Re: Validate SERVER subscription conninfo during ALTER SUBSCRIPTION ... OWNER TO

On Tue, Jul 21, 2026 at 3:23 PM Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:

> Hi,
>
> While tryng the new v19 feature CREATE/ALTER SUBSCRIPTION ... SERVER,
> I found that ALTER SUBSCRIPTION ... OWNER TO can change the effective
> conninfo for a SERVER subscription, but does not validate the new owner's
> generated conninfo with walrcv_check_conninfo().
>
> As a result, the owner of a SERVER subscription with password_required=true
> can be changed to a non-superuser whose generated connection string does
> not
> contain a password. The ownership change succeeds, but the subscription is
> left in a state that will fail later when a worker or another command
> tries to
> connect.
>
> Isn't this problematic?
>
> The attached patch fixes this by making ALTER SUBSCRIPTION ... OWNER TO
> validate the new owner's generated conninfo with walrcv_check_conninfo().
> It also updates the ALTER SUBSCRIPTION documentation to mention
> the SERVER-specific requirements for changing the owner.
>
> Thought?
>
> Regards,
>
> --
> Fujii Masao
>

Sounds correct to me to do the conninfo validation.

A small comment on the documentation change:

+ for the new owner or for <literal>PUBLIC</literal> must exist, and the
+ connection string generated for the new owner must satisfy the
subscription's
+ <literal>password_required</literal> setting.

From the implementation, only when a new owner is not superuser, it needs
to satisfy the password_required setting.

Regards,
Yuanchao Zhang