Source postgres: fix schema permission issue by sashaNeshcheret · Pull Request #19024 · airbytehq/airbyte

oneshcheret (sashaNeshcheret) · 2022-11-07T12:23:36Z

What

Based on issue, during sync user gets permission denied for schema. Need to void using tables from schemas where user don't have USAGE permissions

How

Updatde query that fetch metadata for tables with checking USAGE permissions for schema, it fixes case when user could pick up tables from schemas without permission during discovery. But in case when permission was revoked from user between discovery and sync, all not permitted tables will be skipped without any error, but as far as it happens silently
user can be confused that number tables after sync are less than picked during discovery.

🚨 User Impact 🚨

Are there any breaking changes? What is the end result perceived by the user? If yes, please merge this PR with the 🚨🚨 emoji so changelog authors can further highlight this if needed.

Pre-merge Checklist

Expand the relevant checklist and delete the others.

New Connector

Community member or Airbyter

Airbyter

If this is a community PR, the Airbyte engineer reviewing this PR is responsible for the below items.

Create a non-forked branch based on this PR and test the below items on it
Build is successful
If new credentials are required for use in CI, add them to GSM. Instructions.
/test connector=connectors/<name> command is passing
New Connector version released on Dockerhub by running the /publish command described here
After the connector is published, connector added to connector index as described here
Seed specs have been re-generated by building the platform and committing the changes to the seed spec files, as described here

Updating a connector

Community member or Airbyter

Grant edit access to maintainers (instructions)
Secrets in the connector's spec are annotated with airbyte_secret
Unit & integration tests added and passing. Community members, please provide proof of success locally e.g: screenshot or copy-paste unit, integration, and acceptance test output. To run acceptance tests for a Python connector, follow instructions in the README. For java connectors run ./gradlew :airbyte-integrations:connectors:<name>:integrationTest.
Code reviews completed
Documentation updated
- Connector's README.md
- Connector's bootstrap.md. See description and examples
- Changelog updated in docs/integrations/<source or destination>/<name>.md including changelog. See changelog example
PR name follows PR naming conventions

Airbyter

If this is a community PR, the Airbyte engineer reviewing this PR is responsible for the below items.

Create a non-forked branch based on this PR and test the below items on it
Build is successful
If new credentials are required for use in CI, add them to GSM. Instructions.
/test connector=connectors/<name> command is passing
New Connector version released on Dockerhub and connector version bumped by running the /publish command described here

Connector Generator

Issue acceptance criteria met
PR name follows PR naming conventions
If adding a new generator, add it to the list of scaffold modules being tested
The generator test modules (all connectors with -scaffold in their name) have been updated with the latest scaffold by running ./gradlew :airbyte-integrations:connector-templates:generator:testScaffoldTemplates then checking in your changes
Documentation which references the generator is updated as needed

Tests

Unit

Put your unit tests output here.

Integration

Put your integration tests output here.

Acceptance

Put your acceptance tests output here.

github-actions · 2022-11-07T12:24:30Z

Affected Connector Report

NOTE ⚠️ Changes in this PR affect the following connectors. Make sure to do the following as needed:

Run integration tests
Bump connector or module version
Add changelog
Publish the new version

⚠ Sources (3)

Connector	Version	Changelog	Publish
`source-alloydb`	`1.0.17`	✅	✅
`source-alloydb-strict-encrypt`	`1.0.17`	✅	⚠ (not in seed)
`source-postgres-strict-encrypt`	`1.0.30`	✅	⚠ (not in seed)

See "Actionable Items" below for how to resolve warnings and errors.

✅ Destinations (0)

Connector	Version	Changelog	Publish

See "Actionable Items" below for how to resolve warnings and errors.

