remove wildcard handling from rls policies

adityathebe · adityathebe · commit c7bc2c5a708d · 2026-01-16T00:08:37.000+05:45
diff --git a/api/config.go b/api/config.go
@@ -10,12 +10,13 @@ import (
 
 var DefaultConfig = Config{
 	Postgrest: PostgrestConfig{
-		Version:    "v10.0.0",
-		DBRole:     "postgrest_api",
-		AnonDBRole: "",
-		Port:       3000,
-		AdminPort:  3001,
-		MaxRows:    2000,
+		Version:      "v10.0.0",
+		DBRole:       "postgrest_api",
+		DBRoleBypass: "rls-bypasser",
+		AnonDBRole:   "",
+		Port:         3000,
+		AdminPort:    3001,
+		MaxRows:      2000,
 	},
 }
 
@@ -123,15 +124,22 @@ func (c Config) GetUsername() string {
 }
 
 type PostgrestConfig struct {
-	Port       int
-	Disable    bool
-	LogLevel   string
-	URL        string
-	Version    string
-	JWTSecret  string
-	DBRole     string
+	Port      int
+	Disable   bool
+	LogLevel  string
+	URL       string
+	Version   string
+	JWTSecret string
+	AdminPort int
+
+	// DBRole is the PostgREST role used for authenticated requests.
+	DBRole string
+
+	// DBRoleBypass is the PostgREST role used to bypass RLS for admin requests.
+	DBRoleBypass string
+
+	// AnonDBRole is the PostgREST role used for unauthenticated requests.
 	AnonDBRole string
-	AdminPort  int
 
 	// A hard limit to the number of rows PostgREST will fetch from a view, table, or stored procedure.
 	// Limits payload size for accidental or malicious requests.
diff --git a/db.go b/db.go
@@ -259,6 +259,12 @@ func setStatementTimeouts(ctx dutyContext.Context, config api.Config) {
 		logger.Errorf(err.Error())
 	}
 
+	if config.Postgrest.DBRoleBypass != "" {
+		if err := ctx.DB().Raw(fmt.Sprintf(`ALTER ROLE %s SET statement_timeout = '%0fs'`, config.Postgrest.DBRoleBypass, postgrestTimeout.Seconds())).Error; err != nil {
+			logger.Errorf(err.Error())
+		}
+	}
+
 	if config.Postgrest.AnonDBRole != "" {
 		if err := ctx.DB().Raw(fmt.Sprintf(`ALTER ROLE %s SET statement_timeout = '%0fs'`, config.Postgrest.AnonDBRole, postgrestTimeout.Seconds())).Error; err != nil {
 			logger.Errorf(err.Error())
diff --git a/migrate/migrate.go b/migrate/migrate.go
@@ -270,6 +270,19 @@ func grantPostgrestRolesToCurrentUser(pool *sql.DB, config api.Config) error {
 		"ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO %s"); err != nil {
 		return err
 	}
+
+	if config.Postgrest.DBRoleBypass != "" {
+		if err := createRole(pool, config.Postgrest.DBRoleBypass, config,
+			"GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO %s",
+			"GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO %s",
+			"GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO %s",
+			"ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO %s"); err != nil {
+			return err
+		}
+		if _, err := pool.Exec(fmt.Sprintf("ALTER ROLE %s BYPASSRLS", config.Postgrest.DBRoleBypass)); err != nil {
+			logger.GetLogger("migrate").Errorf("Failed to set BYPASSRLS for role %s: %v", config.Postgrest.DBRoleBypass, err)
+		}
+	}
 	if err := createRole(pool, config.Postgrest.AnonDBRole, config,
 		"GRANT SELECT ON ALL TABLES IN SCHEMA public TO %s",
 		"ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO %s"); err != nil {
diff --git a/rls/payload.go b/rls/payload.go
@@ -67,15 +67,26 @@ func (t *Payload) Fingerprint() string {
 
