Re: INSERT ... ON CONFLICT UPDATE and RLS

On 26 February 2015 at 05:41, Stephen Frost <sfrost(at)snowman(dot)net> wrote:
> Dean,
>
> * Dean Rasheed (dean(dot)a(dot)rasheed(at)gmail(dot)com) wrote:
>> Here's an updated patch with a new test for this bug. I've been
>> developing the fixes for these RLS issues as one big patch, but I
>> suppose it would be easy to split up, if that's preferred.
>
> Thanks for working on all of this!
>
> I've brought this up to date with master and addressed the little bit
> of bitrot. I'm still reviewing it but I'm generally happy with the
> approach and would certainly welcome any additional thoughts from you or
> feedback from others.
>

Thanks for doing that. I had been meaning to update it myself, but
kept getting distracted by my day job.

I think this should probably be committed as 2 separate patches,
because there are really 2 separate issues being fixed here, and the
commit comment only mentions the second one:

1). The planner changes and the first new regression test (update with
from clause self join). This is a fix to the inheritance planner code,
which wasn't properly handling the case of a query containing both
target and non-target relations with RLS and inheritance.

2). The rewriter changes and the other regression tests (S.b. view on
top of Row-level security). This is more than just a code tidy-up --
there's a real bug there. If you run those tests against HEAD, the
update against the s.b. view fails to apply the RLS policy of the
underlying table because the old recursion detection code thinks it
has already handled that RTE.

I should get more time to look at this over the weekend.

Regards,
Dean