Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wfPKv-005QvZ-1L for pgsql-hackers@arkaria.postgresql.org; Thu, 02 Jul 2026 21:52:45 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wfPKu-003OWo-0z for pgsql-hackers@arkaria.postgresql.org; Thu, 02 Jul 2026 21:52:44 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wfPKt-003OWg-2V for pgsql-hackers@lists.postgresql.org; Thu, 02 Jul 2026 21:52:44 +0000 Received: from mail-pg1-x52a.google.com ([2607:f8b0:4864:20::52a]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.98.2) (envelope-from ) id 1wfPKr-00000001G5A-30Gk for pgsql-hackers@postgresql.org; Thu, 02 Jul 2026 21:52:42 +0000 Received: by mail-pg1-x52a.google.com with SMTP id 41be03b00d2f7-c95d0a54ea5so1445282a12.0 for ; Thu, 02 Jul 2026 14:52:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783029161; x=1783633961; darn=postgresql.org; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:from:to:cc:subject:date:message-id:reply-to; bh=0bgUtLVju5zYVn6JZ5L0DP5OigOus6Azk9SIq4zWJLI=; b=rXaRk5Akg5wm1J6Qxucb5svuSYrdSMA0xwHc6WYH9Y5NbmDsHyAuagal1jFQU6Lv9x Ck2RwplCvyGARgJGN0HitYvxGd9bC+qGtq+3tkNCc0/pKpk+wSRrHabzfhPwtaAC1HxJ SqXoZQNkc72xGOERJB+35XYzu6RdJBQCO3MPNVWZwuST57evjoYHQ5dg6KZIbKzoVKaS fYv0Wd3DOQJQ6IF3ybFtn7QgYM98+vlHOCxL+XWfKtmbjQYXY/46lHxyeiQ1aKsmbDud sUPXmeyk1/dQMOnxXqpKRDiJHyVVsDj+Re9RHfkYFslC0KmA7O3rczmL1l/HL8+bTCEF 07uA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783029161; x=1783633961; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=0bgUtLVju5zYVn6JZ5L0DP5OigOus6Azk9SIq4zWJLI=; b=jeB+44QhUYMkFkYwbq4/PiFvU+X39gVh+GRjC8mvxDbe8YqbrM4ReO4/NSaxL+ByWb 0M2AxBnChGMsy+KJoeYUJKxU1G3sqMmf+bi4kvIjl5eBrerDqd0Lsi6JLmrPp/4eBPdV lxGmTwnu8ZibuwZ3P26C4mMod2sW+4FuofCZEdBWeIzEsrXgDJkIiDQV8x0adl9/TQEo 71+FV40twTgnD6EzxTxkPSy0rPnzmG7oXV09kUz94Wc+MnOOYbG1DzSHIYDnECEnEwc0 TlnzPoaOToO6o3QeWqzmDWkYaPjM79ix+BSJrVWGtoMvsO+tVoRX3JFspZNHSgPEE0Ys LK4A== X-Forwarded-Encrypted: i=1; AFNElJ8zLKqcOh3X3w+kqJjdQ+IIk7fzPB31B6/QoPTplQYZA6ox1GLw238ucdAcRP6jR07ChvU+LTIuozVw8wUi@postgresql.org X-Gm-Message-State: AOJu0YzraVD4DTHFRcA9vloxMmsGXkf5903G8uuvEYqFCpKygATUBLSm XgqFZL1cuYn3ev7hZ7w6u0bSkViCYrWo9WSsYzHpGWsuu0msn4Q1xSOI X-Gm-Gg: AfdE7ckfRmh8oFuq/i7Gd4lHC6OYEnT6L7UcG27dpem1+XaWwA4BPnoZIbVXwrZHpFD vgm2kTvoJnAmVt6B9eCYJVdVIkf7U3Az0ZUKUT082nbbuCl/63X50U9YzwCV0FJ32Z5kunmZnV2 M7f3N6kaCJZo9S6AJJ3NXKjEqChf/XmFRyl4yfD81tpvURS8BvOpxgl/4fxdevU1ymd0/VkqDQ8 muU15GtBLwBgPWVSBCwAJmBrr/83m4tBpJDnOHpgdlIMgJ6w+Nr6PY/g3GzLTCDfAqHJDJkCqaq DLIsx/J/RtoRZ7jRKheCl3NsYhoJFRqoaYHmL0gCGbwWSGHFBIv8CnPTHL2dA4SBodQNaelKnxE QwtP/yTj5dA2Hy4iurY9XVT7bmws52XWinMcQaOjF94FEecxQCJs0ZGgK8cY+omvdh2g/f0B49p