✅ Other Modules (0)

Actionable Items

(click to expand)

Category	Status	Actionable Item
Version	❌ mismatch	The version of the connector is different from its normal variant. Please bump the version of the connector.
	⚠ doc not found	The connector does not seem to have a documentation file. This can be normal (e.g. basic connector like `source-jdbc` is not published or documented). Please double-check to make sure that it is not a bug.
Changelog	⚠ doc not found	The connector does not seem to have a documentation file. This can be normal (e.g. basic connector like `source-jdbc` is not published or documented). Please double-check to make sure that it is not a bug.
	❌ changelog missing	There is no chnagelog for the current version of the connector. If you are the author of the current version, please add a changelog.
Publish	⚠ not in seed	The connector is not in the seed file (e.g. `source_definitions.yaml`), so its publication status cannot be checked. This can be normal (e.g. some connectors are cloud-specific, and only listed in the cloud seed file). Please double-check to make sure that it is not a bug.
	❌ diff seed version	The connector exists in the seed file, but the latest version is not listed there. This usually means that the latest version is not published. Please use the `/publish` command to publish the latest version.

oneshcheret (sashaNeshcheret) · 2022-11-07T14:06:04Z

/test connector=connectors/source-postgres

🕑 connectors/source-postgres https://github.com/airbytehq/airbyte/actions/runs/3411017756
✅ connectors/source-postgres https://github.com/airbytehq/airbyte/actions/runs/3411017756
No Python unittests run

Build Passed

Test summary info:

All Passed

oneshcheret (sashaNeshcheret) · 2022-11-07T14:06:11Z

/test connector=connectors/source-postgres-strict-encrypt

🕑 connectors/source-postgres-strict-encrypt https://github.com/airbytehq/airbyte/actions/runs/3411017720
✅ connectors/source-postgres-strict-encrypt https://github.com/airbytehq/airbyte/actions/runs/3411017720
No Python unittests run

Build Passed

Test summary info:

All Passed

…ion-error

oneshcheret (sashaNeshcheret) · 2022-11-08T15:31:14Z

/test connector=connectors/source-postgres-strict-encrypt

🕑 connectors/source-postgres-strict-encrypt https://github.com/airbytehq/airbyte/actions/runs/3420841727
✅ connectors/source-postgres-strict-encrypt https://github.com/airbytehq/airbyte/actions/runs/3420841727
No Python unittests run

Build Passed

Test summary info:

All Passed

oneshcheret (sashaNeshcheret) · 2022-11-08T15:31:26Z

/test connector=connectors/source-postgres

🕑 connectors/source-postgres https://github.com/airbytehq/airbyte/actions/runs/3420843643
✅ connectors/source-postgres https://github.com/airbytehq/airbyte/actions/runs/3420843643
No Python unittests run

Build Passed

Test summary info:

All Passed

oneshcheret (sashaNeshcheret) · 2022-11-08T15:32:57Z

/test connector=connectors/source-alloydb-strict-encrypt

🕑 connectors/source-alloydb-strict-encrypt https://github.com/airbytehq/airbyte/actions/runs/3420856607
✅ connectors/source-alloydb-strict-encrypt https://github.com/airbytehq/airbyte/actions/runs/3420856607
No Python unittests run

Build Passed

Test summary info:

All Passed

oneshcheret (sashaNeshcheret) · 2022-11-08T15:33:07Z

/test connector=connectors/source-alloydb

🕑 connectors/source-alloydb https://github.com/airbytehq/airbyte/actions/runs/3420857495
✅ connectors/source-alloydb https://github.com/airbytehq/airbyte/actions/runs/3420857495
No Python unittests run

Build Passed

Test summary info:

All Passed

Akash Kulkarni (akashkulk)

Looking at the issue, I'm not sure we want to silently fail as we're doing. If I understand correctly, in the case where:

User configures streams assc with schema they have access to
User then has access revoked from some of the schemas
User runs a sync, which appears to run successfully but data from the schemas that they no longer have access to fail

In this case, the user might wonder why records from certain schemas might be missing? But looking at this, we see that the same issue holds for table privilege.

We may want to throw a ConfigErrorException here instead

Akash Kulkarni (akashkulk) · 2022-11-18T01:23:09Z

Related to this - am I correct in understanding that today, while calling discover() the user is allowed to choose tables from schemas that they do not have access to?

oneshcheret (sashaNeshcheret) · 2022-11-18T10:27:14Z

Yes as answering on your last question. I started to work on issue that user gets permission denied exception during sync, but during investigation i found that user can choose tables from schemas without usage permissions during discovery. Pr is fixing root cause, and as far as we run this code before sync we will not catch such exception.

For not skipping schema without permission silently we should add additional step during discovery for verifying schema permissions for all schemas that user specified during creating source, wdyt?