 // Injects the payload as local parameter
 func (t Payload) SetPostgresSessionRLS(db *gorm.DB) error {
-	return t.setPostgresSessionRLS(db, true)
+	return t.setPostgresSessionRLS(db, true, "postgrest_api")
 }
 
 // Injects the payload as sessions parameter
 func (t Payload) SetGlobalPostgresSessionRLS(db *gorm.DB) error {
-	return t.setPostgresSessionRLS(db, false)
+	return t.setPostgresSessionRLS(db, false, "postgrest_api")
 }
 
-func (t Payload) setPostgresSessionRLS(db *gorm.DB, local bool) error {
+func (t Payload) SetPostgresSessionRLSWithRole(db *gorm.DB, role string) error {
+	return t.setPostgresSessionRLS(db, true, role)
+}
+
+func (t Payload) SetGlobalPostgresSessionRLSWithRole(db *gorm.DB, role string) error {
+	return t.setPostgresSessionRLS(db, false, role)
+}
+
+func (t Payload) setPostgresSessionRLS(db *gorm.DB, local bool, role string) error {
+	if role == "" {
+		return fmt.Errorf("role is required")
+	}
 	rlsJSON, err := json.Marshal(t)
 	if err != nil {
 		return fmt.Errorf("failed to marshall to json: %w", err)
@@ -86,7 +97,7 @@ func (t Payload) setPostgresSessionRLS(db *gorm.DB, local bool) error {
 		scope = "LOCAL"
 	}
 
-	if err := db.Exec(fmt.Sprintf("SET %s ROLE postgrest_api", scope)).Error; err != nil {
+	if err := db.Exec(fmt.Sprintf("SET %s ROLE %s", scope, role)).Error; err != nil {
 		return fmt.Errorf("failed to set role: %w", err)
 	}
 
diff --git a/tests/rls_test.go b/tests/rls_test.go
@@ -43,12 +43,6 @@ func payloadWithScopes(scopeIDs ...*uuid.UUID) func() rls.Payload {
 	}
 }
 
-func payloadDisabled() func() rls.Payload {
-	return func() rls.Payload {
-		return rls.Payload{Disable: true}
-	}
-}
-
 func resetScopes(db *gorm.DB, tables ...string) {
 	for _, table := range tables {
 		Expect(db.Exec(fmt.Sprintf("UPDATE %s SET __scope = NULL", table)).Error).To(BeNil())
@@ -112,7 +106,6 @@ var _ = Describe("RLS scopes", Ordered, ContinueOnFailure, func() {
 					Entry("no scopes", scopeCase{payload: payloadNoScopes(), expectedCount: lo.ToPtr(int64(0))}),
 					Entry("aws scope", scopeCase{payload: payloadWithScopes(&awsScopeID), expectedCount: &awsConfigs}),
 					Entry("combined scopes", scopeCase{payload: payloadWithScopes(&awsScopeID, &demoScopeID), expectedCount: &awsOrDemo}),
-					Entry("rls disabled", scopeCase{payload: payloadDisabled(), expectedCount: &totalConfigs}),
 				)
 			})
 		}
diff --git a/views/035_rls_utils.sql b/views/035_rls_utils.sql
@@ -1,16 +1,3 @@
--- isolated from 9998_rls_enable.sql because generated tables in the view use it.
-CREATE
-OR REPLACE FUNCTION is_rls_disabled() RETURNS BOOLEAN AS $$
-DECLARE
-  jwt_claims TEXT;
-BEGIN
-  jwt_claims := current_setting('request.jwt.claims', TRUE);
-  RETURN (jwt_claims IS NULL
-    OR jwt_claims = ''
-    OR jwt_claims::jsonb ->> 'disable_rls' IS NOT NULL);
-END;
-$$ LANGUAGE plpgsql SECURITY INVOKER;
-
 -- rls_scope_access returns scope UUIDs from request.jwt.claims (empty when missing).
 CREATE
 OR REPLACE FUNCTION rls_scope_access() RETURNS UUID[] AS $$
diff --git a/views/9998_rls_enable.sql b/views/9998_rls_enable.sql
@@ -57,10 +57,7 @@ DROP POLICY IF EXISTS config_items_auth ON config_items;
 CREATE POLICY config_items_auth ON config_items
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE
-        (config_items.__scope && rls_scope_access())
-      END
+      (config_items.__scope && rls_scope_access())
     );
 
