Subject: Re: Refactor recordExtObjInitPriv()

From: Peter Eisentraut <[email-masked]>
Date: Mon, 16 Jan 2023 12:01:47 +0100

On 12.01.23 18:40, Nathan Bossart wrote:
> On Thu, Jan 12, 2023 at 12:20:50PM -0500, Tom Lane wrote:
>> Peter Eisentraut <[email-masked]> writes:
>>> On 12.01.23 01:04, Nathan Bossart wrote:
>>> -			 classoid == AggregateRelationId ||
>>>> I noticed that AggregateRelationId isn't listed in the ObjectProperty
>>>> array, so I think recordExtObjInitPriv() will begin erroring for that
>>>> classoid instead of ignoring it like we do today.
>>
>>> Hmm, we do have some extensions in contrib that add aggregates (citext,
>>> intagg).  I suspect that the aggregate function is actually registered
>>> into the extension via its pg_proc entry, so this wouldn't actually
>>> matter.  But maybe the commenting should be clearer?
>>
>> Yeah, I don't believe that AggregateRelationId is used in object
>> addresses; we just refer to pg_proc for any kind of function including
>> aggregates.  Note that there is no "oid" column in pg_aggregate.
> 
> Got it, thanks for clarifying.

I have updated the patch as you suggested and split out the aggregate 
issue into a separate patch for clarity.
From 570643e44f17b1284a4639ab2d14bfcbbd487b7c Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <[email-masked]>
Date: Mon, 16 Jan 2023 11:46:13 +0100
Subject: [PATCH v2 1/2] Remove AggregateRelationId from recordExtObjInitPriv()

This was erroneous, because AggregateRelationId has no OID, so it
cannot be part of an extension directly.  (Aggregates are registered
via pg_proc.)  No harm in practice, but better to make it correct.

Discussion: https://www.postgresql.org/message-id/flat/[email-masked]
---
 src/backend/catalog/aclchk.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index cc6e260908..7cb2faa187 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -4510,7 +4510,6 @@ recordExtObjInitPriv(Oid objoid, Oid classoid)
 		ReleaseSysCache(tuple);
 	}
 	else if (classoid == AccessMethodRelationId ||
-			 classoid == AggregateRelationId ||
 			 classoid == CastRelationId ||
 			 classoid == CollationRelationId ||
 			 classoid == ConversionRelationId ||

base-commit: 20428d344a2964de6aaef9984fcd472f3c65d115
-- 
2.39.0

From d093fe1384f9f95779ccd13caa3f2967508c3c58 Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <[email-masked]>
Date: Mon, 16 Jan 2023 11:49:24 +0100
Subject: [PATCH v2 2/2] Refactor recordExtObjInitPriv()

Instead of half a dozen of mostly-duplicate conditional branches,
write one common one that can handle most catalogs.  We already have
all the information we need, such as which system catalog corresponds
to which catalog table and which column is the ACL column.

Reviewed-by: Nathan Bossart <[email-masked]>
Discussion: https://www.postgresql.org/message-id/flat/[email-masked]
---
 src/backend/catalog/aclchk.c | 152 ++---------------------------------
 1 file changed, 8 insertions(+), 144 deletions(-)

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 7cb2faa187..c4232344aa 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -4241,9 +4241,6 @@ recordDependencyOnNewAcl(Oid classId, Oid objectId, int32 objsubId,
  *
  * For the object passed in, this will record its ACL (if any) and the ACLs of
  * any sub-objects (eg: columns) into pg_init_privs.
- *
- * Any new kinds of objects which have ACLs associated with them and can be
- * added to an extension should be added to the if-else tree below.
  */
 void
 recordExtObjInitPriv(Oid objoid, Oid classoid)
@@ -4336,74 +4333,6 @@ recordExtObjInitPriv(Oid objoid, Oid classoid)
 
 		ReleaseSysCache(tuple);
 	}
-	/* pg_foreign_data_wrapper */
-	else if (classoid == ForeignDataWrapperRelationId)
-	{
-		Datum		aclDatum;
-		bool		isNull;
-		HeapTuple	tuple;
-
-		tuple = SearchSysCache1(FOREIGNDATAWRAPPEROID,
-								ObjectIdGetDatum(objoid));
-		if (!HeapTupleIsValid(tuple))
-			elog(ERROR, "cache lookup failed for foreign data wrapper %u",
-				 objoid);
-
-		aclDatum = SysCacheGetAttr(FOREIGNDATAWRAPPEROID, tuple,
-								   Anum_pg_foreign_data_wrapper_fdwacl,
-								   &isNull);
-
-		/* Add the record, if any, for the top-level object */
-		if (!isNull)
-			recordExtensionInitPrivWorker(objoid, classoid, 0,
-										  DatumGetAclP(aclDatum));
-
-		ReleaseSysCache(tuple);
-	}
-	/* pg_foreign_server */
-	else if (classoid == ForeignServerRelationId)
-	{
-		Datum		aclDatum;
-		bool		isNull;
-		HeapTuple	tuple;
-
-		tuple = SearchSysCache1(FOREIGNSERVEROID, ObjectIdGetDatum(objoid));
-		if (!HeapTupleIsValid(tuple))
-			elog(ERROR, "cache lookup failed for foreign server %u",
-				 objoid);
-
-		aclDatum = SysCacheGetAttr(FOREIGNSERVEROID, tuple,
-								   Anum_pg_foreign_server_srvacl,
-								   &isNull);
-
-		/* Add the record, if any, for the top-level object */
-		if (!isNull)
-			recordExtensionInitPrivWorker(objoid, classoid, 0,
-										  DatumGetAclP(aclDatum));
-
-		ReleaseSysCache(tuple);
-	}
-	/* pg_language */
-	else if (classoid == LanguageRelationId)
-	{
-		Datum		aclDatum;
-		bool		isNull;
-		HeapTuple	tuple;
-
-		tuple = SearchSysCache1(LANGOID, ObjectIdGetDatum(objoid));
-		if (!HeapTupleIsValid(tuple))
-			elog(ERROR, "cache lookup failed for language %u", objoid);
-
-		aclDatum = SysCacheGetAttr(LANGOID, tuple, Anum_pg_language_lanacl,
-								   &isNull);
-
-		/* Add the record, if any, for the top-level object */
-		if (!isNull)
-			recordExtensionInitPrivWorker(objoid, classoid, 0,
-										  DatumGetAclP(aclDatum));
-
-		ReleaseSysCache(tuple);
-	}
 	/* pg_largeobject_metadata */
 	else if (classoid == LargeObjectMetadataRelationId)
 	{
@@ -4446,60 +4375,21 @@ recordExtObjInitPriv(Oid objoid, Oid classoid)
 