stj9T8+aqSE0ViUBnHQz6Otw== X-Received: by 2002:a05:6a20:9f93:b0:3bf:6c05:a9 with SMTP id adf61e73a8af0-3bfed4e5a18mr8747099637.56.1783029160439; Thu, 02 Jul 2026 14:52:40 -0700 (PDT) Received: from smtpclient.apple ([185.135.79.125]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30f0b4c5577sm14738893eec.0.2026.07.02.14.52.37 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 02 Jul 2026 14:52:39 -0700 (PDT) From: Chao Li Message-Id: <20DF964A-C291-491A-9126-62753DCBD7CE@gmail.com> Content-Type: multipart/mixed; boundary="Apple-Mail=_E8690892-1929-4ED2-BCA8-C223251FC202" Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: Re: Fix RLS checks for UPDATE/DELETE FOR PORTION OF leftover rows Date: Fri, 3 Jul 2026 05:52:03 +0800 In-Reply-To: Cc: Ayush Tiwari , PostgreSQL-development , Peter Eisentraut To: Paul A Jungwirth References: <6C34A987-AC50-4477-BD71-2D4AFEE1A589@gmail.com> <07EF5F4D-4AA3-4C21-8868-9ACC0D8B6655@gmail.com> X-Mailer: Apple Mail (2.3864.600.51.1.1) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --Apple-Mail=_E8690892-1929-4ED2-BCA8-C223251FC202 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Jul 3, 2026, at 02:06, Paul A Jungwirth = wrote: >=20 >> Is this the right way to do these checks? I'll try to look into it a >> bit more today, but does this cause problems when an UPDATE *doesn't* >> create leftovers? >=20 > I did some extra testing but couldn't find any problems. I looked at > INSERT policies when FOR PORTION OF exactly matches a row's bounds (so > the row is updated but there are no leftovers), and also INSERT > policies that include sublinks. >=20 >> We should update the documentation as well. I think it should point >> out the contrast between ACLs and RLS here. >=20 > Here is a v2 with a couple lines of documentation added. >=20 > Yours, >=20 > --=20 > Paul ~{:-) > pj@illuminatedcomputing.com > Thanks for testing and updating the doc. I agree the docs need to be = updated. I=E2=80=99d rephrase this a little bit: ``` RLS policies for inserting temporal leftovers are still checked. ``` Only INSERT policies will be checked, so I changed it to: ``` Row-level security INSERT policies are still checked for these leftover = inserts. ``` PFA v3, only this tiny doc change. Best regards, -- Chao Li (Evan) HighGo Software Co., Ltd. https://www.highgo.com/ --Apple-Mail=_E8690892-1929-4ED2-BCA8-C223251FC202 Content-Disposition: attachment; filename=v3-0001-Fix-RLS-checks-for-FOR-PORTION-OF-leftover-rows.patch Content-Type: application/octet-stream; x-unix-mode=0644; name="v3-0001-Fix-RLS-checks-for-FOR-PORTION-OF-leftover-rows.patch" Content-Transfer-Encoding: