MIME-Version: 1.0
References: 
 <CANxoLDdJsRJqnjMXV3yjsk07Z5iRWxG-c2hZJC7bAKqf8ZXj_A@mail.gmail.com>
 <CANxoLDffrZGRTGpW_sPQ-hPEYs0hgjaFgJQh3PJFpPu5Zsbgvg@mail.gmail.com>
 <177997571870.313758.10720313850275742354.pgcf@coridan.postgresql.org>
 <CANxoLDe7xiCWY-UEmzoK_uQdKh3PPNcGXJ3qdzFy3c0o_F+P_Q@mail.gmail.com>
 <SY7PR01MB1092118DD149062E230159D89B6162@SY7PR01MB10921.ausprd01.prod.outlook.com>
 <CAF0whuefRgV3_xgMhPoKaid1LN34CTLhTU-r5dgfFyEGVAFrPg@mail.gmail.com>
 <CANxoLDfBQn+q32DKo5yvb63eD+965umMi8zxqqV8GcsxdN6Trg@mail.gmail.com>
 <CANxoLDf80gXFLSqWM7d-idA=Grot49HsmP9YXZw49nCFe+Mi+g@mail.gmail.com>
 <CANxoLDeqR6wVCoXjsEWv4M_mhng-GCtt1KxFdfM-8PKwushUCA@mail.gmail.com>
 <CANxoLDcQyd=ojcmLCmU5zFT8j475AbXHpjSWHoVP4a5-vdY3Jw@mail.gmail.com>
 <CAF0whue4v=bH8beH0sBxu9UoFKRcZHTW-zH0qeVEt0jW2x7JiQ@mail.gmail.com>
In-Reply-To: 
 <CAF0whue4v=bH8beH0sBxu9UoFKRcZHTW-zH0qeVEt0jW2x7JiQ@mail.gmail.com>
From: Akshay Joshi <akshay.joshi@enterprisedb.com>
Date: Wed, 1 Jul 2026 16:01:10 +0530
Message-ID: 
 <CANxoLDd+Pfi=Do-+1ECG-eZg4=DXfxuUK+yX1KhjAMnQzyidwQ@mail.gmail.com>
Subject: Re: [PATCH] Add pg_get_policy_ddl() function to reconstruct CREATE
 POLICY statement
To: solai v <solai.cdac@gmail.com>
Cc: Ilmar Y <tanswis42@gmail.com>, pgsql-hackers@lists.postgresql.org
Content-Type: multipart/alternative; boundary="00000000000057854706558a31fa"
Archived-At: 
 <https://www.postgresql.org/message-id/CANxoLDd%2BPfi%3DDo-%2B1ECG-eZg4%3DDXfxuUK%2ByX1KhjAMnQzyidwQ%40mail.gmail.com>
Precedence: bulk

--00000000000057854706558a31fa
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Jul 1, 2026 at 2:44=E2=80=AFPM solai v <solai.cdac@gmail.com> wrote=
:

> Hi all,
>
>
> On Tue, Jun 30, 2026 at 4:48=E2=80=AFPM Akshay Joshi
> <akshay.joshi@enterprisedb.com> wrote:
> >
> > All,
> >
> > I've updated the patch to align with the interface change introduced by
> commit d6ed87d1989 (Andrew Dunstan, 2026-06-26 "Use named boolean
> parameters for pg_get_*_ddl option arguments").
> >
> > That commit replaced the VARIADIC text[] alternating key/value option
> interface with typed named boolean parameters across pg_get_role_ddl(),
> pg_get_tablespace_ddl(), and pg_get_database_ddl(), removing the
> DdlOption/parse_ddl_options() machinery in favour of direct
> PG_GETARG_BOOL() calls.
> >
> > Updated patch v14 is ready for review/commit.
> >
>
>
> I reviewed and tested the v14 patch on the latest master. The patch
> applied cleanly, built successfully, and passed make check without any
> regression failures. I verified the new function signature and
> confirmed that pg_get_policy_ddl() now uses the new interface with the
> boolean DEFAULT false argument. Also I tested the function with a
> variety of row-level security policies, including: Basic policy
> reconstruction, PERMISSIVE and RESTRICTIVE policies, Different command
> types (SELECT, INSERT, UPDATE, DELETE), Policies with multiple roles
> and the PUBLIC role, Quoted table, policy, and role names, USING and
> WITH CHECK clauses, Complex expressions including EXISTS, nested
> subqueries, CASE expressions, COALESCE, ANY/ALL operators, and boolean
> expressions, NULL inputs, invalid relation names, and non-existent
> policies. The generated DDL was correct as per the intent, and the
> expected errors were verified for the invalid inputs. I also verified
> that the generated DDL is executable by dropping an existing policy,
> recreating it using the output of pg_get_policy_ddl(), and confirming
> that the recreated policy was reconstructed successfully again by the
> function.
> One observation I noted is that for policies using default attributes
> (TO PUBLIC and AS PERMISSIVE), the generated DDL omits those clauses
> and produces a semantically equivalent statement which seems
> intentional but thought of sending it here for further clarification.
> Overall, I did not encounter any functional issues during testing. The
> patch looks good to me and worked as expected in all the scenarios I
> tested.
>

