Re: minor error message enhance: print RLS policy name when only one permissive policy exists

On Tue, Oct 28, 2025 at 11:06 AM Chao Li <li(dot)evan(dot)chao(at)gmail(dot)com> wrote:
> > The attached patch did what the $subject says.
> > demo:
> >
> > begin;
> > create role alice login;
> > grant all on schema public to alice;
> > drop table if exists tts;
> > create table tts(a int);
> > grant insert on tts to alice;
> > ALTER TABLE tts ENABLE ROW LEVEL SECURITY;
> > CREATE POLICY p1 ON tts FOR ALL USING (a = 1 or a = 2 or a = 3);
> > commit;
> >
> > SET ROLE alice;
> > insert into tts values (4); --error
> >
> > old ERROR message:
> > ERROR: new row violates row-level security policy for table "tts"
> >
> > new ERROR message:
> > ERROR: new row violates row-level security policy "p1" for table "tts"
> >
> > There are fewer than 10 lines of C code changes, but turns out that in the
> > regression tests, there are many cases where only one permissive policy exists
> > for INSERT or UPDATE.
> > So the patch is not smaller.
> > <v1-0001-minor-RLS-violation-error-report-enhance.patch>
>
> I agree printing policy name to the log helps. I tried to “make" and “make check”, all passed.

https://cirrus-ci.com/task/5006265459408896?logs=test_world#L145
says test_rls_hooks test failed.

>
> A tiny comment wrt the code comment:
>
> ```
> * since if the check fails it means that no policy granted permission
> * to perform the update, rather than any particular policy being
> * violated.
> + * However, if there is only a single permissive policy clause, we can
> + * include that specific policy name in error reports when the policy is
> + * violated.
> ```
>
> * “However …” doesn’t have to go to a new line. But if you really want that, an empty comment line should be added above “However …”. See the comment of “if” that is right above this piece of code.
>
> * “include that specific policy name” => “include that specific policy’s name”.
>

ok. now the comment is

* However, if there is only a single permissive policy clause, we can
* include that specific policy’s name in error reports when the policy
* is violated.