quoted-printable =46rom=2071f8e0d287b7f900b5f98a9f6c9da55117895195=20Mon=20Sep=2017=20= 00:00:00=202001=0AFrom:=20"Chao=20Li=20(Evan)"=20=0A= Date:=20Tue,=2030=20Jun=202026=2015:22:29=20+0800=0ASubject:=20[PATCH=20= v3]=20Fix=20RLS=20checks=20for=20FOR=20PORTION=20OF=20leftover=20rows=0A=0A= UPDATE/DELETE=20FOR=20PORTION=20OF=20may=20insert=20leftover=20rows=20to=20= preserve=20the=0Aparts=20of=20the=20old=20row=20that=20are=20outside=20= the=20target=20range.=20Those=20inserts=20go=0Athrough=20ExecInsert(),=20= which=20checks=20RLS=20policies=20using=0AWCO_RLS_INSERT_CHECK.=0A=0A= However,=20the=20rewriter=20only=20added=20RLS=20WITH=20CHECK=20options=20= for=20the=20original=0Astatement=20command.=20For=20UPDATE,=20that=20= meant=20only=20WCO_RLS_UPDATE_CHECK=0Aoptions=20were=20available,=20so=20= ExecInsert()=20skipped=20them.=20For=20DELETE,=20no=20RLS=0AWITH=20CHECK=20= options=20were=20added=20at=20all.=20As=20a=20result,=20leftover=20rows=20= could=20be=0Ainserted=20even=20when=20they=20violated=20INSERT=20RLS=20= policies.=0A=0AFix=20this=20by=20adding=20INSERT=20RLS=20WITH=20CHECK=20= options=20for=20UPDATE/DELETE=20FOR=0APORTION=20OF=20target=20relations.=20= Also=20add=20regression=20coverage=20for=20both=20UPDATE=0Aand=20DELETE,=20= including=20cases=20where=20allowed=20leftovers=20still=20succeed=20and=0A= disallowed=20leftovers=20are=20rejected.=0A=0AAuthor:=20Chao=20Li=20= =0AReviewed-by:=20Paul=20A=20Jungwirth=20= =0AReviewed-by:=20Ayush=20Tiwari=20= =0ADiscussion:=20= https://postgr.es/m/6C34A987-AC50-4477-BD71-2D4AFEE1A589@gmail.com=0A= Discussion:=20= https://postgr.es/m/CAJTYsWWdeBkoH5g8D-k9LDw9ciqsMxb21EJSiFXAzP4J=3DXyxOQ@= mail.gmail.com=0A---=0A=20doc/src/sgml/ref/delete.sgml=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20|=20=203=20+-=0A=20= doc/src/sgml/ref/update.sgml=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20|=20=203=20+-=0A=20src/backend/rewrite/rowsecurity.c=20=20=20=20=20= =20=20=20=20=20=20=20|=2045=20++++++++++++=0A=20= src/test/regress/expected/for_portion_of.out=20|=2075=20= ++++++++++++++++++++=0A=20src/test/regress/sql/for_portion_of.sql=20=20=20= =20=20=20|=2058=20+++++++++++++++=0A=205=20files=20changed,=20182=20= insertions(+),=202=20deletions(-)=0A=0Adiff=20--git=20= a/doc/src/sgml/ref/delete.sgml=20b/doc/src/sgml/ref/delete.sgml=0Aindex=20= ffdcd7fc4fa..3ab1f60525a=20100644=0A---=20a/doc/src/sgml/ref/delete.sgml=0A= +++=20b/doc/src/sgml/ref/delete.sgml=0A@@=20-97,7=20+97,8=20@@=20DELETE=20= FROM=20[=20ONLY=20]=20table_name=20[=20*=0A=20=20=20=20When=20= FOR=20PORTION=20OF=20is=20used,=20the=20secondary=20= inserts=20do=0A=20=20=20=20not=20require=20INSERT=20= privilege=20on=20the=20table.=20=20(This=20is=0A=20=20=20=20because=20= conceptually=20no=20new=20information=20is=20being=20added;=20the=20= inserted=20rows=0A-=20=20=20only=20preserve=20existing=20data=20about=20= the=20untargeted=20time=20period.)=0A+=20=20=20only=20preserve=20= existing=20data=20about=20the=20untargeted=20time=20period.)=20=20= Row-level=0A+=20=20=20security=20INSERT=20policies=20are=20still=20= checked=20for=20these=20leftover=20inserts.=0A=20=20=20=0A=20=20= =0A=20=0Adiff=20--git=20a/doc/src/sgml/ref/update.sgml=20= b/doc/src/sgml/ref/update.sgml=0Aindex=2021a8fd8b037..3175671d475=20= 100644=0A---=20a/doc/src/sgml/ref/update.sgml=0A+++=20= b/doc/src/sgml/ref/update.sgml=0A@@=20-101,7=20+101,8=20@@=20UPDATE=20[=20= ONLY=20]=20table_name=20= [=20*=20]=0A=20=20=20=20When=20FOR=20PORTION=20OF=20= is=20used,=20the=20secondary=20inserts=20do=0A=20=20=20=20not=20require=20= INSERT=20privilege=20on=20the=20table.=20=20(This=20= is=0A=20=20=20=20because=20conceptually=20no=20new=20information=20is=20= being=20added;=20the=20inserted=20rows=0A-=20=20=20only=20preserve=20= existing=20data=20about=20the=20untargeted=20time=20period.)=0A+=20=20=20= only=20preserve=20existing=20data=20about=20the=20untargeted=20time=20= period.)=20=20Row-level=0A+=20=20=20security=20INSERT=20policies=20are=20= still=20checked=20for=20these=20leftover=20inserts.=0A=20=20=20=0A= =20=20=0A=20=0Adiff=20--git=20= a/src/backend/rewrite/rowsecurity.c=20= b/src/backend/rewrite/rowsecurity.c=0Aindex=20e88a1bc1a89..cacf30f25a0=20= 100644=0A---=20a/src/backend/rewrite/rowsecurity.c=0A+++=20= b/src/backend/rewrite/rowsecurity.c=0A@@=20-393,6=20+393,51=20@@=20= get_row_security_policies(Query=20*root,=20RangeTblEntry=20*rte,=20int=20= rt_index,=0A=20=09=09}=0A=20=09}=0A=20=0A+=09/*=0A+=09=20*=20= UPDATE/DELETE=20FOR=20PORTION=20OF=20may=20insert=20leftover=20rows=20to=20= preserve=20the=0A+=09=20*=20portions=20of=20the=20old=20row=20not=20= covered=20by=20the=20target=20range.=20=20Those=20hidden=0A+=09=20*=20= inserts=20go=20through=20ExecInsert(),=20so=20they=20need=20the=20same=20= INSERT=20RLS=20WITH=0A+=09=20*=20CHECK=20options=20as=20ordinary=20= INSERTs.=0A+=09=20*/=0A+=09if=20(root->forPortionOf=20!