_at)::text), 'utf8'::name), secrets.key_id, secrets.nonce), 'utf8'::name)
- END
- END AS decrypted_secret,
- secrets.key_id,
- secrets.nonce,
- secrets.created_at,
- secrets.updated_at
- FROM vault.secrets;
-
-
--
-- Name: refresh_tokens id; Type: DEFAULT; Schema: auth; Owner: -
--
diff --git a/migrations/schema-orioledb-17.sql b/migrations/schema-orioledb-17.sql
index ed5627c7..6c2d37f4 100644
--- a/migrations/schema-orioledb-17.sql
+++ b/migrations/schema-orioledb-17.sql
@@ -45,27 +45,6 @@ CREATE SCHEMA graphql_public;
CREATE SCHEMA pgbouncer;
---
--- Name: pgsodium; Type: SCHEMA; Schema: -; Owner: -
---
-
-CREATE SCHEMA pgsodium;
-
-
---
--- Name: pgsodium; Type: EXTENSION; Schema: -; Owner: -
---
-
-CREATE EXTENSION IF NOT EXISTS pgsodium WITH SCHEMA pgsodium;
-
-
---
--- Name: EXTENSION pgsodium; Type: COMMENT; Schema: -; Owner: -
---
-
-COMMENT ON EXTENSION pgsodium IS 'Pgsodium is a modern cryptography library for Postgres.';
-
-
--
-- Name: realtime; Type: SCHEMA; Schema: -; Owner: -
--
@@ -597,28 +576,6 @@ END
$$;
---
--- Name: secrets_encrypt_secret_secret(); Type: FUNCTION; Schema: vault; Owner: -
---
-
-CREATE FUNCTION vault.secrets_encrypt_secret_secret() RETURNS trigger
- LANGUAGE plpgsql
- AS $$
- BEGIN
- new.secret = CASE WHEN new.secret IS NULL THEN NULL ELSE
- CASE WHEN new.key_id IS NULL THEN NULL ELSE pg_catalog.encode(
- pgsodium.crypto_aead_det_encrypt(
- pg_catalog.convert_to(new.secret, 'utf8'),
- pg_catalog.convert_to((new.id::text || new.description::text || new.created_at::text || new.updated_at::text)::text, 'utf8'),
- new.key_id::uuid,
- new.nonce
- ),
- 'base64') END END;
- RETURN new;
- END;
- $$;
-
-
SET default_tablespace = '';
SET default_table_access_method = orioledb;
@@ -805,30 +762,6 @@ CREATE TABLE storage.objects (
);
---
--- Name: decrypted_secrets; Type: VIEW; Schema: vault; Owner: -
---
-
-CREATE VIEW vault.decrypted_secrets AS
- SELECT id,
- name,
- description,
- secret,
- CASE
- WHEN (secret IS NULL) THEN NULL::text
- ELSE
- CASE
- WHEN (key_id IS NULL) THEN NULL::text
- ELSE convert_from(pgsodium.crypto_aead_det_decrypt(decode(secret, 'base64'::text), convert_to(((((id)::text || description) || (created_at)::text) || (updated_at)::text), 'utf8'::name), key_id, nonce), 'utf8'::name)
- END
- END AS decrypted_secret,
- key_id,
- nonce,
- created_at,
- updated_at
- FROM vault.secrets;
-
-
--
-- Name: refresh_tokens id; Type: DEFAULT; Schema: auth; Owner: -
--
diff --git a/migrations/schema.sql b/migrations/schema.sql
index 1bff8b9d..cb031f79 100644
--- a/migrations/schema.sql
+++ b/migrations/schema.sql
@@ -44,27 +44,6 @@ CREATE SCHEMA graphql_public;
CREATE SCHEMA pgbouncer;
---
--- Name: pgsodium; Type: SCHEMA; Schema: -; Owner: -
---
-
-CREATE SCHEMA pgsodium;
-
-
---
--- Name: pgsodium; Type: EXTENSION; Schema: -; Owner: -
---
-
-CREATE EXTENSION IF NOT EXISTS pgsodium WITH SCHEMA pgsodium;
-
-
---
--- Name: EXTENSION pgsodium; Type: COMMENT; Schema: -; Owner: -
---
-
-COMMENT ON EXTENSION pgsodium IS 'Pgsodium is a modern cryptography library for Postgres.';
-
-
--
-- Name: realtime; Type: SCHEMA; Schema: -; Owner: -
--
@@ -574,28 +553,6 @@ END
$$;
---
--- Name: secrets_encrypt_secret_secret(); Type: FUNCTION; Schema: vault; Owner: -
---
-
-CREATE FUNCTION vault.secrets_encrypt_secret_secret() RETURNS trigger
- LANGUAGE plpgsql
- AS $$
- BEGIN
- new.secret = CASE WHEN new.secret IS NULL THEN NULL ELSE
- CASE WHEN new.key_id IS NULL THEN NULL ELSE pg_catalog.encode(
- pgsodium.crypto_aead_det_encrypt(
- pg_catalog.convert_to(new.secret, 'utf8'),
- pg_catalog.convert_to((new.id::text || new.description::text || new.created_at::text || new.updated_at::text)::text, 'utf8'),
- new.key_id::uuid,
- new.nonce
- ),
- 'base64') END END;
- RETURN new;
- END;
- $$;
-
-
SET default_tablespace = '';
SET default_table_access_method = heap;
@@ -782,30 +739,6 @@ CREATE TABLE storage.objects (
);
---
--- Name: decrypted_secrets; Type: VIEW; Schema: vault; Owner: -
---
-
-CREATE VIEW vault.decrypted_secrets AS
- SELECT secrets.id,
- secrets.name,
- secrets.description,
- secrets.secret,
- CASE
