From ef253a0c2c07f2252c1027faa90b4c4e2551cdbc Mon Sep 17 00:00:00 2001
From: Virender Singla <vksingla@google.com>
Date: Sun, 23 Aug 2026 13:48:28 +0000
Subject: [PATCH v2] Allow pg_read_all_stats to read replication origin status

Grant the pg_read_all_stats role access to the
pg_replication_origin_status view and its backing function
pg_show_replication_origin_status().
The regression test verifies that pg_read_all_stats can access
both the view and its backing function.
---
 src/backend/catalog/system_views.sql     |  2 ++
 src/test/regress/expected/privileges.out | 30 ++++++++++++++++++++++++
 src/test/regress/sql/privileges.sql      |  5 ++++
 3 files changed, 37 insertions(+)

diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
index 8612d99a890..1202921318f 100644
--- a/src/backend/catalog/system_views.sql
+++ b/src/backend/catalog/system_views.sql
@@ -1531,6 +1531,8 @@ CREATE VIEW pg_replication_origin_status AS
     FROM pg_show_replication_origin_status();
 
 REVOKE ALL ON pg_replication_origin_status FROM public;
+GRANT SELECT ON pg_replication_origin_status TO pg_read_all_stats;
+GRANT EXECUTE ON FUNCTION pg_show_replication_origin_status() TO pg_read_all_stats;
 
 -- All columns of pg_subscription except subconninfo are publicly readable.
 REVOKE ALL ON pg_subscription FROM public;
diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out
index ce76a4d2f4d..09fd0f23eb4 100644
--- a/src/test/regress/expected/privileges.out
+++ b/src/test/regress/expected/privileges.out
@@ -3528,6 +3528,18 @@ SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations',
  f
 (1 row)
 
+SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- no
+ has_table_privilege 
+---------------------
+ f
+(1 row)
+
+SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- no
+ has_function_privilege 
+------------------------
+ f
+(1 row)
+
 GRANT pg_read_all_stats TO regress_readallstats;
 SELECT has_table_privilege('regress_readallstats','pg_aios','SELECT'); -- yes
  has_table_privilege 
@@ -3559,6 +3571,18 @@ SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations',
  t
 (1 row)
 
+SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- yes
+ has_table_privilege 
+---------------------
+ t
+(1 row)
+
+SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- yes
+ has_function_privilege 
+------------------------
+ t
+(1 row)
+
 -- run query to ensure that functions within views can be executed
 SET ROLE regress_readallstats;
 SELECT COUNT(*) >= 0 AS ok FROM pg_aios;
@@ -3579,6 +3603,12 @@ SELECT COUNT(*) >= 0 AS ok FROM pg_shmem_allocations;
  t
 (1 row)
 
+SELECT COUNT(*) >= 0 AS ok FROM pg_replication_origin_status;
+ ok 
+----
+ t
+(1 row)
+
 RESET ROLE;
 -- clean up
 DROP ROLE regress_readallstats;
diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql
index 9f7767fb2b9..e4ef7138583 100644
--- a/src/test/regress/sql/privileges.sql
+++ b/src/test/regress/sql/privileges.sql
@@ -2156,6 +2156,8 @@ SELECT has_table_privilege('regress_readallstats','pg_backend_memory_contexts','
 SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations','SELECT'); -- no
 SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations_numa','SELECT'); -- no
 SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations','SELECT'); -- no
+SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- no
+SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- no
 
 GRANT pg_read_all_stats TO regress_readallstats;
 
@@ -2164,12 +2166,15 @@ SELECT has_table_privilege('regress_readallstats','pg_backend_memory_contexts','
 SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations','SELECT'); -- yes
 SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations_numa','SELECT'); -- yes
 SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations','SELECT'); -- yes
+SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- yes
+SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- yes
 
 -- run query to ensure that functions within views can be executed
 SET ROLE regress_readallstats;
 SELECT COUNT(*) >= 0 AS ok FROM pg_aios;
 SELECT COUNT(*) >= 0 AS ok FROM pg_backend_memory_contexts;
 SELECT COUNT(*) >= 0 AS ok FROM pg_shmem_allocations;
+SELECT COUNT(*) >= 0 AS ok FROM pg_replication_origin_status;
 RESET ROLE;
 
 -- clean up
-- 
2.55.0.766.g2966f0265a-goog