 -- Policy config_changes 
@@ -69,14 +66,12 @@ DROP POLICY IF EXISTS config_changes_auth ON config_changes;
 CREATE POLICY config_changes_auth ON config_changes
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE EXISTS (
+      EXISTS (
         -- just leverage the RLS on config_items
         SELECT 1
         FROM config_items
         WHERE config_items.id = config_changes.config_id
       )
-      END
     );
 
 -- Policy config_analysis
@@ -85,14 +80,12 @@ DROP POLICY IF EXISTS config_analysis_auth ON config_analysis;
 CREATE POLICY config_analysis_auth ON config_analysis
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE EXISTS (
+      EXISTS (
         -- just leverage the RLS on config_items
         SELECT 1
         FROM config_items
         WHERE config_items.id = config_analysis.config_id
       )
-      END
     );
 
 -- Policy config_relationships
@@ -101,13 +94,9 @@ DROP POLICY IF EXISTS config_relationships_auth ON config_relationships;
 CREATE POLICY config_relationships_auth ON config_relationships
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE (
-        -- just leverage the RLS on config_items - user must have access to both items
-        EXISTS (SELECT 1 FROM config_items WHERE config_items.id = config_relationships.config_id)
-        AND EXISTS (SELECT 1 FROM config_items WHERE config_items.id = config_relationships.related_id)
-      )
-      END
+      -- just leverage the RLS on config_items - user must have access to both items
+      EXISTS (SELECT 1 FROM config_items WHERE config_items.id = config_relationships.config_id)
+      AND EXISTS (SELECT 1 FROM config_items WHERE config_items.id = config_relationships.related_id)
     );
 
 -- Policy config_component_relationships
@@ -116,14 +105,12 @@ DROP POLICY IF EXISTS config_component_relationships_auth ON config_component_re
 CREATE POLICY config_component_relationships_auth ON config_component_relationships
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE EXISTS (
+      EXISTS (
         -- just leverage the RLS on config_items
         SELECT 1
         FROM config_items
         WHERE config_items.id = config_component_relationships.config_id
       )
-      END
     );
 
 -- Policy components
@@ -132,10 +119,7 @@ DROP POLICY IF EXISTS components_auth ON components;
 CREATE POLICY components_auth ON components
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE
-        (components.__scope && rls_scope_access())
-      END
+      (components.__scope && rls_scope_access())
     );
 
 -- Policy canaries
@@ -144,10 +128,7 @@ DROP POLICY IF EXISTS canaries_auth ON canaries;
 CREATE POLICY canaries_auth ON canaries
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE
-        (canaries.__scope && rls_scope_access())
-      END
+      (canaries.__scope && rls_scope_access())
     );
 
 -- Policy playbooks
@@ -156,10 +137,7 @@ DROP POLICY IF EXISTS playbooks_auth ON playbooks;
 CREATE POLICY playbooks_auth ON playbooks
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE
-        (playbooks.__scope && rls_scope_access())
-      END
+      (playbooks.__scope && rls_scope_access())
     );
 
