Add insforge pg utils for role privileges

Merged
FE
5mo ago
+407-1

Allow project_admin to manage RLS policies without being the table owner

Summary by cubic

Adds a PostgreSQL preload utility insforge_pg_utils that lets insforge.policy_grant_role (default project_admin) manage RLS policies on allowlisted tables without being the table owner. Also updates the Postgres image workflow to skip registry login and pushes on pull requests.

  • New Features

    • New shared-preload library insforge_pg_utils with a ProcessUtility hook.
    • Supports create/alter/drop/rename policy and enable/disable RLS.
    • Runs these statements as the table owner for allowlisted tables.
    • Controlled by insforge.policy_grant_role and insforge.policy_grant_tables (comma-separated, schema-qualified).

  • Migration

    • Add insforge_pg_utils to shared_preload_libraries and restart Postgres.
    • Set insforge.policy_grant_role (optional, defaults to project_admin).
    • Set insforge.policy_grant_tables with the managed tables list.
    • No CREATE EXTENSION needed; it exposes no SQL objects.