Akash Kulkarni (akashkulk) · 2022-11-18T21:22:33Z

I think that makes sense. Ideally, after this change, few people will get into the state as they will be unable to choose a schema during discovery that they do not have permissions for.

It seems like we silently fail syncs today if the current user loses select privileges for a table as well? This just adds a similar failure mode to that case.

Created https://github.com/airbytehq/airbyte-internal-issues/issues/2658 to track this partial sync scenario

Akash Kulkarni (akashkulk)

Can you add a similar test for the discover() case too (discover shouldn't be returning tables assc with schemas user has no access to)

Brian Leonard (bleonard) · 2022-11-21T23:49:20Z

                 FROM   pg_class c
                 JOIN   pg_namespace n on c.relnamespace = n.oid
                 WHERE  has_table_privilege(c.oid, 'SELECT')
+                 AND    has_schema_privilege(current_user, nspname, 'USAGE')


…ma-permission-error' into omneshcheret/18161-postgres-schema-permission-error

…ion-error

…postgres-schema-permission-error

oneshcheret (sashaNeshcheret) · 2022-11-29T15:29:32Z

/publish connector=connectors/source-postgres-strict-encrypt

🕑 Publishing the following connectors:
connectors/source-postgres-strict-encrypt
https://github.com/airbytehq/airbyte/actions/runs/3575550584

Connector	Did it publish?	Were definitions generated?
connectors/source-postgres-strict-encrypt	✅	❌

if you have connectors that successfully published but failed definition generation, follow step 4 here ▶️

oneshcheret (sashaNeshcheret) · 2022-11-29T15:29:42Z

/publish connector=connectors/source-postgres

🕑 Publishing the following connectors:
connectors/source-postgres
https://github.com/airbytehq/airbyte/actions/runs/3575551797

Connector	Did it publish?	Were definitions generated?
connectors/source-postgres	✅	✅

if you have connectors that successfully published but failed definition generation, follow step 4 here ▶️

…ion-error

Rodi Reich Zilberman (rodireich) · 2022-12-02T18:06:37Z

I merged to master to get it to the latest published change.

Source postgres: fix schema permission issue

c9e43f5

github-actions Bot added the area/connectors Connector related issues label Nov 7, 2022

Octavia Squidington IV (octavia-squidington-iv) added the connectors/source/postgres label Nov 7, 2022

oneshcheret (sashaNeshcheret) and others added 3 commits November 8, 2022 17:02

Source postgres: add test for schema permission issue

a1a12d8

Source postgres: format code

5035e6f

Merge branch 'master' into omneshcheret/18161-postgres-schema-permiss…

6257d68

…ion-error

oneshcheret (sashaNeshcheret) marked this pull request as ready for review November 8, 2022 15:30

oneshcheret (sashaNeshcheret) requested a review from a team as a code owner November 8, 2022 15:30

oneshcheret (sashaNeshcheret) temporarily deployed to more-secrets November 8, 2022 15:32 Inactive

Akash Kulkarni (akashkulk) reviewed Nov 18, 2022

View reviewed changes

Brian Leonard (bleonard) reviewed Nov 21, 2022

View reviewed changes

Source postgres: added unit test

52b9065

oneshcheret (sashaNeshcheret) requested review from Akash Kulkarni (akashkulk) and Brian Leonard (bleonard) November 24, 2022 14:44

Merge remote-tracking branch 'origin/omneshcheret/18161-postgres-sche…

a278654

…ma-permission-error' into omneshcheret/18161-postgres-schema-permission-error

oneshcheret (sashaNeshcheret) temporarily deployed to more-secrets November 27, 2022 12:07 Inactive

Akash Kulkarni (akashkulk) approved these changes Nov 27, 2022

View reviewed changes

Merge branch 'master' into omneshcheret/18161-postgres-schema-permiss…

bc2f378

…ion-error

oneshcheret (sashaNeshcheret) temporarily deployed to more-secrets November 28, 2022 11:51 Inactive

oneshcheret (sashaNeshcheret) added 2 commits November 29, 2022 16:52

Merge remote-tracking branch 'origin/master' into omneshcheret/18161-…

c1a4bfd

…postgres-schema-permission-error

Source postgres: bump version

9838a9e

Octavia Squidington IV (octavia-squidington-iv) added connectors/source/postgres-strict-encrypt area/documentation Improvements or additions to documentation labels Nov 29, 2022

oneshcheret (sashaNeshcheret) temporarily deployed to more-secrets November 29, 2022 15:27 Inactive

auto-bump connector version

ea56aa7

Octavia Squidington III (octavia-squidington-iii) temporarily deployed to more-secrets November 29, 2022 16:19 Inactive