 		systable_endscan(scan);
 	}
-	/* pg_namespace */
-	else if (classoid == NamespaceRelationId)
+	/* This will error on unsupported classoid. */
+	else if (get_object_attnum_acl(classoid) != InvalidAttrNumber)
 	{
 		Datum		aclDatum;
 		bool		isNull;
 		HeapTuple	tuple;
 
-		tuple = SearchSysCache1(NAMESPACEOID, ObjectIdGetDatum(objoid));
-		if (!HeapTupleIsValid(tuple))
-			elog(ERROR, "cache lookup failed for schema %u", objoid);
-
-		aclDatum = SysCacheGetAttr(NAMESPACEOID, tuple,
-								   Anum_pg_namespace_nspacl, &isNull);
-
-		/* Add the record, if any, for the top-level object */
-		if (!isNull)
-			recordExtensionInitPrivWorker(objoid, classoid, 0,
-										  DatumGetAclP(aclDatum));
-
-		ReleaseSysCache(tuple);
-	}
-	/* pg_proc */
-	else if (classoid == ProcedureRelationId)
-	{
-		Datum		aclDatum;
-		bool		isNull;
-		HeapTuple	tuple;
-
-		tuple = SearchSysCache1(PROCOID, ObjectIdGetDatum(objoid));
-		if (!HeapTupleIsValid(tuple))
-			elog(ERROR, "cache lookup failed for function %u", objoid);
-
-		aclDatum = SysCacheGetAttr(PROCOID, tuple, Anum_pg_proc_proacl,
-								   &isNull);
-
-		/* Add the record, if any, for the top-level object */
-		if (!isNull)
-			recordExtensionInitPrivWorker(objoid, classoid, 0,
-										  DatumGetAclP(aclDatum));
-
-		ReleaseSysCache(tuple);
-	}
-	/* pg_type */
-	else if (classoid == TypeRelationId)
-	{
-		Datum		aclDatum;
-		bool		isNull;
-		HeapTuple	tuple;
-
-		tuple = SearchSysCache1(TYPEOID, ObjectIdGetDatum(objoid));
+		tuple = SearchSysCache1(get_object_catcache_oid(classoid),
+								ObjectIdGetDatum(objoid));
 		if (!HeapTupleIsValid(tuple))
-			elog(ERROR, "cache lookup failed for type %u", objoid);
+			elog(ERROR, "cache lookup failed for %s %u",
+				 get_object_class_descr(classoid), objoid);
 
-		aclDatum = SysCacheGetAttr(TYPEOID, tuple, Anum_pg_type_typacl,
+		aclDatum = SysCacheGetAttr(get_object_catcache_oid(classoid), tuple,
+								   get_object_attnum_acl(classoid),
 								   &isNull);
 
 		/* Add the record, if any, for the top-level object */
@@ -4509,32 +4399,6 @@ recordExtObjInitPriv(Oid objoid, Oid classoid)
 
 		ReleaseSysCache(tuple);
 	}
-	else if (classoid == AccessMethodRelationId ||
-			 classoid == CastRelationId ||
-			 classoid == CollationRelationId ||
-			 classoid == ConversionRelationId ||
-			 classoid == EventTriggerRelationId ||
-			 classoid == OperatorRelationId ||
-			 classoid == OperatorClassRelationId ||
-			 classoid == OperatorFamilyRelationId ||
-			 classoid == TSConfigRelationId ||
-			 classoid == TSDictionaryRelationId ||
-			 classoid == TSParserRelationId ||
-			 classoid == TSTemplateRelationId ||
-			 classoid == TransformRelationId
-		)
-	{
-		/* no ACL for these object types, so do nothing. */
-	}
-
-	/*
-	 * complain if we are given a class OID for a class that extensions don't
-	 * support or that we don't recognize.
-	 */
-	else
-	{
-		elog(ERROR, "unrecognized or unsupported class OID: %u", classoid);
-	}
 }
 
 /*
-- 
2.39.0

---

From: Nathan Bossart <[email-masked]>
Date: Mon, 16 Jan 2023 14:43:21 -0800

On Mon, Jan 16, 2023 at 12:01:47PM +0100, Peter Eisentraut wrote:
> I have updated the patch as you suggested and split out the aggregate issue
> into a separate patch for clarity.

LGTM

-- 
Nathan Bossart
Amazon Web Services: https://aws.amazon.com