MIME-Version: 1.0
References: <CAMH-PzUPN7JcLXJx-aJzGnJD2T-aSMo8gaMFkzO_x26urpMqSA@mail.gmail.com>
 <88804c921b425d37a3072b5698b558a763d80d63.camel@cybertec.at> <CAFCRh-_fXGfKk6b26xaDD1fg5OhLy92bNofmeDfX2TFjkQLLXA@mail.gmail.com>
In-Reply-To: <CAFCRh-_fXGfKk6b26xaDD1fg5OhLy92bNofmeDfX2TFjkQLLXA@mail.gmail.com>
From: Vydehi Ganti <rayudugs@gmail.com>
Date: Fri, 25 Apr 2025 18:31:00 +0530
Message-ID: <CAMH-PzXe7AR2QDCDx3eRZPMGuixfTwm3sLF3kMZQkyNhtu=5qQ@mail.gmail.com>
Subject: Re: Clarification on RLS policy
To: Dominique Devienne <ddevienne@gmail.com>
Cc: Laurenz Albe <laurenz.albe@cybertec.at>, pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000d29256063399ed5c"
Archived-At: <https://www.postgresql.org/message-id/CAMH-PzXe7AR2QDCDx3eRZPMGuixfTwm3sLF3kMZQkyNhtu%3D5qQ%40mail.gmail.com>
Precedence: bulk

--000000000000d29256063399ed5c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

This is my Scenario:

I would need a policy on table Activity which has a column country_code .
In the policy i would need to call a function get_country as below which
queries the users table based on current user and checks which country code
that user has access to.
Then it should build up the lPredicate with the filter condition and append
to the query user runs on the Activity table.
*Can you please guide how to achieve this?*

CREATE OR REPLACE FUNCTION one.get_country(
powner name,
ptable_name name)
    RETURNS character varying
LANGUAGE 'plpgsql'
    COST 100
    STABLE PARALLEL UNSAFE
AS $BODY$
DECLARE

    lOSUser         varchar(4000) :=3D UPPER(SUBSTRING(current_user FROM
POSITION('\' IN current_user) + 1));
    lPredicate      varchar(4000) :=3D NULL;
    lCount          integer;

  i RECORD;

BEGIN
    IF position('ro' in current_user) =3D 0 THEN
        lPredicate :=3D '1=3D1';
    ELSE
        -- Users associated to explicit country_code
        FOR i IN (SELECT r.country_code AS country_code
                    FROM one.users  u
                        where UPPER(SUBSTR(u.Login, INSTR(u.Login, '\', -1)
+ 1)) =3D lOSUser )
                    WHERE u.role_type =3D 'reader') LOOP
            lPredicate :=3D lPredicate||''''||i.country_code||''',';
        END LOOP;

        IF lPredicate IS NOT NULL THEN
            lPredicate :=3D 'SUBSTR("id",1,3) IN ('||SUBSTR(lPredicate, 1,
LENGTH(lPredicate)-1)||')';
        ELSE
            lPredicate :=3D '1=3D1';
        END IF;
    END IF;

    RETURN lPredicate;

END;
$BODY$;

For the below policy statement it created the policy but i cant call that
CREATE POLICY "Codebase_Filter"
    ON one.activity
    FOR SELECT
    TO one
    USING (one.get_country('one','activity'));

On Fri, Apr 25, 2025 at 6:23=E2=80=AFPM Dominique Devienne <ddevienne@gmail=
.com>
wrote:

> On Fri, Apr 25, 2025 at 2:43=E2=80=AFPM Laurenz Albe <laurenz.albe@cybert=
ec.at>
> wrote:
> > On Fri, 2025-04-25 at 12:38 +0530, Vydehi Ganti wrote:
> > > We are presently using Postgresql:PostgreSQL 15.12 on
> x86_64-pc-linux-gnu, compiled by gcc (GCC) 8.5.0 20210514 (Red Hat
> 8.5.0-23), 64-bit
> > > 2.The function would return a character varying string which should b=
e
> appended
> > >   to the select as a filter.
> >
> > You cannot add whole WHERE conditions to a query dynamically.
> > The only way to fix that is to solve the problem differently.
> > Since you didn't tell us details, we cannot tell you how.
>
> Laurenz is right. That's not how RLS works in PostgreSQL, unlike Oracle.
> In PostgreSQL, you must use a boolean SQL expression, often by calling
> a function.
> You don't simply return some SQL text that Oracle then "splices" into
> the SELECT.
>
> E.g., if you use custom ROLEs as an implementation detail for your
> security rules,
> your policy can be as simple as calling the pg_has_role() built-in
> function. FWIW. --DD
>
> CREATE POLICY ... USING (pg_has_role('SomeRole', 'MEMBER'))
>

