-- fails, binary plugin, textual consumer
SELECT data FROM pg_logical_slot_get_changes('regression_slot', NULL, NULL, 'force-binary', '1', 'skip-empty-xacts', '1');
-ERROR: logical decoding output plugin "test_decoding" produces binary output, but "pg_logical_slot_get_changes(name,pg_lsn,integer,text[])" expects textual data
+ERROR: logical decoding output plugin "test_decoding" produces binary output, but function "pg_logical_slot_get_changes(name,pg_lsn,integer,text[])" expects textual data
-- succeeds, textual plugin, binary consumer
SELECT data FROM pg_logical_slot_get_binary_changes('regression_slot', NULL, NULL, 'force-binary', '0', 'skip-empty-xacts', '1');
data
nmembers + MULTIXACT_MEMBERS_PER_PAGE * SLRU_PAGES_PER_SEGMENT * OFFSET_WARN_SEGMENTS))
ereport(WARNING,
(errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
- errmsg("database with OID %u must be vacuumed before %d more multixact members are used",
+ errmsg_plural("database with OID %u must be vacuumed before %d more multixact member is used",
+ "database with OID %u must be vacuumed before %d more multixact members are used",
+ MultiXactState->offsetStopLimit - nextOffset + nmembers,
MultiXactState->oldestMultiXactDB,
MultiXactState->offsetStopLimit - nextOffset + nmembers),
errhint("Execute a database-wide VACUUM in that database with reduced vacuum_multixact_freeze_min_age and vacuum_multixact_freeze_table_age settings.")));
case REGROLEOID:
ereport(ERROR,
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
- errmsg("constant of the type \'regrole\' cannot be used here")));
+ errmsg("constant of the type \"regrole\" cannot be used here")));
break;
}
}
ereport(ERROR,
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
errmsg("unrecognized default ACL object type %c", objtype),
- errhint("Valid object types are 'r', 'S', 'f', and 'T'.")));
+ errhint("Valid object types are \"r\", \"S\", \"f\", and \"T\".")));
}
/*
ereport(ERROR,
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
errmsg("COPY FROM not supported with row level security."),
- errhint("Use direct INSERT statements instead.")));
+ errhint("Use INSERT statements instead.")));
/* Build target list */
cr = makeNode(ColumnRef);
*/
ereport(ERROR,
(errcode(ERRCODE_CARDINALITY_VIOLATION),
- errmsg("new data for \"%s\" contains duplicate rows without any null columns",
+ errmsg("new data for materialized view \"%s\" contains duplicate rows without any null columns",
RelationGetRelationName(matviewRel)),
errdetail("Row: %s",
SPI_getvalue(SPI_tuptable->vals[0], SPI_tuptable->tupdesc, 1))));
!ConditionalLockRelationOid(relOid, AccessExclusiveLock))
ereport(ERROR,
(errcode(ERRCODE_OBJECT_IN_USE),
- errmsg("aborting because lock on relation \"%s\".\"%s\" is not available",
+ errmsg("aborting because lock on relation \"%s.%s\" is not available",
get_namespace_name(relForm->relnamespace),
NameStr(relForm->relname))));
else
return;
ereport(ERROR,
(errcode_for_file_access(),
- errmsg("could not stat \"%s\": %m", linkloc)));
+ errmsg("could not stat file \"%s\": %m", linkloc)));
}
if (S_ISDIR(st.st_mode))
nkeep);
appendStringInfo(&buf, _("There were %.0f unused item pointers.\n"),
nunused);
- appendStringInfo(&buf, _("Skipped %u pages due to buffer pins.\n"),
+ appendStringInfo(&buf, ngettext("Skipped %u page due to buffer pins.\n",
+ "Skipped %u pages due to buffer pins.\n",
+ vacrelstats->pinskipped_pages),
vacrelstats->pinskipped_pages);
- appendStringInfo(&buf, _("%u pages are entirely empty.\n"),
+ appendStringInfo(&buf, ngettext("%u page is entirely empty.\n",
