Follow-on to #18: install and run the test suite as a genuine non-superuser

[jnasbyupgrade]

Stacked on #18 -- based on that PR's branch (fix/issue-14-clean, now also pushed here to Postgres-Extensions/test_factory so this PR can be opened against the real repo instead of fork-to-fork). GitHub will retarget this to master automatically once #18 merges.

Background

While updating #18, the question came up: could we run more of this test suite as a non-superuser, given #18 was exactly the kind of bug (SET ROLE permission check) that a superuser-run test suite can't naturally catch? That turned into two rounds:

Round 1 (running the application-level tests as non-superuser): found that test/helpers/create.sql already switches into a non-superuser test_role for most of base.sql/pgtap.sql -- but via SET ROLE, not SET SESSION AUTHORIZATION. That distinction matters: SET ROLE only changes current_user; Postgres's own permission check for a further SET ROLE (the exact class of check #18's bug was in) is based on session_user, which SET ROLE leaves untouched. Under pg_regress's superuser connection, that silently bypassed this whole class of check for the rest of the file. Fixed by switching to SET SESSION AUTHORIZATION. Also added test/sql/security.sql, proving the public tf.* API needs nothing beyond a freshly-created, unprivileged role.

Round 2 (actually installing the extension as non-superuser, closing the real gap #18's own description calls out: "can't be reproduced under pg_regress, which runs as a superuser"):

• Marked both control files superuser = false -- the pre-PG13 mechanism (not trusted, which is an unrecognized control-file key on PG10-12 and errors out entirely there, not just for non-superuser attempts; this project's CI still tests those versions). Verified empirically.
• test/sql/install.sql now creates a disposable NOSUPERUSER + CREATEROLE role (mirroring what a real RDS/Aurora master user has) and installs through it via SET SESSION AUTHORIZATION, replacing the indirect pg_auth_members proxy check from Fix CREATE EXTENSION on PG16+ for non-superuser installs (#14) #18 with a genuine end-to-end repro: before Fix CREATE EXTENSION on PG16+ for non-superuser installs (#14) #18's fix this fails with "must be able to SET ROLE test_factory__owner"; after the fix it succeeds.
• Needed two grants beyond CREATEROLE, found by actually running this rather than reasoning about it: USAGE on the tap schema (pgtap test-harness necessity) and CREATE on the current database (never granted to PUBLIC by default -- only CONNECT/TEMP are).
• Fixed a real local-iteration flakiness this surfaced: test_factory__owner is deliberately left behind by DROP EXTENSION (so a real install/uninstall cycle by the same installer keeps working), but this test creates a fresh disposable installer role every run, so an orphaned owner role from a previous run belongs to an installer that no longer exists, breaking GRANT ... WITH SET. install.sql now drops both roles at start and end of the file.

Test plan

• make test -- all 4 regression tests pass (base, install, pgtap, security)
• Verified stable across many repeated make test runs against the same live cluster (this surfaced and fixed the role-leakage flakiness above)
• test/expected/base.out/pgtap.out/security.out unchanged; install.out updated only for the renamed test description

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5dfa1fbc-fad5-4960-8fd8-2f53aaf8cc7d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}