=3D=20NULL=20&&=20= rt_index=20=3D=3D=20root->resultRelation=20&&=0A+=09=09(commandType=20=3D=3D= =20CMD_UPDATE=20||=20commandType=20=3D=3D=20CMD_DELETE))=0A+=09{=0A+=09=09= List=09=20=20=20*insert_permissive_policies;=0A+=09=09List=09=20=20=20= *insert_restrictive_policies;=0A+=0A+=09=09= get_policies_for_relation(rel,=20CMD_INSERT,=20user_id,=0A+=09=09=09=09=09= =09=09=09=20=20&insert_permissive_policies,=0A+=09=09=09=09=09=09=09=09=20= =20&insert_restrictive_policies);=0A+=09=09add_with_check_options(rel,=20= rt_index,=0A+=09=09=09=09=09=09=09=20=20=20WCO_RLS_INSERT_CHECK,=0A+=09=09= =09=09=09=09=09=20=20=20insert_permissive_policies,=0A+=09=09=09=09=09=09= =09=20=20=20insert_restrictive_policies,=0A+=09=09=09=09=09=09=09=20=20=20= withCheckOptions,=0A+=09=09=09=09=09=09=09=20=20=20hasSubLinks,=0A+=09=09= =09=09=09=09=09=20=20=20false);=0A+=0A+=09=09/*=0A+=09=09=20*=20As=20= with=20regular=20INSERT/UPDATE=20above,=20if=20SELECT=20rights=20are=20= needed=0A+=09=09=20*=20for=20the=20statement,=20ensure=20the=20leftover=20= row=20remains=20visible.=0A+=09=09=20*/=0A+=09=09if=20= (perminfo->requiredPerms=20&=20ACL_SELECT)=0A+=09=09{=0A+=09=09=09List=09= =20=20=20*select_permissive_policies;=0A+=09=09=09List=09=20=20=20= *select_restrictive_policies;=0A+=0A+=09=09=09= get_policies_for_relation(rel,=20CMD_SELECT,=20user_id,=0A+=09=09=09=09=09= =09=09=09=09=20=20&select_permissive_policies,=0A+=09=09=09=09=09=09=09=09= =09=20=20&select_restrictive_policies);=0A+=09=09=09= add_with_check_options(rel,=20rt_index,=0A+=09=09=09=09=09=09=09=09=20=20= =20WCO_RLS_INSERT_CHECK,=0A+=09=09=09=09=09=09=09=09=20=20=20= select_permissive_policies,=0A+=09=09=09=09=09=09=09=09=20=20=20= select_restrictive_policies,=0A+=09=09=09=09=09=09=09=09=20=20=20= withCheckOptions,=0A+=09=09=09=09=09=09=09=09=20=20=20hasSubLinks,=0A+=09= =09=09=09=09=09=09=09=20=20=20true);=0A+=09=09}=0A+=09}=0A+=0A=20=09/*=0A= =20=09=20*=20FOR=20MERGE,=20we=20fetch=20policies=20for=20UPDATE,=20= DELETE=20and=20INSERT=20(and=20ALL)=0A=20=09=20*=20and=20set=20them=20up=20= so=20that=20we=20can=20enforce=20the=20appropriate=20policy=20depending=0A= diff=20--git=20a/src/test/regress/expected/for_portion_of.out=20= b/src/test/regress/expected/for_portion_of.out=0Aindex=20= 207e370627e..5a0fb84f357=20100644=0A---=20= a/src/test/regress/expected/for_portion_of.out=0A+++=20= b/src/test/regress/expected/for_portion_of.out=0A@@=20-2488,4=20+2488,79=20= @@=20SELECT=20*=20FROM=20fpo_cursed;=0A=20(1=20row)=0A=20=0A=20DROP=20= TABLE=20fpo_cursed;=0A+--=20UPDATE/DELETE=20FOR=20PORTION=20OF=20= leftover=20rows=20must=20satisfy=20RLS=20INSERT=20checks.