postgresql_privs - Improved roles management

changelogs/fragments/502_postgresql_privs.yml

@@ -0,0 +1,3 @@
+minor_changes:
+- "postgresql_privs - added support for implicit roles CURRENT_ROLE, CURRENT_USER, and SESSION_USER (https://github.com/ansible-collections/community.postgresql/pull/502)."
+- "postgresql_privs - added idempotence when roles=PUBLIC (https://github.com/ansible-collections/community.postgresql/pull/502)."

plugins/modules/postgresql_privs.py

@@ -77,8 +77,9 @@
   roles:
     description:
     - Comma separated list of role (user/group) names to set permissions for.
-    - The special value C(PUBLIC) can be provided instead to set permissions
-      for the implicitly defined PUBLIC group.
+    - Roles C(PUBLIC), C(CURRENT_ROLE), C(CURRENT_USER), C(SESSION_USER) are implicitly defined in PostgreSQL.
+    - C(CURRENT_USER) and C(SESSION_USER) implicit roles are supported since collection version 3.1.0 and PostgreSQL 9.5.
+    - C(CURRENT_ROLE) implicit role is supported since collection version 3.1.0 and PostgreSQL 14.
     type: str
     required: true
     aliases:
@@ -133,7 +134,6 @@
   C(present) and I(grant_option) to C(false) (see examples).
 - Note that when revoking privileges from a role R, this role  may still have
   access via privileges granted to any role R is a member of including C(PUBLIC).
-- Note that when you use C(PUBLIC) role, the module always reports that the state has been changed.
 - Note that when revoking privileges from a role R, you do so as the user
   specified via I(login_user). If R has been granted the same privileges by
   another user also, R can still access database objects via these privileges.
@@ -424,6 +424,10 @@
                       'FUNCTIONS': ('ALL', 'EXECUTE'),
                       'TYPES': ('ALL', 'USAGE'),
                       'SCHEMAS': ('CREATE', 'USAGE'), }
+VALID_IMPLICIT_ROLES = {'PUBLIC': 0,
+                        'CURRENT_USER': 95000,
+                        'SESSION_USER': 95000,
+                        'CURRENT_ROLE': 140000, }
 
 executed_queries = []
 
@@ -432,19 +436,6 @@ class Error(Exception):
     pass
 
 
-def role_exists(module, cursor, rolname):
-    """Check user exists or not"""
-    query = "SELECT 1 FROM pg_roles WHERE rolname = '%s'" % rolname
-    try:
-        cursor.execute(query)
-        return cursor.rowcount > 0
-
-    except Exception as e:
-        module.fail_json(msg="Cannot execute SQL '%s': %s" % (query, to_native(e)))
-
-    return False
-
-
 # We don't have functools.partial in Python < 2.5
 def partial(f, *args, **kwargs):
     """Partial function application"""
@@ -477,6 +468,11 @@ def __init__(self, params, module):
         self.cursor = self.connection.cursor()
         self.pg_version = self.connection.server_version
 
+        # implicit roles in current pg version
+        self.pg_implicit_roles = tuple(
+            implicit_role for implicit_role, version_min in VALID_IMPLICIT_ROLES.items() if self.pg_version >= version_min
+        )
+
     def commit(self):
         self.connection.commit()
 
@@ -488,8 +484,23 @@ def encoding(self):
         """Connection encoding in Python-compatible form"""
         return psycopg2.extensions.encodings[self.connection.encoding]
 
+    # Methods for implicit roles managements
+
+    def is_implicit_role(self, rolname):
+        return rolname.upper() in self.pg_implicit_roles
+
     # Methods for querying database objects
 
+    def role_exists(self, rolname):
+        # check if rolname is a implicit role
+        if self.is_implicit_role(rolname):
+            return True
+
+        # check if rolname is present in pg_catalog.pg_roles
+        query = "SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = %s"
+        self.cursor.execute(query, (rolname,))
+        return self.cursor.rowcount > 0
+
     # PostgreSQL < 9.0 doesn't support "ALL TABLES IN SCHEMA schema"-like
     # phrases in GRANT or REVOKE statements, therefore alternative methods are
     # provided here.
@@ -698,9 +709,8 @@ def manipulate_privs(self, obj_type, privs, objs, orig_objs, roles, target_roles
                       or None if type is "group".
         :param objs: List of database objects to grant/revoke
                      privileges for.
-        :param orig_objs: ALL_IN_SCHEMA or None
-        :param roles: Either a list of role names or "PUBLIC"
-                      for the implicitly defined "PUBLIC" group
+        :param orig_objs: ALL_IN_SCHEMA or None.
+        :param roles: List of role names.
         :param target_roles: List of role names to grant/revoke
                              default privileges as.
         :param state: "present" to grant privileges, "absent" to revoke.
@@ -778,26 +788,11 @@ def manipulate_privs(self, obj_type, privs, objs, orig_objs, roles, target_roles
                 set_what = '%s ON %s %s' % (','.join(privs), obj_type.replace('_', ' '), ','.join(obj_ids))
 
