Skip to content

Views/Materialized Views: MAINTAIN privilege silently dropped on PG17+ (allowed_privs.json looked up at wrong path) #10350

Description

@dpage

Describe the bug

views/__init__.py:360 sets a fixed relative suffix for locating the allowed-privileges list:

_ALLOWED_PRIVS_JSON = 'sql/allowed_privs.json'

used at views/__init__.py:289:

self.allowed_acls = render_template(
    "/".join([self.template_path, self._ALLOWED_PRIVS_JSON])
)

For the default version bucket, the file genuinely lives under a sql/ subdirectory (e.g. templates/views/pg/default/sql/allowed_privs.json), so this resolves correctly. But for the PG17+ bucket, the file was added directly under the bucket directory, with no sql/ subdirectory:

web/pgadmin/browser/server_groups/servers/databases/schemas/views/templates/views/pg/17_plus/allowed_privs.json
web/pgadmin/browser/server_groups/servers/databases/schemas/views/templates/mviews/pg/17_plus/allowed_privs.json
web/pgadmin/browser/server_groups/servers/databases/schemas/views/templates/views/ppas/17_plus/allowed_privs.json
web/pgadmin/browser/server_groups/servers/databases/schemas/views/templates/mviews/ppas/17_plus/allowed_privs.json

So on PG17+/EPAS17+, render_template is asked for views/pg/17_plus/sql/allowed_privs.json, which doesn't exist. The failure is swallowed silently:

try:
    self.allowed_acls = render_template(...)
    self.allowed_acls = json.loads(self.allowed_acls)
except Exception as e:
    current_app.logger.exception(e)

with no user-visible error — self.allowed_acls simply doesn't pick up the 17_plus list, which is the one that adds MAINTAIN ('m') for views and materialized views. The result: the MAINTAIN checkbox still appears in the Grant Wizard / privileges UI (added via table.ui.js, shared across table-like objects), the user can tick it, but because allowed_acls never validated/loaded it for views/mviews, _parse_privileges drops it and the generated GRANT statement never includes MAINTAIN.

To Reproduce

  1. Connect to a PostgreSQL 17+ (or EPAS 17+) server.
  2. Open a view or materialized view's Properties/Security tab.
  3. Grant a role the MAINTAIN privilege and save.
  4. Check the generated SQL / re-open the properties: MAINTAIN was not actually granted.

Expected behavior

Either move the 17_plus allowed_privs.json files under a sql/ subdirectory to match the default bucket's layout, or make _ALLOWED_PRIVS_JSON version-bucket-aware, so the 17+ allowed-privileges list (including MAINTAIN) is actually loaded.

Found while re-verifying #5597 (MAINTAIN privilege support) — the table-side implementation is correct and complete; this is a views/mviews-specific packaging bug in the same feature.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions