[Fermionic-Lyu]

Allow project_admin to manage RLS policies without being the table owner

---

Summary by cubic

Adds a PostgreSQL preload utility insforge_pg_utils that lets insforge.policy_grant_role (default project_admin) manage RLS policies on allowlisted tables without being the table owner. Also updates the Postgres image workflow to skip registry login and pushes on pull requests.

• New Features

  • New shared-preload library insforge_pg_utils with a ProcessUtility hook.
  • Supports create/alter/drop/rename policy and enable/disable RLS.
  • Runs these statements as the table owner for allowlisted tables.
  • Controlled by insforge.policy_grant_role and insforge.policy_grant_tables (comma-separated, schema-qualified).

• Migration

  • Add insforge_pg_utils to shared_preload_libraries and restart Postgres.
  • Set insforge.policy_grant_role (optional, defaults to project_admin).
  • Set insforge.policy_grant_tables with the managed tables list.
  • No CREATE EXTENSION needed; it exposes no SQL objects.

^{Written for commit 8510757. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

2 issues found across 6 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="postgres/insforge_pg_utils/src/insforge_pg_utils.c">

<violation number="1" location="postgres/insforge_pg_utils/src/insforge_pg_utils.c:246">
P1: Delegated policy-management escalation also permits disabling row-level security, which bypasses policy enforcement on allowlisted tables.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>