YugabyteDB (2.13.0.0-b42, bfc6a6643e7399ac8a0e81d06a3ee6d6571b33ab)

/*-------------------------------------------------------------------------

 *

 * user.c

 *    Commands for manipulating roles (formerly called users).

 *

 * Portions Copyright (c) 1996-2018, PostgreSQL Global Development Group

 * Portions Copyright (c) 1994, Regents of the University of California

 *

 * src/backend/commands/user.c

 *

 *-------------------------------------------------------------------------

 */

#include <pg_yb_utils.h>

#include "postgres.h"

#include "access/genam.h"

#include "access/heapam.h"

#include "access/htup_details.h"

#include "access/xact.h"

#include "catalog/binary_upgrade.h"

#include "catalog/catalog.h"

#include "catalog/dependency.h"

#include "catalog/indexing.h"

#include "catalog/objectaccess.h"

#include "catalog/pg_auth_members.h"

#include "catalog/pg_authid.h"

#include "catalog/pg_database.h"

#include "catalog/pg_db_role_setting.h"

#include "commands/comment.h"

#include "commands/dbcommands.h"

#include "commands/seclabel.h"

#include "commands/user.h"

#include "libpq/crypt.h"

#include "miscadmin.h"

#include "storage/lmgr.h"

#include "utils/acl.h"

#include "utils/builtins.h"

#include "utils/fmgroids.h"

#include "utils/syscache.h"

#include "utils/timestamp.h"

#include "utils/tqual.h"

/* Potentially set by pg_upgrade_support functions */

Oid     binary_upgrade_next_pg_authid_oid = InvalidOid;

/* GUC parameter */

int     Password_encryption = PASSWORD_TYPE_MD5;

/* Hook to check passwords in CreateRole() and AlterRole() */

check_password_hook_type check_password_hook = NULL;

static void AddRoleMems(const char *rolename, Oid roleid,

      List *memberSpecs, List *memberIds,

      Oid grantorId, bool admin_opt);

static void DelRoleMems(const char *rolename, Oid roleid,

      List *memberSpecs, List *memberIds,

      bool admin_opt);

/* Check if current user has createrole privileges */

static bool

have_createrole_privilege(void)

{

  return has_createrole_privilege(GetUserId());

}

/*

 * CREATE ROLE

 */

Oid

CreateRole(ParseState *pstate, CreateRoleStmt *stmt)

{

  Relation  pg_authid_rel;

  TupleDesc pg_authid_dsc;

  HeapTuple tuple;

  Datum   new_record[Natts_pg_authid];

  bool    new_record_nulls[Natts_pg_authid];

  Oid     roleid;

  ListCell   *item;

  ListCell   *option;

  char     *password = NULL;  /* user password */

  bool    issuper = false;  /* Make the user a superuser? */

  bool    inherit = true; /* Auto inherit privileges? */

  bool    createrole = false; /* Can this user create roles? */

  bool    createdb = false; /* Can the user create databases? */

  bool    canlogin = false; /* Can this user login? */

  bool    isreplication = false;  /* Is this a replication role? */

  bool    bypassrls = false;  /* Is this a row security enabled role? */

  int     connlimit = -1; /* maximum connections allowed */

  List     *addroleto = NIL; /* roles to make this a member of */

  List     *rolemembers = NIL; /* roles to be members of this role */

  List     *adminmembers = NIL; /* roles to be admins of this role */

  char     *validUntil = NULL;  /* time the login is valid until */

  Datum   validUntil_datum; /* same, as timestamptz Datum */

  bool    validUntil_null;

  DefElem    *dpassword = NULL;

  DefElem    *dissuper = NULL;

  DefElem    *dinherit = NULL;

  DefElem    *dcreaterole = NULL;

  DefElem    *dcreatedb = NULL;

  DefElem    *dcanlogin = NULL;

  DefElem    *disreplication = NULL;

