supabase-postgres.git / summary / log / commit / refs
commit ae728fa9443d72c6e97034d0b4dc48b79f42ac6d
Author: Raminder Singh <romi_ssk@yahoo.co.in>
Commit: GitHub <noreply@github.com>
Date: Tue Aug 12 09:31:41 2025 +0000
feat: add supabase_etl_admin user
ansible/files/postgresql_config/supautils.conf.j2 | 4 ++--
ansible/vars.yml | 6 +++---
migrations/db/init-scripts/00000000000000-initial-schema.sql | 5 +++++
nix/tests/expected/roles.out | 6 ++++--
nix/tests/expected/z_15_roles.out | 3 ++-
nix/tests/expected/z_17_roles.out | 6 ++++--
nix/tools/postgresql_schema.sql | 1 +
testinfra/test_ami_nix.py | 1 +
8 files changed, 22 insertions(+), 10 deletions(-)
diff --git a/ansible/files/postgresql_config/supautils.conf.j2 b/ansible/files/postgresql_config/supautils.conf.j2
index f8c4aa0a..a3456f69 100644
--- a/ansible/files/postgresql_config/supautils.conf.j2
+++ b/ansible/files/postgresql_config/supautils.conf.j2
@@ -11,5 +11,5 @@ supautils.extension_custom_scripts_path = '/etc/postgresql-custom/extension-cust
supautils.privileged_extensions_superuser = 'supabase_admin'
supautils.privileged_role = 'postgres'
supautils.privileged_role_allowed_configs = 'auto_explain.*, log_lock_waits, log_min_duration_statement, log_min_messages, log_replication_commands, log_statement, log_temp_files, pg_net.batch_size, pg_net.ttl, pg_stat_statements.*, pgaudit.log, pgaudit.log_catalog, pgaudit.log_client, pgaudit.log_level, pgaudit.log_relation, pgaudit.log_rows, pgaudit.log_statement, pgaudit.log_statement_once, pgaudit.role, pgrst.*, plan_filter.*, safeupdate.enabled, session_replication_role, track_io_timing, wal_compression'
-supautils.reserved_memberships = 'pg_read_server_files, pg_write_server_files, pg_execute_server_program, supabase_admin, supabase_auth_admin, supabase_storage_admin, supabase_read_only_user, supabase_realtime_admin, supabase_replication_admin, dashboard_user, pgbouncer, authenticator'
-supautils.reserved_roles = 'supabase_admin, supabase_auth_admin, supabase_storage_admin, supabase_read_only_user, supabase_realtime_admin, supabase_replication_admin, dashboard_user, pgbouncer, service_role*, authenticator*, authenticated*, anon*'
+supautils.reserved_memberships = 'pg_read_server_files, pg_write_server_files, pg_execute_server_program, supabase_admin, supabase_auth_admin, supabase_storage_admin, supabase_read_only_user, supabase_realtime_admin, supabase_replication_admin, supabase_etl_admin, dashboard_user, pgbouncer, authenticator'
+supautils.reserved_roles = 'supabase_admin, supabase_auth_admin, supabase_storage_admin, supabase_read_only_user, supabase_realtime_admin, supabase_replication_admin, supabase_etl_admin, dashboard_user, pgbouncer, service_role*, authenticator*, authenticated*, anon*'
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 99de42a6..cd7ea6a2 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
# Full version strings for each major version
postgres_release:
- postgresorioledb-17: "17.5.1.016-orioledb"
- postgres17: "17.4.1.073"
- postgres15: "15.8.1.130"
+ postgresorioledb-17: "17.5.1.017-orioledb"
+ postgres17: "17.4.1.074"
+ postgres15: "15.8.1.131"
# Non Postgres Extensions
pgbouncer_release: "1.19.0"
diff --git a/migrations/db/init-scripts/00000000000000-initial-schema.sql b/migrations/db/init-scripts/00000000000000-initial-schema.sql
index 272c989c..2406a748 100644
--- a/migrations/db/init-scripts/00000000000000-initial-schema.sql
+++ b/migrations/db/init-scripts/00000000000000-initial-schema.sql
@@ -10,6 +10,11 @@ alter user supabase_admin with superuser createdb createrole replication bypass
-- Supabase replication user
create user supabase_replication_admin with login replication;
+-- Supabase etl user
+create user supabase_etl_admin with login replication;
+grant pg_read_all_data to supabase_etl_admin;
+grant create on database postgres to supabase_etl_admin;
+
-- Supabase read-only user
create role supabase_read_only_user with login bypassrls;
