Follow-on to #18: run application-level tests as a genuine non-superuser

test/expected/base.out

@@ -1,22 +1,23 @@
 \set ECHO none
-ok 1 - Register test customers
-ok 2 - Create function customer__add
-ok 3 - Register test invoices
-ok 4 - Ensure original_role temp table was dropped
-ok 5 - Security definer function _tf.get has search_path=pg_catalog
-ok 6 - Security definer function _tf.schema__getsert has search_path=pg_catalog
-ok 7 - Security definer function _tf.table_create has search_path=pg_catalog
-ok 8 - Security definer function _tf.test_factory__get has search_path=pg_catalog
-ok 9 - Security definer function _tf.test_factory__set has search_path=pg_catalog
-ok 10 - customer table is empty
-ok 11 - invoice table is empty
-ok 12 - invoice factory output
-ok 13 - invoice table content
-ok 14 - customer table content
-ok 15 - invoice factory second call
-ok 16 - invoice table content stayed constant
-ok 17 - customer table content stayed constant
-ok 18 - Test function factory
-ok 19 - customer table has new row
-ok 20 - truncate invoice
-ok 21 - invoice factory get remains the same after truncate
+ok 1 - test_role is not a member of test_factory__owner
+ok 2 - Register test customers
+ok 3 - Create function customer__add
+ok 4 - Register test invoices
+ok 5 - Ensure original_role temp table was dropped
+ok 6 - Security definer function _tf.get has search_path=pg_catalog
+ok 7 - Security definer function _tf.schema__getsert has search_path=pg_catalog
+ok 8 - Security definer function _tf.table_create has search_path=pg_catalog
+ok 9 - Security definer function _tf.test_factory__get has search_path=pg_catalog
+ok 10 - Security definer function _tf.test_factory__set has search_path=pg_catalog
+ok 11 - customer table is empty
+ok 12 - invoice table is empty
+ok 13 - invoice factory output
+ok 14 - invoice table content
+ok 15 - customer table content
+ok 16 - invoice factory second call
+ok 17 - invoice table content stayed constant
+ok 18 - customer table content stayed constant
+ok 19 - Test function factory
+ok 20 - customer table has new row
+ok 21 - truncate invoice
+ok 22 - invoice factory get remains the same after truncate

test/expected/pgtap.out

@@ -1,14 +1,15 @@
 \set ECHO none
 ok 1 - test_factory_pgtap depends on test_factory (control file requires is real and enforced)
-ok 2 - Register test customers
-ok 3 - Create function customer__add
-ok 4 - Register test invoices
-ok 5 - Ensure original_role temp table was dropped
-ok 6 - Security definer function _tf.get has search_path=pg_catalog
-ok 7 - Security definer function _tf.schema__getsert has search_path=pg_catalog
-ok 8 - Security definer function _tf.table_create has search_path=pg_catalog
-ok 9 - Security definer function _tf.test_factory__get has search_path=pg_catalog
-ok 10 - Security definer function _tf.test_factory__set has search_path=pg_catalog
-ok 11 - Get test data set "base" for table invoice
+ok 2 - test_role is not a member of test_factory__owner
+ok 3 - Register test customers
+ok 4 - Create function customer__add
+ok 5 - Register test invoices
+ok 6 - Ensure original_role temp table was dropped
+ok 7 - Security definer function _tf.get has search_path=pg_catalog
+ok 8 - Security definer function _tf.schema__getsert has search_path=pg_catalog
+ok 9 - Security definer function _tf.table_create has search_path=pg_catalog
+ok 10 - Security definer function _tf.test_factory__get has search_path=pg_catalog
+ok 11 - Security definer function _tf.test_factory__set has search_path=pg_catalog
 ok 12 - Get test data set "base" for table invoice
-ok 13 - Ensure we get sane error for a non-existent table
+ok 13 - Get test data set "base" for table invoice
+ok 14 - Ensure we get sane error for a non-existent table

test/helpers/create.sql

@@ -9,9 +9,22 @@ GRANT USAGE ON SCHEMA tap TO :test_role;
  * DO NOT GRANT test_role TO test_factory__owner; the whole point test_role is
  * to check for security problems.
  */
+SELECT isnt_member_of(
+  'test_factory__owner'
+  , :'test_role'
+  , 'test_role is not a member of test_factory__owner'
+);
 
 CREATE SCHEMA test AUTHORIZATION :test_role;
-SET ROLE = :test_role;
+/*
+ * SET SESSION AUTHORIZATION (not SET ROLE): it changes session_user too, not
+ * just current_user. Permission checks for a *further* SET ROLE (like the one
+ * test_factory's install does, and like issue #14's bug) are based on
+ * session_user's superuser status, not current_user's -- so a plain SET ROLE
+ * here would leave that one class of check silently bypassed for the rest of
+ * this file, since pg_regress always connects as a superuser.
+ */
+SET SESSION AUTHORIZATION :test_role;
 SET search_path = test, tap;
 
 CREATE TABLE customer(