  DefElem    *dconnlimit = NULL;

  DefElem    *daddroleto = NULL;

  DefElem    *drolemembers = NULL;

  DefElem    *dadminmembers = NULL;

  DefElem    *dvalidUntil = NULL;

  DefElem    *dbypassRLS = NULL;

  /* The defaults can vary depending on the original statement type */

  switch (stmt->stmt_type)

  {

    case ROLESTMT_ROLE:

      break;

    case ROLESTMT_USER:

      canlogin = true;

      /* may eventually want inherit to default to false here */

      break;

    case ROLESTMT_GROUP:

      break;

  }

  /* Extract options from the statement node tree */

  foreach(option, stmt->options)

  {

    DefElem    *defel = (DefElem *) lfirst(option);

    if (strcmp(defel->defname, "password") == 0)

    {

      if (dpassword)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      dpassword = defel;

    }

    else if (strcmp(defel->defname, "sysid") == 0)

    {

      ereport(NOTICE,

          (errmsg("SYSID can no longer be specified")));

    }

    else if (strcmp(defel->defname, "superuser") == 0)

    {

      if (dissuper)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      dissuper = defel;

    }

    else if (strcmp(defel->defname, "inherit") == 0)

    {

      if (dinherit)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      dinherit = defel;

    }

    else if (strcmp(defel->defname, "createrole") == 0)

    {

      if (dcreaterole)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      dcreaterole = defel;

    }

    else if (strcmp(defel->defname, "createdb") == 0)

    {

      if (dcreatedb)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      dcreatedb = defel;

    }

    else if (strcmp(defel->defname, "canlogin") == 0)

    {

      if (dcanlogin)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      dcanlogin = defel;

    }

    else if (strcmp(defel->defname, "isreplication") == 0)

    {

      if (disreplication)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      disreplication = defel;

    }

    else if (strcmp(defel->defname, "connectionlimit") == 0)

    {

      if (dconnlimit)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      dconnlimit = defel;

    }

    else if (strcmp(defel->defname, "addroleto") == 0)

    {

      if (daddroleto)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      daddroleto = defel;

    }

    else if (strcmp(defel->defname, "rolemembers") == 0)

    {

      if (drolemembers)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      drolemembers = defel;

    }

    else if (strcmp(defel->defname, "adminmembers") == 0)

    {

      if (dadminmembers)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      dadminmembers = defel;

    }

    else if (strcmp(defel->defname, "validUntil") == 0)

    {

      if (dvalidUntil)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      dvalidUntil = defel;

    }

    else if (strcmp(defel->defname, "bypassrls") == 0)

    {

      if (dbypassRLS)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options"),

             parser_errposition(pstate, defel->location)));

      dbypassRLS = defel;

    }

    else

      elog(ERROR, "option \"%s\" not recognized",

         defel->defname);

  }

  if (dpassword && dpassword->arg)

    password = strVal(dpassword->arg);

  if (dissuper)

    issuper = intVal(dissuper->arg) != 0;

  if (dinherit)

    inherit = intVal(dinherit->arg) != 0;

  if (dcreaterole)

    createrole = intVal(dcreaterole->arg) != 0;

  if (dcreatedb)

    createdb = intVal(dcreatedb->arg) != 0;

  if (dcanlogin)

    canlogin = intVal(dcanlogin->arg) != 0;

  if (disreplication)

    isreplication = intVal(disreplication->arg) != 0;

  if (dconnlimit)

  {

    connlimit = intVal(dconnlimit->arg);

    if (connlimit < -1)

      ereport(ERROR,

          (errcode(ERRCODE_INVALID_PARAMETER_VALUE),

           errmsg("invalid connection limit: %d", connlimit)));