+ "%u pages are entirely empty.\n",
+ empty_pages),
empty_pages);
appendStringInfo(&buf, _("%s."),
pg_rusage_show(&ru0));
ereport(ERROR,
(errcode(ERRCODE_WITH_CHECK_OPTION_VIOLATION),
- errmsg("new row violates WITH CHECK OPTION for \"%s\"",
+ errmsg("new row violates check option for view \"%s\"",
wco->relname),
val_desc ? errdetail("Failing row contains %s.",
val_desc) : 0));
if (wco->polname != NULL)
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
- errmsg("new row violates row level security policy \"%s\" for \"%s\"",
+ errmsg("new row violates row-level security policy \"%s\" for table \"%s\"",
wco->polname, wco->relname)));
else
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
- errmsg("new row violates row level security policy for \"%s\"",
+ errmsg("new row violates row-level security policy for table \"%s\"",
wco->relname)));
break;
case WCO_RLS_CONFLICT_CHECK:
if (wco->polname != NULL)
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
- errmsg("new row violates row level security policy \"%s\" (USING expression) for \"%s\"",
+ errmsg("new row violates row-level security policy \"%s\" (USING expression) for table \"%s\"",
wco->polname, wco->relname)));
else
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
- errmsg("new row violates row level security policy (USING expression) for \"%s\"",
+ errmsg("new row violates row-level security policy (USING expression) for table \"%s\"",
wco->relname)));
break;
default:
if (IsCatalogRelation(pstate->p_target_relation))
ereport(ERROR,
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
- errmsg("ON CONFLICT not supported with system catalog tables"),
+ errmsg("ON CONFLICT is not supported with system catalog tables"),
parser_errposition(pstate,
exprLocation((Node *) onConflictClause))));
if (RelationIsUsedAsCatalogTable(pstate->p_target_relation))
ereport(ERROR,
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
- errmsg("ON CONFLICT not supported on table \"%s\" used as a catalog table",
+ errmsg("ON CONFLICT is not supported on table \"%s\" used as a catalog table",
RelationGetRelationName(pstate->p_target_relation)),
parser_errposition(pstate,
exprLocation((Node *) onConflictClause))));
ctx->options.output_type !=OUTPUT_PLUGIN_TEXTUAL_OUTPUT)
ereport(ERROR,
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
- errmsg("logical decoding output plugin \"%s\" produces binary output, but \"%s\" expects textual data",
+ errmsg("logical decoding output plugin \"%s\" produces binary output, but function \"%s\" expects textual data",
NameStr(MyReplicationSlot->data.plugin),
format_procedure(fcinfo->flinfo->fn_oid))));
if (tuple == NULL)
ereport(ERROR,
(errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
- errmsg("no free replication origin oid could be found")));
+ errmsg("could not find free replication origin OID")));
heap_freetuple(tuple);
return roident;
{
ereport(ERROR,
(errcode(ERRCODE_OBJECT_IN_USE),
- errmsg("cannot drop replication origin with oid %d, in use by pid %d",
+ errmsg("could not drop replication origin with OID %d, in use by PID %d",
state->roident,
state->acquired_by)));
}
if (last_state == max_replication_slots)
ereport(PANIC,
(errcode(ERRCODE_CONFIGURATION_LIMIT_EXCEEDED),
- errmsg("no free replication state could be found, increase max_replication_slots")));
+ errmsg("could not find free replication state, increase max_replication_slots")));
/* copy data to shared memory */
replication_states[last_state].roident = disk_state.roident;
if (file_crc != crc)
ereport(PANIC,