Merge branch 'master' into omneshcheret/18161-postgres-schema-permiss…

f58d9f4

…ion-error

Rodi Reich Zilberman (rodireich) merged commit 1fd4a03 into master Dec 2, 2022

Rodi Reich Zilberman (rodireich) deleted the omneshcheret/18161-postgres-schema-permission-error branch December 2, 2022 18:04

Rodi Reich Zilberman (rodireich) temporarily deployed to more-secrets December 2, 2022 18:05 Inactive

github-actions Bot mentioned this pull request Dec 2, 2022

Bump helm chart version reference to 0.42.4 #20029

Closed

Conversation

oneshcheret (sashaNeshcheret) commented Nov 7, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

How

Recommended reading order

🚨 User Impact 🚨

Pre-merge Checklist

Community member or Airbyter

Airbyter

Community member or Airbyter

Airbyter

Tests

Uh oh!

github-actions Bot commented Nov 7, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Affected Connector Report

⚠ Sources (3)

✅ Destinations (0)

✅ Other Modules (0)

Actionable Items

Uh oh!

oneshcheret (sashaNeshcheret) commented Nov 7, 2022 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Build Passed

Uh oh!

oneshcheret (sashaNeshcheret) commented Nov 7, 2022 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Build Passed

Uh oh!

oneshcheret (sashaNeshcheret) commented Nov 8, 2022 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Build Passed

Uh oh!

oneshcheret (sashaNeshcheret) commented Nov 8, 2022 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Build Passed

Uh oh!

oneshcheret (sashaNeshcheret) commented Nov 8, 2022 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Build Passed

Uh oh!

oneshcheret (sashaNeshcheret) commented Nov 8, 2022 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Build Passed

Uh oh!

Akash Kulkarni (akashkulk) left a comment

Choose a reason for hiding this comment

Uh oh!

Akash Kulkarni (akashkulk) commented Nov 18, 2022

Uh oh!

oneshcheret (sashaNeshcheret) commented Nov 18, 2022

Uh oh!

Akash Kulkarni (akashkulk) commented Nov 18, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Akash Kulkarni (akashkulk) left a comment

Choose a reason for hiding this comment

Uh oh!

Brian Leonard (bleonard) Nov 21, 2022

Choose a reason for hiding this comment

Uh oh!

oneshcheret (sashaNeshcheret) commented Nov 29, 2022 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oneshcheret (sashaNeshcheret) commented Nov 29, 2022 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Rodi Reich Zilberman (rodireich) commented Dec 2, 2022

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

oneshcheret (sashaNeshcheret) commented Nov 7, 2022 •

edited

Loading

github-actions Bot commented Nov 7, 2022 •

edited

Loading

oneshcheret (sashaNeshcheret) commented Nov 7, 2022 •

edited by github-actions Bot

Loading

oneshcheret (sashaNeshcheret) commented Nov 7, 2022 •

edited by github-actions Bot

Loading

oneshcheret (sashaNeshcheret) commented Nov 8, 2022 •

edited by github-actions Bot

Loading

oneshcheret (sashaNeshcheret) commented Nov 8, 2022 •

edited by github-actions Bot

Loading

oneshcheret (sashaNeshcheret) commented Nov 8, 2022 •

edited by github-actions Bot

Loading

oneshcheret (sashaNeshcheret) commented Nov 8, 2022 •

edited by github-actions Bot

Loading

Akash Kulkarni (akashkulk) commented Nov 18, 2022 •

edited

Loading

oneshcheret (sashaNeshcheret) commented Nov 29, 2022 •

edited by github-actions Bot

Loading

oneshcheret (sashaNeshcheret) commented Nov 29, 2022 •

edited by github-actions Bot

Loading