=0A+CREATE=20= ROLE=20regress_fpo_rls;=0A+CREATE=20TABLE=20fpo_rls=20(=0A+=20=20id=20= int,=0A+=20=20valid_at=20int4range=0A+);=0A+ALTER=20TABLE=20fpo_rls=20= ENABLE=20ROW=20LEVEL=20SECURITY;=0A+CREATE=20POLICY=20fpo_rls_select=20= ON=20fpo_rls=0A+=20=20FOR=20SELECT=20TO=20regress_fpo_rls=0A+=20=20USING=20= (true);=0A+CREATE=20POLICY=20fpo_rls_update=20ON=20fpo_rls=0A+=20=20FOR=20= UPDATE=20TO=20regress_fpo_rls=0A+=20=20USING=20(lower(valid_at)=20<=20= 50)=0A+=20=20WITH=20CHECK=20(lower(valid_at)=20<=2050);=0A+CREATE=20= POLICY=20fpo_rls_delete=20ON=20fpo_rls=0A+=20=20FOR=20DELETE=20TO=20= regress_fpo_rls=0A+=20=20USING=20(lower(valid_at)=20<=2050);=0A+CREATE=20= POLICY=20fpo_rls_insert=20ON=20fpo_rls=0A+=20=20FOR=20INSERT=20TO=20= regress_fpo_rls=0A+=20=20WITH=20CHECK=20(lower(valid_at)=20<=2050);=0A= +GRANT=20SELECT,=20UPDATE,=20DELETE=20ON=20fpo_rls=20TO=20= regress_fpo_rls;=0A+INSERT=20INTO=20fpo_rls=20VALUES=20(1,=20= '[10,100)');=0A+SET=20ROLE=20regress_fpo_rls;=0A+UPDATE=20fpo_rls=0A+=20=20= FOR=20PORTION=20OF=20valid_at=20FROM=2030=20TO=20100=0A+=20=20SET=20id=20= =3D=202;=0A+RESET=20ROLE;=0A+SELECT=20*=20FROM=20fpo_rls=20ORDER=20BY=20= valid_at;=0A+=20id=20|=20valid_at=20=0A+----+----------=0A+=20=201=20|=20= [10,30)=0A+=20=202=20|=20[30,100)=0A+(2=20rows)=0A+=0A+TRUNCATE=20= fpo_rls;=0A+INSERT=20INTO=20fpo_rls=20VALUES=20(1,=20'[10,100)');=0A+SET=20= ROLE=20regress_fpo_rls;=0A+DELETE=20FROM=20fpo_rls=0A+=20=20FOR=20= PORTION=20OF=20valid_at=20FROM=2030=20TO=20100;=0A+RESET=20ROLE;=0A= +SELECT=20*=20FROM=20fpo_rls=20ORDER=20BY=20valid_at;=0A+=20id=20|=20= valid_at=20=0A+----+----------=0A+=20=201=20|=20[10,30)=0A+(1=20row)=0A+=0A= +TRUNCATE=20fpo_rls;=0A+INSERT=20INTO=20fpo_rls=20VALUES=20(1,=20= '[10,100)');=0A+SET=20ROLE=20regress_fpo_rls;=0A+UPDATE=20fpo_rls=0A+=20=20= FOR=20PORTION=20OF=20valid_at=20FROM=2030=20TO=2070=0A+=20=20SET=20id=20= =3D=202;=0A+ERROR:=20=20new=20row=20violates=20row-level=20security=20= policy=20for=20table=20"fpo_rls"=0A+RESET=20ROLE;=0A+SELECT=20*=20FROM=20= fpo_rls=20ORDER=20BY=20valid_at;=0A+=20id=20|=20valid_at=20=0A= +----+----------=0A+=20=201=20|=20[10,100)=0A+(1=20row)=0A+=0A+TRUNCATE=20= fpo_rls;=0A+INSERT=20INTO=20fpo_rls=20VALUES=20(1,=20'[10,100)');=0A+SET=20= ROLE=20regress_fpo_rls;=0A+DELETE=20FROM=20fpo_rls=0A+=20=20FOR=20= PORTION=20OF=20valid_at=20FROM=2030=20TO=2070;=0A+ERROR:=20=20new=20row=20= violates=20row-level=20security=20policy=20for=20table=20"fpo_rls"=0A= +RESET=20ROLE;=0A+SELECT=20*=20FROM=20fpo_rls=20ORDER=20BY=20valid_at;=0A= +=20id=20|=20valid_at=20=0A+----+----------=0A+=20=201=20|=20[10,100)=0A= +(1=20row)=0A+=0A+DROP=20TABLE=20fpo_rls;=0A+DROP=20ROLE=20= regress_fpo_rls;=0A=20RESET=20datestyle;=0Adiff=20--git=20= a/src/test/regress/sql/for_portion_of.sql=20= b/src/test/regress/sql/for_portion_of.sql=0Aindex=20= a3c41abf7b7..3b1653df074=20100644=0A---=20= a/src/test/regress/sql/for_portion_of.sql=0A+++=20= b/src/test/regress/sql/for_portion_of.sql=0A@@=20-1619,4=20+1619,62=20@@=20= ROLLBACK;=0A=20SELECT=20*=20FROM=20fpo_cursed;=0A=20DROP=20TABLE=20= fpo_cursed;=0A=20=0A+--=20UPDATE/DELETE=20FOR=20PORTION=20OF=20leftover=20= rows=20must=20satisfy=20RLS=20INSERT=20checks.