Company
Date Published
Author
Steve Chavez
Word count
619
Language
English
Hacker News points
2

Summary

Event triggers in Postgres allow for powerful database automation, but only superusers can create them. To make event triggers accessible to regular users in a safe way, the `supautils` extension uses a combination of the Utility Hook and Function Manager Hook. A "privileged role" is used as a proxy to superuser capabilities, allowing regular users to create event triggers while preventing privilege escalation. The privileged role intercepts event trigger creation, elevates it to a superuser, creates the trigger, and then downgrades back to the privileged role, ensuring safety. However, this approach still has limitations, such as targeting every role and running with target role privileges. To address this, the extension also skips user event triggers for superusers and "reserved roles" used in managed services like `pgbouncer`. User event triggers are now available through the `supautils` extension, allowing regular users to create event triggers safely without superuser access, and the feature is being discussed for inclusion in Postgres core.