--000000000000d29256063399ed5c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">This is my Scenario:<br><br>I would need a policy on table=
 Activity which has a column country_code .<br>In the policy i would need t=
o call a function get_country as below which queries the users table based =
on current user and checks which country code that user has access to.<br>T=
hen it should build up the lPredicate with the filter condition and append =
to the query user runs on the Activity table.<br><b>Can you please guide ho=
w to achieve this?</b><br><br>CREATE OR REPLACE FUNCTION one.get_country(<b=
r>	powner name,<br>	ptable_name name)<br>=C2=A0 =C2=A0 RETURNS character va=
rying<br>	LANGUAGE &#39;plpgsql&#39;<br>=C2=A0 =C2=A0 COST 100<br>=C2=A0 =
=C2=A0 STABLE PARALLEL UNSAFE<br>AS $BODY$<br>DECLARE<br><br>=C2=A0 =C2=A0 =
lOSUser =C2=A0 =C2=A0 =C2=A0 =C2=A0 varchar(4000) :=3D UPPER(SUBSTRING(curr=
ent_user FROM POSITION(&#39;\&#39; IN current_user) + 1));<br>=C2=A0 =C2=A0=
 lPredicate =C2=A0 =C2=A0 =C2=A0varchar(4000) :=3D NULL;<br>=C2=A0 =C2=A0 l=
Count =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0integer;<br><br>=C2=A0 i RECORD;<br=
><br>BEGIN<br>=C2=A0 =C2=A0 IF position(&#39;ro&#39; in current_user) =3D 0=
 THEN<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 lPredicate :=3D &#39;1=3D1&#39;;<br>=
=C2=A0 =C2=A0 ELSE<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 -- Users associated to ex=
plicit country_code<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 FOR i IN (SELECT r.count=
ry_code AS country_code<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 FROM one.users =C2=A0u<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 where UPPER(SUBSTR=
(u.Login, INSTR(u.Login, &#39;\&#39;, -1) + 1)) =3D lOSUser ) <br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 WHERE u.role=
_type =3D &#39;reader&#39;) LOOP<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 lPredicate :=3D lPredicate||&#39;&#39;&#39;&#39;||i.country_code||&#39;=
&#39;&#39;,&#39;;<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 END LOOP;<br><br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 IF lPredicate IS NOT NULL THEN<br>=C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 lPredicate :=3D &#39;SUBSTR(&quot;id&quot;,1,3) IN (&=
#39;||SUBSTR(lPredicate, 1, LENGTH(lPredicate)-1)||&#39;)&#39;;<br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 ELSE<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 lPre=
dicate :=3D &#39;1=3D1&#39;;<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 END IF;<br>=C2=
=A0 =C2=A0 END IF;<br><br>=C2=A0 =C2=A0 RETURN lPredicate;<br><br>END;<br>$=
BODY$;<br><br>For the below policy statement it created the policy but i ca=
nt call that<br>CREATE POLICY &quot;Codebase_Filter&quot;<br>=C2=A0 =C2=A0 =
ON one.activity<br>=C2=A0 =C2=A0 FOR SELECT<br>=C2=A0 =C2=A0 TO one<br>=C2=
=A0 =C2=A0 USING (one.get_country(&#39;one&#39;,&#39;activity&#39;));</div>=
<br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=
=3D"gmail_attr">On Fri, Apr 25, 2025 at 6:23=E2=80=AFPM Dominique Devienne =
&lt;<a href=3D"mailto:ddevienne@gmail.com">ddevienne@gmail.com</a>&gt; wrot=
e:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0=
.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Fri, Apr 2=
5, 2025 at 2:43=E2=80=AFPM Laurenz Albe &lt;<a href=3D"mailto:laurenz.albe@=
cybertec.at" target=3D"_blank">laurenz.albe@cybertec.at</a>&gt; wrote:<br>
&gt; On Fri, 2025-04-25 at 12:38 +0530, Vydehi Ganti wrote:<br>
&gt; &gt; We are presently using Postgresql:PostgreSQL 15.12 on x86_64-pc-l=
inux-gnu, compiled by gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-23), 64-bit<b=
r>
&gt; &gt; 2.The function would return a character varying string which shou=
ld be appended<br>
&gt; &gt;=C2=A0 =C2=A0to the select as a filter.<br>
&gt;<br>
&gt; You cannot add whole WHERE conditions to a query dynamically.<br>
&gt; The only way to fix that is to solve the problem differently.<br>
&gt; Since you didn&#39;t tell us details, we cannot tell you how.<br>
<br>
Laurenz is right. That&#39;s not how RLS works in PostgreSQL, unlike Oracle=
.<br>
In PostgreSQL, you must use a boolean SQL expression, often by calling<br>
a function.<br>
You don&#39;t simply return some SQL text that Oracle then &quot;splices&qu=
ot; into<br>
the SELECT.<br>
<br>
E.g., if you use custom ROLEs as an implementation detail for your<br>
security rules,<br>
your policy can be as simple as calling the pg_has_role() built-in<br>
function. FWIW. --DD<br>
<br>
CREATE POLICY ... USING (pg_has_role(&#39;SomeRole&#39;, &#39;MEMBER&#39;))=
<br>
</blockquote></div>

--000000000000d29256063399ed5c--