=0A+CREATE=20ROLE=20= regress_fpo_rls;=0A+CREATE=20TABLE=20fpo_rls=20(=0A+=20=20id=20int,=0A+=20= =20valid_at=20int4range=0A+);=0A+ALTER=20TABLE=20fpo_rls=20ENABLE=20ROW=20= LEVEL=20SECURITY;=0A+CREATE=20POLICY=20fpo_rls_select=20ON=20fpo_rls=0A+=20= =20FOR=20SELECT=20TO=20regress_fpo_rls=0A+=20=20USING=20(true);=0A= +CREATE=20POLICY=20fpo_rls_update=20ON=20fpo_rls=0A+=20=20FOR=20UPDATE=20= TO=20regress_fpo_rls=0A+=20=20USING=20(lower(valid_at)=20<=2050)=0A+=20=20= WITH=20CHECK=20(lower(valid_at)=20<=2050);=0A+CREATE=20POLICY=20= fpo_rls_delete=20ON=20fpo_rls=0A+=20=20FOR=20DELETE=20TO=20= regress_fpo_rls=0A+=20=20USING=20(lower(valid_at)=20<=2050);=0A+CREATE=20= POLICY=20fpo_rls_insert=20ON=20fpo_rls=0A+=20=20FOR=20INSERT=20TO=20= regress_fpo_rls=0A+=20=20WITH=20CHECK=20(lower(valid_at)=20<=2050);=0A= +GRANT=20SELECT,=20UPDATE,=20DELETE=20ON=20fpo_rls=20TO=20= regress_fpo_rls;=0A+=0A+INSERT=20INTO=20fpo_rls=20VALUES=20(1,=20= '[10,100)');=0A+SET=20ROLE=20regress_fpo_rls;=0A+UPDATE=20fpo_rls=0A+=20=20= FOR=20PORTION=20OF=20valid_at=20FROM=2030=20TO=20100=0A+=20=20SET=20id=20= =3D=202;=0A+RESET=20ROLE;=0A+SELECT=20*=20FROM=20fpo_rls=20ORDER=20BY=20= valid_at;=0A+=0A+TRUNCATE=20fpo_rls;=0A+INSERT=20INTO=20fpo_rls=20VALUES=20= (1,=20'[10,100)');=0A+SET=20ROLE=20regress_fpo_rls;=0A+DELETE=20FROM=20= fpo_rls=0A+=20=20FOR=20PORTION=20OF=20valid_at=20FROM=2030=20TO=20100;=0A= +RESET=20ROLE;=0A+SELECT=20*=20FROM=20fpo_rls=20ORDER=20BY=20valid_at;=0A= +=0A+TRUNCATE=20fpo_rls;=0A+INSERT=20INTO=20fpo_rls=20VALUES=20(1,=20= '[10,100)');=0A+SET=20ROLE=20regress_fpo_rls;=0A+UPDATE=20fpo_rls=0A+=20=20= FOR=20PORTION=20OF=20valid_at=20FROM=2030=20TO=2070=0A+=20=20SET=20id=20= =3D=202;=0A+RESET=20ROLE;=0A+SELECT=20*=20FROM=20fpo_rls=20ORDER=20BY=20= valid_at;=0A+=0A+TRUNCATE=20fpo_rls;=0A+INSERT=20INTO=20fpo_rls=20VALUES=20= (1,=20'[10,100)');=0A+SET=20ROLE=20regress_fpo_rls;=0A+DELETE=20FROM=20= fpo_rls=0A+=20=20FOR=20PORTION=20OF=20valid_at=20FROM=2030=20TO=2070;=0A= +RESET=20ROLE;=0A+SELECT=20*=20FROM=20fpo_rls=20ORDER=20BY=20valid_at;=0A= +=0A+DROP=20TABLE=20fpo_rls;=0A+DROP=20ROLE=20regress_fpo_rls;=0A+=0A=20= RESET=20datestyle;=0A--=20=0A2.50.1=20(Apple=20Git-155)=0A=0A= --Apple-Mail=_E8690892-1929-4ED2-BCA8-C223251FC202--