(errcode(ERRCODE_CONFIGURATION_LIMIT_EXCEEDED),
- errmsg("replication_slot_checkpoint has wrong checksum %u, expected %u",
+ errmsg("replication slot checkpoint has wrong checksum %u, expected %u",
crc, file_crc)));
CloseTransientFile(fd);
{
ereport(ERROR,
(errcode(ERRCODE_OBJECT_IN_USE),
- errmsg("replication origin with oid %d is already active for pid %d",
+ errmsg("replication origin with OID %d is already active for PID %d",
replication_state->roident,
replication_state->acquired_by)));
}
if (replication_state == NULL && free_state == NULL)
ereport(ERROR,
(errcode(ERRCODE_CONFIGURATION_LIMIT_EXCEEDED),
- errmsg("no free replication state slot could be found for replication origin with oid %u",
+ errmsg("could not find free replication state slot for replication origin with OID %u",
node),
errhint("Increase max_replication_slots and try again.")));
{
ereport(ERROR,
(errcode(ERRCODE_OBJECT_IN_USE),
- errmsg("replication identifier %d is already active for pid %d",
+ errmsg("replication identifier %d is already active for PID %d",
curstate->roident, curstate->acquired_by)));
}
if (session_replication_state == NULL && free_slot == -1)
ereport(ERROR,
(errcode(ERRCODE_CONFIGURATION_LIMIT_EXCEEDED),
- errmsg("no free replication state slot could be found for replication origin with oid %u",
+ errmsg("could not find free replication state slot for replication origin with OID %u",
node),
errhint("Increase max_replication_slots and try again.")));
else if (session_replication_state == NULL)
if (ondisk.magic != SNAPBUILD_MAGIC)
ereport(ERROR,
- (errmsg("snapbuild state file \"%s\" has wrong magic %u instead of %u",
+ (errmsg("snapbuild state file \"%s\" has wrong magic number: %u instead of %u",
path, ondisk.magic, SNAPBUILD_MAGIC)));
if (ondisk.version != SNAPBUILD_VERSION)
ereport(ERROR,
- (errmsg("snapbuild state file \"%s\" has unsupported version %u instead of %u",
+ (errmsg("snapbuild state file \"%s\" has unsupported version: %u instead of %u",
path, ondisk.version, SNAPBUILD_VERSION)));
INIT_CRC32C(checksum);
if (!EQ_CRC32C(checksum, ondisk.checksum))
ereport(ERROR,
(errcode_for_file_access(),
- errmsg("snapbuild state file %s: checksum mismatch, is %u, should be %u",
+ errmsg("checksum mismatch for snapbuild state file \"%s\": is %u, should be %u",
path, checksum, ondisk.checksum)));
/*
if (active_pid != 0)
ereport(ERROR,
(errcode(ERRCODE_OBJECT_IN_USE),
- errmsg("replication slot \"%s\" is already active for pid %d",
+ errmsg("replication slot \"%s\" is already active for PID %d",
name, active_pid)));
/* We made this slot active, so it's ours now. */
if (cp.magic != SLOT_MAGIC)
ereport(PANIC,
(errcode_for_file_access(),
- errmsg("replication slot file \"%s\" has wrong magic %u instead of %u",
+ errmsg("replication slot file \"%s\" has wrong magic number: %u instead of %u",
path, cp.magic, SLOT_MAGIC)));
/* verify version */
if (!EQ_CRC32C(checksum, cp.checksum))
ereport(PANIC,
- (errmsg("replication slot file %s: checksum mismatch, is %u, should be %u",
+ (errmsg("checksum mismatch for replication slot file \"%s\": is %u, should be %u",
path, checksum, cp.checksum)));
/*
if (pq_is_reading_msg())
ereport(FATAL,
(errcode(ERRCODE_PROTOCOL_VIOLATION),
- errmsg("terminating connection because protocol sync was lost")));
+ errmsg("terminating connection because protocol synchronization was lost")));
/* Now we can allow interrupts again */
RESUME_INTERRUPTS();
{
ereport(ERROR,
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
- errmsg("key value must be scalar, not array, composite or json")));
