MIME-Version: 1.0
References: <202601241015.y5uvxd7oxnfs@alvherre.pgsql>
In-Reply-To: <202601241015.y5uvxd7oxnfs@alvherre.pgsql>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Mon, 26 Jan 2026 14:17:08 -0800
Message-ID: <CAOYmi+kLmjJmtmkKs1mWcmNFsgQWsY8ajRhctsrmeVy-y6OKFw@mail.gmail.com>
Subject: Re: unclear OAuth error message
To: =?UTF-8?Q?=C3=81lvaro_Herrera?= <alvherre@kurilemu.de>
Cc: Pg Hackers <pgsql-hackers@lists.postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAOYmi%2BkLmjJmtmkKs1mWcmNFsgQWsY8ajRhctsrmeVy-y6OKFw%40mail.gmail.com>
Precedence: bulk

On Sat, Jan 24, 2026 at 6:50=E2=80=AFAM =C3=81lvaro Herrera <alvherre@kuril=
emu.de> wrote:
> But the code suggests that the module worked fine and made the
> determination not to authorize the user.  If that's so, then why do we
> have the errdetail at all?  Can't we just get rid of it and let the
> errmsg stand on its own merit?

For that code path I suspect we could get rid of the entire message,
because of what you mentioned later: auth_failed() is already going to
give us that. The validator can log what's important if needed, or
not. We could add some DEBUGs, maybe, so that you can still figure out
what's going on if a validator fails silently?

> Here it seems the validator did indeed have an internal problem of some
> sort, because while it did declare that the user was authorized, it did
> not provide what we were expecting from it.  Should in this case the
> errmsg() be different?

Yeah, I think so. The errdetail should probably become the errmsg,
essentially (but with more context).

Thanks,
--Jacob