    Yes, it's intentional for all pg_get_***_ddl functions. Clause with
defaults won't be reconstructed.

>
>
> Regards,
> Solai
>

--00000000000057854706558a31fa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Jul 1, =
2026 at 2:44=E2=80=AFPM solai v &lt;<a href=3D"mailto:solai.cdac@gmail.com"=
>solai.cdac@gmail.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_qu=
ote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,20=
4);padding-left:1ex">Hi all,<br>
<br>
<br>
On Tue, Jun 30, 2026 at 4:48=E2=80=AFPM Akshay Joshi<br>
&lt;<a href=3D"mailto:akshay.joshi@enterprisedb.com" target=3D"_blank">aksh=
ay.joshi@enterprisedb.com</a>&gt; wrote:<br>
&gt;<br>
&gt; All,<br>
&gt;<br>
&gt; I&#39;ve updated the patch to align with the interface change introduc=
ed by commit d6ed87d1989 (Andrew Dunstan, 2026-06-26 &quot;Use named boolea=
n parameters for pg_get_*_ddl option arguments&quot;).<br>
&gt;<br>
&gt; That commit replaced the VARIADIC text[] alternating key/value option =
interface with typed named boolean parameters across pg_get_role_ddl(), pg_=
get_tablespace_ddl(), and pg_get_database_ddl(), removing the DdlOption/par=
se_ddl_options() machinery in favour of direct PG_GETARG_BOOL() calls.<br>
&gt;<br>
&gt; Updated patch v14 is ready for review/commit.<br>
&gt;<br>
<br>
<br>
I reviewed and tested the v14 patch on the latest master. The patch<br>
applied cleanly, built successfully, and passed make check without any<br>
regression failures. I verified the new function signature and<br>
confirmed that pg_get_policy_ddl() now uses the new interface with the<br>
boolean DEFAULT false argument. Also I tested the function with a<br>
variety of row-level security policies, including: Basic policy<br>
reconstruction, PERMISSIVE and RESTRICTIVE policies, Different command<br>
types (SELECT, INSERT, UPDATE, DELETE), Policies with multiple roles<br>
and the PUBLIC role, Quoted table, policy, and role names, USING and<br>
WITH CHECK clauses, Complex expressions including EXISTS, nested<br>
subqueries, CASE expressions, COALESCE, ANY/ALL operators, and boolean<br>
expressions, NULL inputs, invalid relation names, and non-existent<br>
policies. The generated DDL was correct as per the intent, and the<br>
expected errors were verified for the invalid inputs. I also verified<br>
that the generated DDL is executable by dropping an existing policy,<br>
recreating it using the output of pg_get_policy_ddl(), and confirming<br>
that the recreated policy was reconstructed successfully again by the<br>
function.<br>
One observation I noted is that for policies using default attributes<br>
(TO PUBLIC and AS PERMISSIVE), the generated DDL omits those clauses<br>
and produces a semantically equivalent statement which seems<br>
intentional but thought of sending it here for further clarification.<br>
Overall, I did not encounter any functional issues during testing. The<br>
patch looks good to me and worked as expected in all the scenarios I<br>
tested.<br></blockquote><div><br>=C2=A0 =C2=A0 Yes, it&#39;s intentional fo=
r all pg_get_***_ddl functions. Clause with defaults won&#39;t be reconstru=
cted.=C2=A0 =C2=A0 =C2=A0</div><blockquote class=3D"gmail_quote" style=3D"m=
argin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left=
:1ex">
<br>
<br>
Regards,<br>
Solai<br>
</blockquote></div></div>

--00000000000057854706558a31fa--