diff --git a/manifests/server/grant.pp b/manifests/server/grant.pp index 2749e74f00..80ca540085 100644 --- a/manifests/server/grant.pp +++ b/manifests/server/grant.pp @@ -421,17 +421,22 @@ } } + # Function like has_database_privilege() refer the PUBLIC pseudo role as 'public' + # So we need to replace 'PUBLIC' by 'public'. + $_unless = $unless_function ? { false => undef, 'custom' => $custom_unless, - default => "SELECT 1 WHERE ${unless_function}('${role}', - '${_granted_object}${arguments}', '${unless_privilege}') = ${unless_is}", + default => $role ? { + 'PUBLIC' => "SELECT 1 WHERE ${unless_function}('public', '${_granted_object}${arguments}', '${unless_privilege}') = ${unless_is}", + default => "SELECT 1 WHERE ${unless_function}('${role}', '${_granted_object}${arguments}', '${unless_privilege}') = ${unless_is}", + } } $_onlyif = $onlyif_function ? { 'table_exists' => "SELECT true FROM pg_tables WHERE tablename = '${_togrant_object}'", 'language_exists' => "SELECT true from pg_language WHERE lanname = '${_togrant_object}'", - 'role_exists' => "SELECT 1 FROM pg_roles WHERE rolname = '${role}'", + 'role_exists' => "SELECT 1 FROM pg_roles WHERE rolname = '${role}' or '${role}' = 'PUBLIC'", 'function_exists' => "SELECT true FROM pg_proc WHERE (oid::regprocedure)::text = '${_togrant_object}${arguments}'", default => undef, } diff --git a/spec/unit/defines/server/grant_spec.rb b/spec/unit/defines/server/grant_spec.rb index 63d1e9e4ea..db4214b732 100644 --- a/spec/unit/defines/server/grant_spec.rb +++ b/spec/unit/defines/server/grant_spec.rb @@ -214,6 +214,34 @@ class {'postgresql::server':} end end + context 'with a role defined to PUBLIC' do + let :params do + { + db: 'test', + role: 'PUBLIC', + privilege: 'all', + object_name: ['myschema', 'mytable'], + object_type: 'table', + } + end + + let :pre_condition do + <<-EOS + class {'postgresql::server':} + postgresql::server::role { 'test': } + EOS + end + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_postgresql__server__grant('test') } + it { is_expected.to contain_postgresql__server__role('test') } + it do + is_expected.to contain_postgresql_psql('grant:test') + .with_command(%r{GRANT ALL ON TABLE "myschema"."mytable" TO\s* "PUBLIC"}m) + .with_unless(%r{SELECT 1 WHERE has_table_privilege\('public',\s*'myschema.mytable', 'INSERT'\)}m) + end + end + context 'function' do let :params do {