  }

  if (daddroleto)

    addroleto = (List *) daddroleto->arg;

  if (drolemembers)

    rolemembers = (List *) drolemembers->arg;

  if (dadminmembers)

    adminmembers = (List *) dadminmembers->arg;

  if (dvalidUntil)

    validUntil = strVal(dvalidUntil->arg);

  if (dbypassRLS)

    bypassrls = intVal(dbypassRLS->arg) != 0;

  /* Check some permissions first */

  if (issuper)

  {

    if (!superuser())

      ereport(ERROR,

          (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

           errmsg("must be superuser to create superusers")));

  }

  else if (isreplication)

  {

    if (!superuser())

      ereport(ERROR,

          (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

           errmsg("must be superuser to create replication users")));

  }

  else if (bypassrls)

  {

    if (!superuser())

      ereport(ERROR,

          (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

           errmsg("must be superuser to change bypassrls attribute")));

  }

  else

  {

    if (!have_createrole_privilege())

      ereport(ERROR,

          (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

           errmsg("permission denied to create role")));

  }

  /*

   * Check that the user is not trying to create a role in the reserved

   * "pg_" namespace.

   */

  if (IsReservedName(stmt->role))

    ereport(ERROR,

        (errcode(ERRCODE_RESERVED_NAME),

         errmsg("role name \"%s\" is reserved",

            stmt->role),

         errdetail("Role names starting with \"pg_\" are reserved.")));

  /*

   * Check the pg_authid relation to be certain the role doesn't already

   * exist.

   */

  pg_authid_rel = heap_open(AuthIdRelationId, RowExclusiveLock);

  pg_authid_dsc = RelationGetDescr(pg_authid_rel);

  if (OidIsValid(get_role_oid(stmt->role, true)))

    ereport(ERROR,

        (errcode(ERRCODE_DUPLICATE_OBJECT),

         errmsg("role \"%s\" already exists",

            stmt->role)));

  /* Convert validuntil to internal form */

  if (validUntil)

  {

    validUntil_datum = DirectFunctionCall3(timestamptz_in,

                         CStringGetDatum(validUntil),

                         ObjectIdGetDatum(InvalidOid),

                         Int32GetDatum(-1));

    validUntil_null = false;

  }

  else

  {

    validUntil_datum = (Datum) 0;

    validUntil_null = true;

  }

  /*

   * Call the password checking hook if there is one defined

   */

  if (check_password_hook && password)

    (*check_password_hook) (stmt->role,

                password,

                get_password_type(password),

                validUntil_datum,

                validUntil_null);

  /*

   * Build a tuple to insert

   */

  MemSet(new_record, 0, sizeof(new_record));

  MemSet(new_record_nulls, false, sizeof(new_record_nulls));

  new_record[Anum_pg_authid_rolname - 1] =

    DirectFunctionCall1(namein, CStringGetDatum(stmt->role));

  new_record[Anum_pg_authid_rolsuper - 1] = BoolGetDatum(issuper);

  new_record[Anum_pg_authid_rolinherit - 1] = BoolGetDatum(inherit);

  new_record[Anum_pg_authid_rolcreaterole - 1] = BoolGetDatum(createrole);

  new_record[Anum_pg_authid_rolcreatedb - 1] = BoolGetDatum(createdb);

  new_record[Anum_pg_authid_rolcanlogin - 1] = BoolGetDatum(canlogin);

  new_record[Anum_pg_authid_rolreplication - 1] = BoolGetDatum(isreplication);

  new_record[Anum_pg_authid_rolconnlimit - 1] = Int32GetDatum(connlimit);

  if (password)

  {

    char     *shadow_pass;

    char     *logdetail;

    /*

     * Don't allow an empty password. Libpq treats an empty password the

     * same as no password at all, and won't even try to authenticate. But

     * other clients might, so allowing it would be confusing. By clearing

     * the password when an empty string is specified, the account is

     * consistently locked for all clients.

     *

     * Note that this only covers passwords stored in the database itself.

     * There are also checks in the authentication code, to forbid an

     * empty password from being used with authentication methods that

     * fetch the password from an external system, like LDAP or PAM.