+ errmsg("key value must be scalar, not array, composite, or json")));
}
else
{
if (r == SIGNAL_BACKEND_NOPERMISSION)
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
- (errmsg("must be a member of the role whose query is being cancelled"))));
+ (errmsg("must be a member of the role whose query is being canceled"))));
PG_RETURN_BOOL(r == SIGNAL_BACKEND_SUCCESS);
}
/* show minimum lines for pager use */
else if (strcmp(param, "pager_min_lines") == 0)
{
- printf(_("Pager won't be used for less than %d lines\n"),
+ printf(ngettext("Pager won't be used for less than %d line.\n",
+ "Pager won't be used for less than %d lines.\n",
+ popt->topt.pager_min_lines),
popt->topt.pager_min_lines);
}
INSERT INTO rls_test_permissive VALUES ('r1','s1',10);
-- failure
INSERT INTO rls_test_permissive VALUES ('r4','s4',10);
-ERROR: new row violates row level security policy for "rls_test_permissive"
+ERROR: new row violates row-level security policy for table "rls_test_permissive"
SET ROLE s1;
-- With only the hook's policies, restrictive
-- hook's policy is current_user = supervisor
INSERT INTO rls_test_restrictive VALUES ('r1','s1',10);
-- failure
INSERT INTO rls_test_restrictive VALUES ('r4','s4',10);
-ERROR: new row violates row level security policy "extension policy" for "rls_test_restrictive"
+ERROR: new row violates row-level security policy "extension policy" for table "rls_test_restrictive"
SET ROLE s1;
-- With only the hook's policies, both
-- permissive hook's policy is current_user = username
-- failure
INSERT INTO rls_test_both VALUES ('r1','s1',10);
-ERROR: new row violates row level security policy for "rls_test_both"
+ERROR: new row violates row-level security policy for table "rls_test_both"
-- failure
INSERT INTO rls_test_both VALUES ('r4','s1',10);
-ERROR: new row violates row level security policy for "rls_test_both"
+ERROR: new row violates row-level security policy for table "rls_test_both"
-- failure
INSERT INTO rls_test_both VALUES ('r4','s4',10);
-ERROR: new row violates row level security policy for "rls_test_both"
+ERROR: new row violates row-level security policy for table "rls_test_both"
RESET ROLE;
-- Create "internal" policies, to check that the policies from
-- the hooks are combined correctly.
INSERT INTO rls_test_permissive VALUES ('r3','s3',10);
-- failure
INSERT INTO rls_test_permissive VALUES ('r4','s4',7);
-ERROR: new row violates row level security policy for "rls_test_permissive"
+ERROR: new row violates row-level security policy for table "rls_test_permissive"
SET ROLE s1;
-- With both internal and hook policies, restrictive
EXPLAIN (costs off) SELECT * FROM rls_test_restrictive;
INSERT INTO rls_test_restrictive VALUES ('r1','s1',8);
-- failure
INSERT INTO rls_test_restrictive VALUES ('r3','s3',10);
-ERROR: new row violates row level security policy "extension policy" for "rls_test_restrictive"
+ERROR: new row violates row-level security policy "extension policy" for table "rls_test_restrictive"
-- failure
INSERT INTO rls_test_restrictive VALUES ('r1','s1',7);
-ERROR: new row violates row level security policy for "rls_test_restrictive"
+ERROR: new row violates row-level security policy for table "rls_test_restrictive"
-- failure
INSERT INTO rls_test_restrictive VALUES ('r4','s4',7);
-ERROR: new row violates row level security policy for "rls_test_restrictive"
+ERROR: new row violates row-level security policy for table "rls_test_restrictive"
-- With both internal and hook policies, both permissive
-- and restrictive hook policies
EXPLAIN (costs off) SELECT * FROM rls_test_both;
