mirror of
https://github.com/timescale/timescaledb.git
synced 2025-05-17 02:53:51 +08:00
5661ff1523
Since the job error log can contain information from many different sources and also from many different jobs it is important to ensure that visibility of the job error log entries is restricted to job owners. This commit extend the view `timescaledb_information.job_errors` with role-based checks so that a user can only see entries for jobs that she has permission to view and restrict the permissions to `_timescaledb_internal.job_errors` so that users only can view the job error log through the view. A special case is added so that the superuser and the database owner can see all log entries, even if there is no associated job id with the log entry. Closes #5217
38 lines
1.3 KiB
SQL
38 lines
1.3 KiB
SQL
CREATE OR REPLACE VIEW timescaledb_information.job_errors
|
|
WITH (security_barrier = true) AS
|
|
SELECT
|
|
job_id,
|
|
error_data ->> 'proc_schema' as proc_schema,
|
|
error_data ->> 'proc_name' as proc_name,
|
|
pid,
|
|
start_time,
|
|
finish_time,
|
|
error_data ->> 'sqlerrcode' AS sqlerrcode,
|
|
CASE WHEN error_data ->>'message' IS NOT NULL THEN
|
|
CASE WHEN error_data ->>'detail' IS NOT NULL THEN
|
|
CASE WHEN error_data ->>'hint' IS NOT NULL THEN concat(error_data ->>'message', '. ', error_data ->>'detail', '. ', error_data->>'hint')
|
|
ELSE concat(error_data ->>'message', ' ', error_data ->>'detail')
|
|
END
|
|
ELSE
|
|
CASE WHEN error_data ->>'hint' IS NOT NULL THEN concat(error_data ->>'message', '. ', error_data->>'hint')
|
|
ELSE error_data ->>'message'
|
|
END
|
|
END
|
|
ELSE
|
|
'job crash detected, see server logs'
|
|
END
|
|
AS err_message
|
|
FROM
|
|
_timescaledb_internal.job_errors
|
|
LEFT JOIN
|
|
_timescaledb_config.bgw_job ON (bgw_job.id = job_errors.job_id)
|
|
WHERE
|
|
pg_catalog.pg_has_role(current_user,
|
|
(SELECT pg_catalog.pg_get_userbyid(datdba)
|
|
FROM pg_catalog.pg_database
|
|
WHERE datname = current_database()),
|
|
'MEMBER') IS TRUE
|
|
OR pg_catalog.pg_has_role(current_user, owner, 'MEMBER') IS TRUE;
|
|
|
|
REVOKE ALL ON _timescaledb_internal.job_errors FROM PUBLIC;
|