grant pg_read_all_data to supabase_read_only_user;
diff --git a/nix/tests/expected/roles.out b/nix/tests/expected/roles.out
index 69446110..9c5a47a7 100644
--- a/nix/tests/expected/roles.out
+++ b/nix/tests/expected/roles.out
@@ -46,11 +46,12 @@ order by rolname;
service_role | f | f | f | t | f | f | -1 | t |
supabase_admin | t | t | t | t | t | t | -1 | t |
supabase_auth_admin | t | t | f | f | f | f | -1 | f |
+ supabase_etl_admin | f | t | f | t | f | t | -1 | f |
supabase_functions_admin | t | t | f | f | f | f | -1 | f |
supabase_read_only_user | f | t | f | t | f | f | -1 | t |
supabase_replication_admin | f | t | f | t | f | t | -1 | f |
supabase_storage_admin | t | t | f | f | f | f | -1 | f |
-(29 rows)
+(30 rows)
select
rolname,
@@ -85,11 +86,12 @@ order by rolname;
service_role |
supabase_admin | {"search_path=\"$user\", public, auth, extensions",log_statement=none}
supabase_auth_admin | {search_path=auth,idle_in_transaction_session_timeout=60000,log_statement=none}
+ supabase_etl_admin |
supabase_functions_admin |
supabase_read_only_user | {default_transaction_read_only=on}
supabase_replication_admin |
supabase_storage_admin | {search_path=storage,log_statement=none}
-(29 rows)
+(30 rows)
-- Check all privileges of the roles on the schemas
select schema_name, privilege_type, grantee, default_for
diff --git a/nix/tests/expected/z_15_roles.out b/nix/tests/expected/z_15_roles.out
index 42c2314e..796b298b 100644
--- a/nix/tests/expected/z_15_roles.out
+++ b/nix/tests/expected/z_15_roles.out
@@ -29,7 +29,8 @@ order by
postgres | pg_signal_backend | f
postgres | pgtle_admin | f
postgres | service_role | f
+ supabase_etl_admin | pg_read_all_data | f
supabase_read_only_user | pg_read_all_data | f
supabase_storage_admin | authenticator | f
-(18 rows)
+(19 rows)
diff --git a/nix/tests/expected/z_17_roles.out b/nix/tests/expected/z_17_roles.out
index 40ce6007..ecda2ffd 100644
--- a/nix/tests/expected/z_17_roles.out
+++ b/nix/tests/expected/z_17_roles.out
@@ -66,9 +66,10 @@ order by
postgres | pg_signal_backend | t
postgres | pgtle_admin | f
postgres | service_role | t
+ supabase_etl_admin | pg_read_all_data | f
supabase_read_only_user | pg_read_all_data | f
supabase_storage_admin | authenticator | f
-(20 rows)
+(21 rows)
-- Check version-specific privileges of the roles on the schemas
select schema_name, privilege_type, grantee, default_for
@@ -157,7 +158,8 @@ order by
postgres | pg_signal_backend | t
postgres | pgtle_admin | f
postgres | service_role | t
+ supabase_etl_admin | pg_read_all_data | f
supabase_read_only_user | pg_read_all_data | f
supabase_storage_admin | authenticator | f
-(19 rows)
+(20 rows)
diff --git a/nix/tools/postgresql_schema.sql b/nix/tools/postgresql_schema.sql
index 4547ab23..7c2ae21a 100644
--- a/nix/tools/postgresql_schema.sql
+++ b/nix/tools/postgresql_schema.sql
@@ -7,5 +7,6 @@ ALTER USER pgbouncer WITH PASSWORD 'postgres';
ALTER USER supabase_auth_admin WITH PASSWORD 'postgres';
ALTER USER supabase_storage_admin WITH PASSWORD 'postgres';
ALTER USER supabase_replication_admin WITH PASSWORD 'postgres';
+ALTER USER supabase_etl_admin WITH PASSWORD 'postgres';
ALTER ROLE supabase_read_only_user WITH PASSWORD 'postgres';
ALTER ROLE supabase_admin SET search_path TO "$user",public,auth,extensions;
diff --git a/testinfra/test_ami_nix.py b/testinfra/test_ami_nix.py
index d7b3ecca..96ce12da 100644
--- a/testinfra/test_ami_nix.py
+++ b/testinfra/test_ami_nix.py
@@ -32,6 +32,7 @@ ALTER USER pgbouncer WITH PASSWORD 'postgres';
ALTER USER supabase_auth_admin WITH PASSWORD 'postgres';
ALTER USER supabase_storage_admin WITH PASSWORD 'postgres';
ALTER USER supabase_replication_admin WITH PASSWORD 'postgres';
+ALTER USER supabase_etl_admin WITH PASSWORD 'postgres';
ALTER ROLE supabase_read_only_user WITH PASSWORD 'postgres';
ALTER ROLE supabase_admin SET search_path TO "$user",public,auth,extensions;
"""
[parent: 4433e215f0e0]