INSERT INTO rls_test_both VALUES ('r1','s1',8);
-- failure
INSERT INTO rls_test_both VALUES ('r3','s3',10);
-ERROR: new row violates row level security policy "extension policy" for "rls_test_both"
+ERROR: new row violates row-level security policy "extension policy" for table "rls_test_both"
-- failure
INSERT INTO rls_test_both VALUES ('r1','s1',7);
-ERROR: new row violates row level security policy for "rls_test_both"
+ERROR: new row violates row-level security policy for table "rls_test_both"
-- failure
INSERT INTO rls_test_both VALUES ('r4','s4',7);
-ERROR: new row violates row level security policy for "rls_test_both"
+ERROR: new row violates row-level security policy for table "rls_test_both"
RESET ROLE;
DROP TABLE rls_test_restrictive;
DROP TABLE rls_test_permissive;
SELECT jsonb_build_object(null,2);
ERROR: arg 1: key cannot be null
SELECT jsonb_build_object(r,2) FROM (SELECT 1 AS a, 2 AS b) r;
-ERROR: key value must be scalar, not array, composite or json
+ERROR: key value must be scalar, not array, composite, or json
SELECT jsonb_build_object(json '{"a":1,"b":2}', 3);
-ERROR: key value must be scalar, not array, composite or json
+ERROR: key value must be scalar, not array, composite, or json
SELECT jsonb_build_object('{1,2,3}'::int[], 3);
-ERROR: key value must be scalar, not array, composite or json
+ERROR: key value must be scalar, not array, composite, or json
-- handling of NULL values
SELECT jsonb_object_agg(1, NULL::jsonb);
jsonb_object_agg
ERROR: could not create unique index "mv_a_idx"
DETAIL: Key (a)=(1) is duplicated.
REFRESH MATERIALIZED VIEW CONCURRENTLY mv;
-ERROR: new data for "mv" contains duplicate rows without any null columns
+ERROR: new data for materialized view "mv" contains duplicate rows without any null columns
DETAIL: Row: (1,10)
DROP TABLE foo CASCADE;
NOTICE: drop cascades to materialized view mv
-- RLS policies are checked before constraints
INSERT INTO document VALUES (8, 44, 1, 'rls_regress_user2', 'my third manga'); -- Should fail with RLS check violation, not duplicate key violation
-ERROR: new row violates row level security policy for "document"
+ERROR: new row violates row-level security policy for table "document"
UPDATE document SET did = 8, dauthor = 'rls_regress_user2' WHERE did = 5; -- Should fail with RLS check violation, not duplicate key violation
-ERROR: new row violates row level security policy for "document"
+ERROR: new row violates row-level security policy for table "document"
-- database superuser does bypass RLS policy when enabled
RESET SESSION AUTHORIZATION;
SET row_security TO ON;
(5 rows)
INSERT INTO bv1 VALUES (-1, 'xxx'); -- should fail view WCO
-ERROR: new row violates row level security policy for "b1"
+ERROR: new row violates row-level security policy for table "b1"
INSERT INTO bv1 VALUES (11, 'xxx'); -- should fail RLS check
-ERROR: new row violates row level security policy for "b1"
+ERROR: new row violates row-level security policy for table "b1"
INSERT INTO bv1 VALUES (12, 'xxx'); -- ok
EXPLAIN (COSTS OFF) UPDATE bv1 SET b = 'yyy' WHERE a = 4 AND f_leak(b);
QUERY PLAN
-- alternative UPDATE path happens to be taken):
INSERT INTO document VALUES (2, (SELECT cid from category WHERE cname = 'novel'), 1, 'rls_regress_user2', 'my first novel')
ON CONFLICT (did) DO UPDATE SET dtitle = EXCLUDED.dtitle, dauthor = EXCLUDED.dauthor;
-ERROR: new row violates row level security policy for "document"
+ERROR: new row violates row-level security policy for table "document"
-- Violates USING qual for UPDATE policy p3.