- WHEN (secrets.secret IS NULL) THEN NULL::text
- ELSE
- CASE
- WHEN (secrets.key_id IS NULL) THEN NULL::text
- ELSE convert_from(pgsodium.crypto_aead_det_decrypt(decode(secrets.secret, 'base64'::text), convert_to(((((secrets.id)::text || secrets.description) || (secrets.created_at)::text) || (secrets.updated_at)::text), 'utf8'::name), secrets.key_id, secrets.nonce), 'utf8'::name)
- END
- END AS decrypted_secret,
- secrets.key_id,
- secrets.nonce,
- secrets.created_at,
- secrets.updated_at
- FROM vault.secrets;
-
-
--
-- Name: refresh_tokens id; Type: DEFAULT; Schema: auth; Owner: -
--
diff --git a/migrations/tests/database/privs.sql b/migrations/tests/database/privs.sql
index d164e0cb..ea4f1318 100644
--- a/migrations/tests/database/privs.sql
+++ b/migrations/tests/database/privs.sql
@@ -2,10 +2,6 @@ SELECT database_privs_are(
'postgres', 'postgres', ARRAY['CONNECT', 'TEMPORARY', 'CREATE']
);
-SELECT function_privs_are('pgsodium', 'crypto_aead_det_decrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
-SELECT function_privs_are('pgsodium', 'crypto_aead_det_encrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
-SELECT function_privs_are('pgsodium', 'crypto_aead_det_keygen', array[]::text[], 'service_role', array['EXECUTE']);
-
-- Verify public schema privileges
SELECT schema_privs_are('public', 'postgres', array['CREATE', 'USAGE']);
SELECT schema_privs_are('public', 'anon', array['USAGE']);
diff --git a/nix/ext/vault.nix b/nix/ext/vault.nix
index c822fcd5..2cbd7e7a 100644
--- a/nix/ext/vault.nix
+++ b/nix/ext/vault.nix
@@ -1,23 +1,24 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{ lib, stdenv, fetchFromGitHub, libsodium, postgresql }:
stdenv.mkDerivation rec {
pname = "vault";
- version = "0.2.9";
+ version = "0.3.1";
- buildInputs = [ postgresql ];
+ buildInputs = [ libsodium postgresql ];
src = fetchFromGitHub {
owner = "supabase";
repo = pname;
rev = "refs/tags/v${version}";
- hash = "sha256-kXTngBW4K6FkZM8HvJG2Jha6OQqbejhnk7tchxy031I=";
+ hash = "sha256-MC87bqgtynnDhmNZAu96jvfCpsGDCPB0g5TZfRQHd30=";
};
installPhase = ''
mkdir -p $out/{lib,share/postgresql/extension}
- cp sql/*.sql $out/share/postgresql/extension
- cp *.control $out/share/postgresql/extension
+ install -D *${postgresql.dlSuffix} $out/lib
+ install -D -t $out/share/postgresql/extension sql/*.sql
+ install -D -t $out/share/postgresql/extension *.control
'';
meta = with lib; {
diff --git a/nix/tests/expected/security.out b/nix/tests/expected/security.out
index 97047d77..81b6b870 100644
--- a/nix/tests/expected/security.out
+++ b/nix/tests/expected/security.out
@@ -27,5 +27,7 @@ order by 1,2;
public | st_estimatedextent
public | st_estimatedextent
repack | repack_trigger
-(18 rows)
+ vault | create_secret
+ vault | update_secret
+(20 rows)
diff --git a/nix/tests/expected/z_15_ext_interface.out b/nix/tests/expected/z_15_ext_interface.out
index 9cc14323..566da6ae 100644
--- a/nix/tests/expected/z_15_ext_interface.out
+++ b/nix/tests/expected/z_15_ext_interface.out
@@ -4748,6 +4748,9 @@ order by
sslinfo | public | ssl_issuer_dn | | text
sslinfo | public | ssl_issuer_field | text | text
sslinfo | public | ssl_version | | text
+ supabase_vault | vault | _crypto_aead_det_decrypt | message bytea, additional bytea, key_id bigint, context bytea, nonce bytea | bytea
+ supabase_vault | vault | _crypto_aead_det_encrypt | message bytea, additional bytea, key_id bigint, context bytea, nonce bytea | bytea
+ supabase_vault | vault | _crypto_aead_det_noncegen | | bytea
supabase_vault | vault | create_secret | new_secret text, new_name text, new_description text, new_key_id uuid | uuid
supabase_vault | vault | update_secret | secret_id uuid, new_secret text, new_name text, new_description text, new_key_id uuid | void
tablefunc | public | connectby | text, text, text, text, integer, text | SETOF record
@@ -5224,7 +5227,7 @@ order by
xml2 | public | xpath_table | text, text, text, text, text | SETOF record
xml2 | public | xslt_process | text, text | text
xml2 | public | xslt_process | text, text, text | text
-(5054 rows)
+(5057 rows)
/*
@@ -6032,6 +6035,15 @@ order by