 -- Policy playbook_runs
@@ -168,31 +146,27 @@ DROP POLICY IF EXISTS playbook_runs_auth ON playbook_runs;
 CREATE POLICY playbook_runs_auth ON playbook_runs
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE (
-        -- User must have access to the playbook
-        EXISTS (
-          SELECT 1
-          FROM playbooks
-          WHERE playbooks.id = playbook_runs.playbook_id
-        )
-        AND
-        -- AND if run has a config_id, user must have access to that config
-        (playbook_runs.config_id IS NULL OR EXISTS (
-          SELECT 1
-          FROM config_items
-          WHERE config_items.id = playbook_runs.config_id
-        ))
-        AND
-        -- AND if run has a check_id, user must have access to that check (via its canary)
-        (playbook_runs.check_id IS NULL OR EXISTS (
-          SELECT 1
-          FROM checks
-          WHERE checks.id = playbook_runs.check_id
-        ))
-        -- Note: component_id check omitted (phasing out topology soon)
+      -- User must have access to the playbook
+      EXISTS (
+        SELECT 1
+        FROM playbooks
+        WHERE playbooks.id = playbook_runs.playbook_id
       )
-      END
+      AND
+      -- AND if run has a config_id, user must have access to that config
+      (playbook_runs.config_id IS NULL OR EXISTS (
+        SELECT 1
+        FROM config_items
+        WHERE config_items.id = playbook_runs.config_id
+      ))
+      AND
+      -- AND if run has a check_id, user must have access to that check (via its canary)
+      (playbook_runs.check_id IS NULL OR EXISTS (
+        SELECT 1
+        FROM checks
+        WHERE checks.id = playbook_runs.check_id
+      ))
+      -- Note: component_id check omitted (phasing out topology soon)
     );
 
 -- Policy checks
@@ -201,14 +175,12 @@ DROP POLICY IF EXISTS checks_auth ON checks;
 CREATE POLICY checks_auth ON checks
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE EXISTS (
+      EXISTS (
         -- just leverage the RLS on canaries
         SELECT 1
         FROM canaries
         WHERE canaries.id = checks.canary_id
       )
-      END
     );
 
 -- Policy views
@@ -217,10 +189,7 @@ DROP POLICY IF EXISTS views_auth ON views;
 CREATE POLICY views_auth ON views
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE
-        (views.__scope && rls_scope_access())
-      END
+      (views.__scope && rls_scope_access())
     );
 
 -- Policy view_panels (inherits from parent views table)
@@ -229,13 +198,10 @@ DROP POLICY IF EXISTS view_panels_auth ON view_panels;
 CREATE POLICY view_panels_auth ON view_panels
   FOR ALL TO postgrest_api, postgrest_anon
     USING (
-      CASE WHEN (SELECT is_rls_disabled()) THEN TRUE
-      ELSE
-        EXISTS (
-          SELECT 1 FROM views
-          WHERE views.id = view_panels.view_id
-        )
-      END
+      EXISTS (
+        SELECT 1 FROM views
+        WHERE views.id = view_panels.view_id
+      )
     );
 
 ALTER VIEW analysis_by_config SET (security_invoker = true);

Original file line number	Diff line number	Diff line change
`@@ -43,12 +43,6 @@ func payloadWithScopes(scopeIDs ...*uuid.UUID) func() rls.Payload {`
`43`	`43`	`}`
`44`	`44`	`}`
`45`	`45`
`46`		`-func payloadDisabled() func() rls.Payload {`
`47`		`- return func() rls.Payload {`
`48`		`- return rls.Payload{Disable: true}`
`49`		`- }`
`50`		`-}`
`51`		`-`
`52`	`46`	`func resetScopes(db *gorm.DB, tables ...string) {`
`53`	`47`	`for _, table := range tables {`
`54`	`48`	`Expect(db.Exec(fmt.Sprintf("UPDATE %s SET __scope = NULL", table)).Error).To(BeNil())`
`@@ -112,7 +106,6 @@ var _ = Describe("RLS scopes", Ordered, ContinueOnFailure, func() {`
`112`	`106`	`Entry("no scopes", scopeCase{payload: payloadNoScopes(), expectedCount: lo.ToPtr(int64(0))}),`
`113`	`107`	`Entry("aws scope", scopeCase{payload: payloadWithScopes(&awsScopeID), expectedCount: &awsConfigs}),`
`114`	`108`	`Entry("combined scopes", scopeCase{payload: payloadWithScopes(&awsScopeID, &demoScopeID), expectedCount: &awsOrDemo}),`
`115`		`- Entry("rls disabled", scopeCase{payload: payloadDisabled(), expectedCount: &totalConfigs}),`
`116`	`109`	`)`
`117`	`110`	`})`
`118`	`111`	`}`