         # for_whom: SQL-fragment specifying for whom to set the above
-        if roles == 'PUBLIC':
-            for_whom = 'PUBLIC'
-        else:
-            for_whom = []
-            for r in roles:
-                if not role_exists(self.module, self.cursor, r):
-                    if fail_on_role:
-                        self.module.fail_json(msg="Role '%s' does not exist" % r.strip())
-
-                    else:
-                        self.module.warn("Role '%s' does not exist, pass it" % r.strip())
-                else:
-                    for_whom.append('"%s"' % r)
-
-            if not for_whom:
-                return False
-
-            for_whom = ','.join(for_whom)
+        if not roles:
+            return False
+        for_whom = ','.join(roles)
 
-        # as_who:
+        # as_who: SQL-fragment specifying to who to set the above
         as_who = None
         if target_roles:
             as_who = ','.join('"%s"' % r for r in target_roles)
@@ -816,8 +811,6 @@ def manipulate_privs(self, obj_type, privs, objs, orig_objs, roles, target_roles
 
         executed_queries.append(query)
         self.cursor.execute(query)
-        if roles == 'PUBLIC':
-            return True
 
         status_after = get_status(objs)
 
@@ -1120,17 +1113,25 @@ def main():
                 objs = [obj.replace(':', ',') for obj in objs]
 
         # roles
-        if p.roles.upper() == 'PUBLIC':
-            roles = 'PUBLIC'
-        else:
-            roles = p.roles.split(',')
-
-            if len(roles) == 1 and not role_exists(module, conn.cursor, roles[0]):
+        roles = []
+        roles_raw = p.roles.split(',')
+        for r in roles_raw:
+            if conn.role_exists(r):
+                if conn.is_implicit_role(r):
+                    # Some implicit roles (as PUBLIC) works in uppercase without double quotes and in lowercase with double quotes.
+                    # Other implicit roles (as SESSION_USER) works only in uppercase without double quotes.
+                    # So the approach that works for all implicit roles is uppercase without double quotes.
+                    roles.append('%s' % r.upper())
+                else:
+                    roles.append('"%s"' % r)
+            else:
                 if fail_on_role:
-                    module.fail_json(msg="Role '%s' does not exist" % roles[0].strip())
+                    module.fail_json(msg="Role '%s' does not exist" % r)
                 else:
-                    module.warn("Role '%s' does not exist, nothing to do" % roles[0].strip())
-                module.exit_json(changed=False, queries=executed_queries)
+                    module.warn("Role '%s' does not exist, pass it" % r)
+        if not roles:
+            module.warn("No valid roles provided, nothing to do")
+            module.exit_json(changed=False, queries=executed_queries)
 
         # check if target_roles is set with type: default_privs
         if p.target_roles and not p.type == 'default_privs':

tests/integration/targets/postgresql_privs/tasks/postgresql_privs_general.yml

@@ -1554,7 +1554,7 @@
   register: result
 - assert:
     that:
-      - result is changed
+      - result is not changed
 - name: check permissions on tables in schemas with special names
   become: true
   become_user: "{{ pg_user }}"

tests/integration/targets/postgresql_privs/tasks/postgresql_privs_initial.yml

@@ -343,22 +343,144 @@
     target_roles: "{{ db_user_with_dots2 }}"
     trust_input: false
 
-# Bugfix for https://github.com/ansible-collections/community.general/issues/857
-- name: Test passing lowercase PUBLIC role
+# https://github.com/ansible-collections/community.postgresql/pull/502 - role PUBLIC
+- name: Test passing lowercase PUBLIC role - Grant CREATE ON DATABASE - Test
   become_user: "{{ pg_user }}"
   become: true
   postgresql_privs:
     db: "{{ db_name }}"
     login_user: "{{ pg_user }}"
+    state: present
     type: 'database'
-    privs: 'connect'
+    privs: 'create'
     role: 'public'
   register: result
 