postgis_topology | topology | topology | name
postgis_topology | topology | topology | precision
postgis_topology | topology | topology | srid
+ supabase_vault | vault | decrypted_secrets | created_at
+ supabase_vault | vault | decrypted_secrets | decrypted_secret
+ supabase_vault | vault | decrypted_secrets | description
+ supabase_vault | vault | decrypted_secrets | id
+ supabase_vault | vault | decrypted_secrets | key_id
+ supabase_vault | vault | decrypted_secrets | name
+ supabase_vault | vault | decrypted_secrets | nonce
+ supabase_vault | vault | decrypted_secrets | secret
+ supabase_vault | vault | decrypted_secrets | updated_at
supabase_vault | vault | secrets | created_at
supabase_vault | vault | secrets | description
supabase_vault | vault | secrets | id
@@ -6355,5 +6367,5 @@ order by
wrappers | public | wrappers_fdw_stats | rows_in
wrappers | public | wrappers_fdw_stats | rows_out
wrappers | public | wrappers_fdw_stats | updated_at
-(1097 rows)
+(1106 rows)
diff --git a/nix/tests/expected/z_17_ext_interface.out b/nix/tests/expected/z_17_ext_interface.out
index 0380ccd8..92ce9ac2 100644
--- a/nix/tests/expected/z_17_ext_interface.out
+++ b/nix/tests/expected/z_17_ext_interface.out
@@ -4705,6 +4705,9 @@ order by
sslinfo | public | ssl_issuer_dn | | text
sslinfo | public | ssl_issuer_field | text | text
sslinfo | public | ssl_version | | text
+ supabase_vault | vault | _crypto_aead_det_decrypt | message bytea, additional bytea, key_id bigint, context bytea, nonce bytea | bytea
+ supabase_vault | vault | _crypto_aead_det_encrypt | message bytea, additional bytea, key_id bigint, context bytea, nonce bytea | bytea
+ supabase_vault | vault | _crypto_aead_det_noncegen | | bytea
supabase_vault | vault | create_secret | new_secret text, new_name text, new_description text, new_key_id uuid | uuid
supabase_vault | vault | update_secret | secret_id uuid, new_secret text, new_name text, new_description text, new_key_id uuid | void
tablefunc | public | connectby | text, text, text, text, integer | SETOF record
@@ -4904,7 +4907,7 @@ order by
xml2 | public | xpath_table | text, text, text, text, text | SETOF record
xml2 | public | xslt_process | text, text | text
xml2 | public | xslt_process | text, text, text | text
-(4746 rows)
+(4749 rows)
/*
@@ -5319,6 +5322,15 @@ order by
postgis_topology | topology | topology | name
postgis_topology | topology | topology | precision
postgis_topology | topology | topology | srid
+ supabase_vault | vault | decrypted_secrets | created_at
+ supabase_vault | vault | decrypted_secrets | decrypted_secret
+ supabase_vault | vault | decrypted_secrets | description
+ supabase_vault | vault | decrypted_secrets | id
+ supabase_vault | vault | decrypted_secrets | key_id
+ supabase_vault | vault | decrypted_secrets | name
+ supabase_vault | vault | decrypted_secrets | nonce
+ supabase_vault | vault | decrypted_secrets | secret
+ supabase_vault | vault | decrypted_secrets | updated_at
supabase_vault | vault | secrets | created_at
supabase_vault | vault | secrets | description
supabase_vault | vault | secrets | id
@@ -5336,5 +5348,5 @@ order by
wrappers | public | wrappers_fdw_stats | rows_in
wrappers | public | wrappers_fdw_stats | rows_out
wrappers | public | wrappers_fdw_stats | updated_at
-(398 rows)
+(407 rows)
diff --git a/nix/tests/postgresql.conf.in b/nix/tests/postgresql.conf.in
index ba1df515..e4f844d0 100644
--- a/nix/tests/postgresql.conf.in
+++ b/nix/tests/postgresql.conf.in
@@ -718,7 +718,7 @@ default_text_search_config = 'pg_catalog.english'
#local_preload_libraries = ''
#session_preload_libraries = ''
-shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter' # (change requires restart)
+shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter, supabase_vault' # (change requires restart)
jit_provider = 'llvmjit' # JIT library to use
@@ -795,6 +795,7 @@ jit_provider = 'llvmjit' # JIT library to use
# Add settings for extensions here
pgsodium.getkey_script = '@PGSODIUM_GETKEY_SCRIPT@'
+vault.getkey_script = '@PGSODIUM_GETKEY_SCRIPT@'
auto_explain.log_min_duration = 10s
cron.database_name = 'postgres'
[parent: 70657e2f3b7e]