pg_tde_grant_database_key_management_to_role() creates undeclared function dependencies that prevent role drop

General

Escalation

General

Escalation

Description

CREATE ROLE mohit;
SELECT pg_tde_grant_database_key_management_to_role('mohit');
DROP ROLE mohit;  -- Fails due to function privilege dependency

2025-05-19 05:28:22.777 UTC [3118717] ERROR:  role "mohit" cannot be dropped because some objects depend on it
2025-05-19 05:28:22.777 UTC [3118717] DETAIL:  privileges for function pg_tde_set_key_using_database_key_provider(text,text,boolean)
2025-05-19 05:28:22.777 UTC [3118717] STATEMENT:  drop role mohit;
ERROR:  role "mohit" cannot be dropped because some objects depend on it
DETAIL:  privileges for function pg_tde_set_key_using_database_key_provider(text,text,boolean)

Environment

None

Activity

mohit.joshi

June 3, 2025 at 4:25 PM

Verified that the grant/revoke functions have been successfully removed from the codebase.

commit ad8a0f0457390f4f113c7e5f9605dee16dad4d49
Author: Andreas Karlsson <andreas.karlsson@percona.com>
Date:   Fri May 30 21:39:55 2025 +0200

    PG-1605, PG-1606 Remove grant/revoke helper functions

    These helper functions were tricky to use correctly and did not add much
    vaule. Emulating a role this way does not really work in PostgreSQL. If
    people want this behavior they should use a real role.

andreas.karlsson

June 3, 2025 at 10:48 AM

The solution was to remove all these tricky to use functions. So nothing to test really.

Resize issue view side panel

Done

Details

Assignee

Unassigned

Reporter

mohit.joshi

Labels

pg_tde

Needs QA

Yes

Components

pg_tde

Sprint

Add sprint

Fix versions

pg_tde 1.0.0 - GA (WAL Beta)

Priority

Medium

Created May 19, 2025 at 5:31 AM

Updated June 3, 2025 at 4:25 PM

Resolved June 3, 2025 at 4:25 PM