Follow-on to #18: run application-level tests as a genuine non-superuser

[jnasbyupgrade]

Follow-on to #18: run more of the application-level test suite as a genuine non-superuser.

(Replaces #30, which developed a stuck head/diff computation on GitHub's side that survived a
force-push, a base-branch retarget, and a close/reopen — confirmed by opening this PR against the
exact same commits, which computed correctly immediately. Same content, same history.)

Background

While updating #18, the question came up: could we run more of this test suite as a non-superuser, given #18 was exactly the kind of bug (SET ROLE permission check) that a superuser-run test suite can't naturally catch?

test/helpers/create.sql switches into a non-superuser test_role for most of base.sql/pgtap.sql -- but via SET ROLE, not SET SESSION AUTHORIZATION. That distinction matters: SET ROLE only changes current_user; Postgres's own permission check for a further SET ROLE (the exact class of check #18's bug was in) is based on session_user, which SET ROLE leaves untouched. Under pg_regress's superuser connection, that silently bypassed this whole class of check for the rest of the file. Fixed by switching to SET SESSION AUTHORIZATION. Also added test/sql/security.sql, proving the public tf.* API needs nothing beyond a freshly-created, unprivileged role -- using a new bare_role entry in test/roles.sql (this repo's single-source-of-truth pattern for test-only role names) rather than a literal role name.

Scope note: an earlier version of this PR also added a separate non-superuser CREATE EXTENSION repro (a disposable installer role in test/sql/install.sql). That's dropped -- test/install/load.sql's fresh/update branch (landed as part of #18's own review iterations, now on master) already does exactly this as the real install for the whole suite, making the separate repro redundant; test/sql/install.sql itself was deleted upstream for the same reason. This PR is based on current master and contains only the still-missing piece.

Test plan

• make test -- load/base/pgtap pass; security runs correctly (4/4 pgtap assertions pass) but needs make results to accept its expected output, per this repo's human-verifies-expected-output convention
• make test-update -- same result
• make lint -- clean
• test/expected/base.out/pgtap.out unchanged

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 40439ead-7279-4433-8c75-dc5790661f25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jnasbyupgrade]

Superseded by #45 — turns out GitHub does allow a duplicate PR from the exact same branch, so #45 (no extra branch needed) is the simpler replacement for #30.