--
-- UPDATE path is taken, but UPDATE fails purely because *existing* row to be
INSERT INTO document VALUES (33, 22, 1, 'rls_regress_user1', 'okay science fiction'); -- preparation for next statement
INSERT INTO document VALUES (33, (SELECT cid from category WHERE cname = 'novel'), 1, 'rls_regress_user1', 'Some novel, replaces sci-fi') -- takes UPDATE path
ON CONFLICT (did) DO UPDATE SET dtitle = EXCLUDED.dtitle;
-ERROR: new row violates row level security policy (USING expression) for "document"
+ERROR: new row violates row-level security policy (USING expression) for table "document"
-- Fine (we UPDATE, since INSERT WCOs and UPDATE security barrier quals + WCOs
-- not violated):
INSERT INTO document VALUES (2, (SELECT cid from category WHERE cname = 'novel'), 1, 'rls_regress_user1', 'my first novel')
-- passing quals:
INSERT INTO document VALUES (78, (SELECT cid from category WHERE cname = 'novel'), 1, 'rls_regress_user1', 'some technology novel')
ON CONFLICT (did) DO UPDATE SET dtitle = EXCLUDED.dtitle, cid = 33 RETURNING *;
-ERROR: new row violates row level security policy (USING expression) for "document"
+ERROR: new row violates row-level security policy (USING expression) for table "document"
-- Don't fail just because INSERT doesn't satisfy WITH CHECK option that
-- originated as a barrier/USING() qual from the UPDATE. Note that the UPDATE
-- path *isn't* taken, and so UPDATE-related policy does not apply:
-- irrelevant, in fact.
INSERT INTO document VALUES (79, (SELECT cid from category WHERE cname = 'technology'), 1, 'rls_regress_user1', 'technology book, can only insert')
ON CONFLICT (did) DO UPDATE SET dtitle = EXCLUDED.dtitle RETURNING *;
-ERROR: new row violates row level security policy (USING expression) for "document"
+ERROR: new row violates row-level security policy (USING expression) for table "document"
-- Test default USING qual enforced as WCO
SET SESSION AUTHORIZATION rls_regress_user0;
DROP POLICY p1 ON document;
-- UPDATE to make this fail:
INSERT INTO document VALUES (79, (SELECT cid from category WHERE cname = 'technology'), 1, 'rls_regress_user1', 'technology book, can only insert')
ON CONFLICT (did) DO UPDATE SET dtitle = EXCLUDED.dtitle RETURNING *;
-ERROR: new row violates row level security policy for "document"
+ERROR: new row violates row-level security policy for table "document"
-- UPDATE path is taken here. Existing tuple passes, since it's cid
-- corresponds to "novel", but default USING qual is enforced against
-- post-UPDATE tuple too (as always when updating with a policy that lacks an
-- explicit WCO), and so this fails:
INSERT INTO document VALUES (2, (SELECT cid from category WHERE cname = 'technology'), 1, 'rls_regress_user1', 'my first novel')
ON CONFLICT (did) DO UPDATE SET cid = EXCLUDED.cid, dtitle = EXCLUDED.dtitle RETURNING *;
-ERROR: new row violates row level security policy for "document"
+ERROR: new row violates row-level security policy for table "document"
SET SESSION AUTHORIZATION rls_regress_user0;
DROP POLICY p3_with_default ON document;
--
-- Fails, since ALL WCO is enforced in insert path:
INSERT INTO document VALUES (80, (SELECT cid from category WHERE cname = 'novel'), 1, 'rls_regress_user2', 'my first novel')
ON CONFLICT (did) DO UPDATE SET dtitle = EXCLUDED.dtitle, cid = 33;
-ERROR: new row violates row level security policy for "document"
+ERROR: new row violates row-level security policy for table "document"
-- Fails, since ALL policy USING qual is enforced (existing, target tuple is in
-- violation, since it has the "manga" cid):
INSERT INTO document VALUES (4, (SELECT cid from category WHERE cname = 'novel'), 1, 'rls_regress_user1', 'my first novel')
