From 51de915d651494fec4bccadc7a1a41f27096890d Mon Sep 17 00:00:00 2001 From: shihao zhong Date: Mon, 2 Nov 2026 22:37:33 -0500 Subject: [PATCH 2/2] Test foreign key checks under FORCE ROW LEVEL SECURITY Covers ADD FOREIGN KEY and DETACH PARTITION when policies hide rows from the owner. Discussion: https://postgr.es/m/954644F5-A39B-4BC1-B698-56AB42F0316F@luline.de --- src/test/regress/expected/rowsecurity.out | 28 +++++++++++++++++++++++ src/test/regress/sql/rowsecurity.sql | 26 +++++++++++++++++++++ 2 files changed, 54 insertions(+) diff --git a/src/test/regress/expected/rowsecurity.out b/src/test/regress/expected/rowsecurity.out index 72d76405639..fcdd99b92f3 100644 --- a/src/test/regress/expected/rowsecurity.out +++ b/src/test/regress/expected/rowsecurity.out @@ -4687,6 +4687,34 @@ TABLE r2; 25 (2 rows) +DROP TABLE r2; +DROP TABLE r1; +-- Ensure adding a foreign key sees rows hidden by FORCE RLS +CREATE TABLE r1 (a int PRIMARY KEY); +CREATE TABLE r2 (a int); +INSERT INTO r1 VALUES (10); +INSERT INTO r2 VALUES (10), (30); +CREATE POLICY p1 ON r2 USING (a <> 30); +ALTER TABLE r2 ENABLE ROW LEVEL SECURITY; +ALTER TABLE r2 FORCE ROW LEVEL SECURITY; +ALTER TABLE r2 ADD CONSTRAINT r2_a_fkey FOREIGN KEY (a) REFERENCES r1; -- error +ERROR: insert or update on table "r2" violates foreign key constraint "r2_a_fkey" +DETAIL: Key is not present in table "r1". +DROP TABLE r2; +DROP TABLE r1; +-- Ensure detaching a referenced partition sees rows hidden by FORCE RLS +CREATE TABLE r1 (a int PRIMARY KEY) PARTITION BY LIST (a); +CREATE TABLE r1_1 PARTITION OF r1 FOR VALUES IN (10); +CREATE TABLE r1_2 PARTITION OF r1 FOR VALUES IN (20); +CREATE TABLE r2 (a int REFERENCES r1); +INSERT INTO r1 VALUES (10), (20); +INSERT INTO r2 VALUES (10), (20); +CREATE POLICY p1 ON r2 USING (a <> 20); +ALTER TABLE r2 ENABLE ROW LEVEL SECURITY; +ALTER TABLE r2 FORCE ROW LEVEL SECURITY; +ALTER TABLE r1 DETACH PARTITION r1_2; -- error +ERROR: removing partition "r1_2" violates foreign key constraint "r2_a_fkey_2" +DETAIL: Key (a)=(20) is still referenced from table "r2". DROP TABLE r2; DROP TABLE r1; -- diff --git a/src/test/regress/sql/rowsecurity.sql b/src/test/regress/sql/rowsecurity.sql index 2bdb0c70c5c..4bf5695be77 100644 --- a/src/test/regress/sql/rowsecurity.sql +++ b/src/test/regress/sql/rowsecurity.sql @@ -2203,6 +2203,32 @@ TABLE r2; DROP TABLE r2; DROP TABLE r1; +-- Ensure adding a foreign key sees rows hidden by FORCE RLS +CREATE TABLE r1 (a int PRIMARY KEY); +CREATE TABLE r2 (a int); +INSERT INTO r1 VALUES (10); +INSERT INTO r2 VALUES (10), (30); +CREATE POLICY p1 ON r2 USING (a <> 30); +ALTER TABLE r2 ENABLE ROW LEVEL SECURITY; +ALTER TABLE r2 FORCE ROW LEVEL SECURITY; +ALTER TABLE r2 ADD CONSTRAINT r2_a_fkey FOREIGN KEY (a) REFERENCES r1; -- error +DROP TABLE r2; +DROP TABLE r1; + +-- Ensure detaching a referenced partition sees rows hidden by FORCE RLS +CREATE TABLE r1 (a int PRIMARY KEY) PARTITION BY LIST (a); +CREATE TABLE r1_1 PARTITION OF r1 FOR VALUES IN (10); +CREATE TABLE r1_2 PARTITION OF r1 FOR VALUES IN (20); +CREATE TABLE r2 (a int REFERENCES r1); +INSERT INTO r1 VALUES (10), (20); +INSERT INTO r2 VALUES (10), (20); +CREATE POLICY p1 ON r2 USING (a <> 20); +ALTER TABLE r2 ENABLE ROW LEVEL SECURITY; +ALTER TABLE r2 FORCE ROW LEVEL SECURITY; +ALTER TABLE r1 DETACH PARTITION r1_2; -- error +DROP TABLE r2; +DROP TABLE r1; + -- -- Test INSERT+RETURNING applies SELECT policies as -- WithCheckOptions (meaning an error is thrown) -- 2.37.1 (Apple Git-137.1)