Allow pg_read_all_stats to read replication origin status

From: Virender Singla <virender(dot)cse(at)gmail(dot)com>
To: PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>
Subject: Allow pg_read_all_stats to read replication origin status
Date: 2026-08-08 14:46:28
Message-ID: CAM6Zo8ywTSsi7JHEYLTbyvJ-ukH2Mr=Z611Qf4rQLhX12NyFqQ@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

I have been looking at the requirement for providing non-superuser
read access to specific catalog relations, specifically
pg_replication_origin_status. During this, I reviewed the capabilities
of the pg_read_all_stats role.

Looks like pg_read_all_stats was originally designed to grant access
to all pg_stats_* views, a few other monitoring views defined in
system_views.sql have been included over time. However, access to
pg_replication_origin_status remains restricted and is not currently
covered by existing roles such as pg_read_all_stats, pg_read_all_data,
or pg_monitor.

The attached patch grants pg_read_all_stats read access to the
pg_replication_origin_status view and its underlying function,
consistent with the existing approach for monitoring views in
system_views.sql. I have also included the relevant regression tests.

On pgsql-hackers, I noted a previous discussion [1] regarding granting
this access; however, that discussion focused on the pg_monitor role
rather than pg_read_all_stats and never got commited.

[1] https://www.postgresql.org/message-id/flat/CAPdiE1zUeSycQ-VHrZQMDR4vkPthYTSxeQPXM-ZfH8QHDBCE%3DQ%40mail.gmail.com

Thanks,
Virender

Attachment Content-Type Size
0001-Grant-pg-read-all-stats-access-to-replication-origin.patch application/octet-stream 4.7 KB

Browse pgsql-hackers by date

  From Date Subject
Next Message Mihail Nikalayeu 2026-08-08 15:03:00 Re: Revisiting {CREATE INDEX, REINDEX} CONCURRENTLY improvements
Previous Message Xuneng Zhou 2026-08-08 13:51:04 Re: Deadlock detector fails to activate on a hot standby replica