ON CONFLICT (did) DO UPDATE SET dtitle = EXCLUDED.dtitle;
-ERROR: new row violates row level security policy (USING expression) for "document"
+ERROR: new row violates row-level security policy (USING expression) for table "document"
-- Fails, since ALL WCO are enforced:
INSERT INTO document VALUES (1, (SELECT cid from category WHERE cname = 'novel'), 1, 'rls_regress_user1', 'my first novel')
ON CONFLICT (did) DO UPDATE SET dauthor = 'rls_regress_user2';
-ERROR: new row violates row level security policy for "document"
+ERROR: new row violates row-level security policy for table "document"
--
-- ROLE/GROUP
--
(6 rows)
WITH cte1 AS (UPDATE t1 SET a = a + 1 RETURNING *) SELECT * FROM cte1; --fail
-ERROR: new row violates row level security policy for "t1"
+ERROR: new row violates row-level security policy for table "t1"
WITH cte1 AS (UPDATE t1 SET a = a RETURNING *) SELECT * FROM cte1; --ok
a | b
----+----------------------------------
(11 rows)
WITH cte1 AS (INSERT INTO t1 VALUES (21, 'Fail') RETURNING *) SELECT * FROM cte1; --fail
-ERROR: new row violates row level security policy for "t1"
+ERROR: new row violates row-level security policy for table "t1"
WITH cte1 AS (INSERT INTO t1 VALUES (20, 'Success') RETURNING *) SELECT * FROM cte1; --ok
a | b
----+---------
SET row_security TO ON;
COPY copy_t FROM STDIN; --fail - COPY FROM not supported by RLS.
ERROR: COPY FROM not supported with row level security.
-HINT: Use direct INSERT statements instead.
+HINT: Use INSERT statements instead.
-- Check COPY FROM as user with permissions and BYPASSRLS
SET SESSION AUTHORIZATION rls_regress_exempt_user;
SET row_security TO ON;
-- r2 is read-only
INSERT INTO r2 VALUES (2); -- Not allowed
-ERROR: new row violates row level security policy for "r2"
+ERROR: new row violates row-level security policy for table "r2"
UPDATE r2 SET a = 2 RETURNING *; -- Updates nothing
a
---
-- RLS error
INSERT INTO r1 VALUES (1);
-ERROR: new row violates row level security policy for "r1"
+ERROR: new row violates row-level security policy for table "r1"
-- No error (unable to see any rows to update)
UPDATE r1 SET a = 1;
TABLE r1;
SET row_security = on;
-- Error
INSERT INTO r1 VALUES (10), (20) RETURNING *;
-ERROR: new row violates row level security policy for "r1"
+ERROR: new row violates row-level security policy for table "r1"
DROP TABLE r1;
--
-- Test UPDATE+RETURNING applies SELECT policies as
SET row_security = on;
-- Error
UPDATE r1 SET a = 30 RETURNING *;
-ERROR: new row violates row level security policy for "r1"
+ERROR: new row violates row-level security policy for table "r1"
DROP TABLE r1;
--
-- Clean up objects
INSERT INTO rw_view1 VALUES(3,4); -- ok
INSERT INTO rw_view1 VALUES(4,3); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (4, 3).
INSERT INTO rw_view1 VALUES(5,null); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (5, null).
UPDATE rw_view1 SET b = 5 WHERE a = 3; -- ok
UPDATE rw_view1 SET b = -5 WHERE a = 3; -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (3, -5).
INSERT INTO rw_view1(a) VALUES (9); -- ok
INSERT INTO rw_view1(a) VALUES (10); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (10, 10).
SELECT * FROM base_tbl;
a | b
(1 row)
INSERT INTO rw_view2 VALUES (-5); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (-5).
INSERT INTO rw_view2 VALUES (5); -- ok
INSERT INTO rw_view2 VALUES (15); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view2"
+ERROR: new row violates check option for view "rw_view2"
DETAIL: Failing row contains (15).
SELECT * FROM base_tbl;
a
(1 row)
UPDATE rw_view2 SET a = a - 10; -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (-5).