 - assert:
     that:
     - result is changed
-    - result.queries == ["GRANT CONNECT ON database \"{{ db_name }}\" TO PUBLIC;"]
+    - result.queries == ["GRANT CREATE ON database \"{{ db_name }}\" TO PUBLIC;"]
+
+- name: Test passing lowercase PUBLIC role - Grant CREATE ON DATABASE - Idempotence
+  become_user: "{{ pg_user }}"
+  become: true
+  postgresql_privs:
+    db: "{{ db_name }}"
+    login_user: "{{ pg_user }}"
+    state: present
+    type: 'database'
+    privs: 'create'
+    role: 'public'
+  register: result
+
+- assert:
+    that:
+    - result is not changed
+    - result.queries == ["GRANT CREATE ON database \"{{ db_name }}\" TO PUBLIC;"]
+
+- name: Test passing lowercase PUBLIC role - Revoke CREATE ON DATABASE - Test
+  become_user: "{{ pg_user }}"
+  become: true
+  postgresql_privs:
+    db: "{{ db_name }}"
+    login_user: "{{ pg_user }}"
+    state: absent
+    type: 'database'
+    privs: 'create'
+    role: 'public'
+  register: result
+
+- assert:
+    that:
+    - result is changed
+    - result.queries == ["REVOKE CREATE ON database \"{{ db_name }}\" FROM PUBLIC;"]
+
+- name: Test passing lowercase PUBLIC role - Revoke CREATE ON DATABASE - Test
+  become_user: "{{ pg_user }}"
+  become: true
+  postgresql_privs:
+    db: "{{ db_name }}"
+    login_user: "{{ pg_user }}"
+    state: absent
+    type: 'database'
+    privs: 'create'
+    role: 'public'
+  register: result
+
+- assert:
+    that:
+    - result is not changed
+    - result.queries == ["REVOKE CREATE ON database \"{{ db_name }}\" FROM PUBLIC;"]
+
+# https://github.com/ansible-collections/community.postgresql/pull/502 - role SESSION_USER
+# first revoke after grant, as the privilege is already granted
+- name: Test passing lowercase SESSION_USER role - Revoke CREATE ON DATABASE - Test
+  become_user: "{{ pg_user }}"
+  become: true
+  postgresql_privs:
+    db: "{{ db_name }}"
+    login_user: "{{ pg_user }}"
+    state: absent
+    type: 'database'
+    privs: 'create'
+    role: 'session_user'
+  register: result
+
+- assert:
+    that:
+    - result is changed
+    - result.queries == ["REVOKE CREATE ON database \"{{ db_name }}\" FROM SESSION_USER;"]
+
+- name: Test passing lowercase SESSION_USER role - Revoke CREATE ON DATABASE - Test
+  become_user: "{{ pg_user }}"
+  become: true
+  postgresql_privs:
+    db: "{{ db_name }}"
+    login_user: "{{ pg_user }}"
+    state: absent
+    type: 'database'
+    privs: 'create'
+    role: 'session_user'
+  register: result
+
+- assert:
+    that:
+    - result is not changed
+    - result.queries == ["REVOKE CREATE ON database \"{{ db_name }}\" FROM SESSION_USER;"]
+
+- name: Test passing lowercase SESSION_USER role - Grant CREATE ON DATABASE - Test
+  become_user: "{{ pg_user }}"
+  become: true
+  postgresql_privs:
+    db: "{{ db_name }}"
+    login_user: "{{ pg_user }}"
+    state: present
+    type: 'database'
+    privs: 'create'
+    role: 'session_user'
+  register: result
+
+- assert:
+    that:
+    - result is changed
+    - result.queries == ["GRANT CREATE ON database \"{{ db_name }}\" TO SESSION_USER;"]
+
+- name: Test passing lowercase SESSION_USER role - Grant CREATE ON DATABASE - Idempotence
+  become_user: "{{ pg_user }}"
+  become: true
+  postgresql_privs:
+    db: "{{ db_name }}"
+    login_user: "{{ pg_user }}"
+    state: present
+    type: 'database'
+    privs: 'create'
+    role: 'session_user'
+  register: result
+
+- assert:
+    that:
+    - result is not changed
+    - result.queries == ["GRANT CREATE ON database \"{{ db_name }}\" TO SESSION_USER;"]
 
 #
 # Cleanup