UPDATE rw_view2 SET a = a + 10; -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view2"
+ERROR: new row violates check option for view "rw_view2"
DETAIL: Failing row contains (15).
CREATE OR REPLACE VIEW rw_view2 AS SELECT * FROM rw_view1 WHERE a < 10
WITH LOCAL CHECK OPTION;
INSERT INTO rw_view2 VALUES (-10); -- ok, but not in view
INSERT INTO rw_view2 VALUES (20); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view2"
+ERROR: new row violates check option for view "rw_view2"
DETAIL: Failing row contains (20).
SELECT * FROM base_tbl;
a
DETAIL: Valid values are "local" and "cascaded".
ALTER VIEW rw_view1 SET (check_option=local);
INSERT INTO rw_view2 VALUES (-20); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (-20).
INSERT INTO rw_view2 VALUES (30); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view2"
+ERROR: new row violates check option for view "rw_view2"
DETAIL: Failing row contains (30).
ALTER VIEW rw_view2 RESET (check_option);
\d+ rw_view2
INSERT INTO rw_view2 VALUES (-2); -- ok, but not in view
INSERT INTO rw_view2 VALUES (2); -- ok
INSERT INTO rw_view3 VALUES (-3); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view2"
+ERROR: new row violates check option for view "rw_view2"
DETAIL: Failing row contains (-3).
INSERT INTO rw_view3 VALUES (3); -- ok
DROP TABLE base_tbl CASCADE;
WITH CHECK OPTION;
INSERT INTO rw_view1 VALUES (1, ARRAY[1,2,3]); -- ok
INSERT INTO rw_view1 VALUES (10, ARRAY[4,5]); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (10, {4,5}).
UPDATE rw_view1 SET b[2] = -b[2] WHERE a = 1; -- ok
UPDATE rw_view1 SET b[1] = -b[1] WHERE a = 1; -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (1, {-1,-2,3}).
PREPARE ins(int, int[]) AS INSERT INTO rw_view1 VALUES($1, $2);
EXECUTE ins(2, ARRAY[1,2,3]); -- ok
EXECUTE ins(10, ARRAY[4,5]); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (10, {4,5}).
DEALLOCATE PREPARE ins;
DROP TABLE base_tbl CASCADE;
WITH CHECK OPTION;
INSERT INTO rw_view1 VALUES (5); -- ok
INSERT INTO rw_view1 VALUES (15); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (15).
UPDATE rw_view1 SET a = a + 5; -- ok
UPDATE rw_view1 SET a = a + 5; -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (15).
EXPLAIN (costs off) INSERT INTO rw_view1 VALUES (5);
QUERY PLAN
CREATE VIEW rw_view1 AS SELECT * FROM base_tbl WHERE a < b WITH CHECK OPTION;
INSERT INTO rw_view1 VALUES (5,0); -- ok
INSERT INTO rw_view1 VALUES (15, 20); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (15, 10).
UPDATE rw_view1 SET a = 20, b = 30; -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view1"
+ERROR: new row violates check option for view "rw_view1"
DETAIL: Failing row contains (20, 10).
DROP TABLE base_tbl CASCADE;
NOTICE: drop cascades to view rw_view1
CREATE VIEW rw_view2 AS
SELECT * FROM rw_view1 WHERE a > 0 WITH LOCAL CHECK OPTION;
INSERT INTO rw_view2 VALUES (-5); -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view2"
+ERROR: new row violates check option for view "rw_view2"
DETAIL: Failing row contains (-5).
INSERT INTO rw_view2 VALUES (5); -- ok
INSERT INTO rw_view2 VALUES (50); -- ok, but not in view
UPDATE rw_view2 SET a = a - 10; -- should fail
-ERROR: new row violates WITH CHECK OPTION for "rw_view2"
+ERROR: new row violates check option for view "rw_view2"
DETAIL: Failing row contains (-5).
SELECT * FROM base_tbl;
a | b