     */

    if (password[0] == '\0' ||

      plain_crypt_verify(stmt->role, password, "", &logdetail) == STATUS_OK)

    {

      ereport(NOTICE,

          (errmsg("empty string is not a valid password, clearing password")));

      new_record_nulls[Anum_pg_authid_rolpassword - 1] = true;

    }

    else

    {

      /* Encrypt the password to the requested format. */

      shadow_pass = encrypt_password(Password_encryption, stmt->role,

                       password);

      new_record[Anum_pg_authid_rolpassword - 1] =

        CStringGetTextDatum(shadow_pass);

    }

  }

  else

    new_record_nulls[Anum_pg_authid_rolpassword - 1] = true;

  new_record[Anum_pg_authid_rolvaliduntil - 1] = validUntil_datum;

  new_record_nulls[Anum_pg_authid_rolvaliduntil - 1] = validUntil_null;

  new_record[Anum_pg_authid_rolbypassrls - 1] = BoolGetDatum(bypassrls);

  tuple = heap_form_tuple(pg_authid_dsc, new_record, new_record_nulls);

  /*

   * pg_largeobject_metadata contains pg_authid.oid's, so we use the

   * binary-upgrade override.

   */

  if (IsBinaryUpgrade && !yb_binary_restore)

  {

    if (!OidIsValid(binary_upgrade_next_pg_authid_oid))

      ereport(ERROR,

          (errcode(ERRCODE_INVALID_PARAMETER_VALUE),

           errmsg("pg_authid OID value not set when in binary upgrade mode")));

    HeapTupleSetOid(tuple, binary_upgrade_next_pg_authid_oid);

    binary_upgrade_next_pg_authid_oid = InvalidOid;

  }

  /*

   * Insert new record in the pg_authid table

   */

  roleid = CatalogTupleInsert(pg_authid_rel, tuple);

  /*

   * Advance command counter so we can see new record; else tests in

   * AddRoleMems may fail.

   */

  if (addroleto || adminmembers || rolemembers)

    CommandCounterIncrement();

  /*

   * Add the new role to the specified existing roles.

   */

  foreach(item, addroleto)

  {

    RoleSpec   *oldrole = lfirst(item);

    HeapTuple oldroletup = get_rolespec_tuple(oldrole);

    Oid     oldroleid = HeapTupleGetOid(oldroletup);

    char     *oldrolename = NameStr(((Form_pg_authid) GETSTRUCT(oldroletup))->rolname);

    AddRoleMems(oldrolename, oldroleid,

          list_make1(makeString(stmt->role)),

          list_make1_oid(roleid),

          GetUserId(), false);

    ReleaseSysCache(oldroletup);

  }

  /*

   * Add the specified members to this new role. adminmembers get the admin

   * option, rolemembers don't.

   */

  AddRoleMems(stmt->role, roleid,

        adminmembers, roleSpecsToIds(adminmembers),

        GetUserId(), true);

  AddRoleMems(stmt->role, roleid,

        rolemembers, roleSpecsToIds(rolemembers),

        GetUserId(), false);

  /* Post creation hook for new role */

  InvokeObjectPostCreateHook(AuthIdRelationId, roleid, 0);

  /*

   * Close pg_authid, but keep lock till commit.

   */

  heap_close(pg_authid_rel, NoLock);

  return roleid;

}

/*

 * ALTER ROLE

 *

 * Note: the rolemembers option accepted here is intended to support the

 * backwards-compatible ALTER GROUP syntax.  Although it will work to say

 * "ALTER ROLE role ROLE rolenames", we don't document it.

 */

Oid

AlterRole(AlterRoleStmt *stmt)

{

  Datum   new_record[Natts_pg_authid];

  bool    new_record_nulls[Natts_pg_authid];

  bool    new_record_repl[Natts_pg_authid];

  Relation  pg_authid_rel;

  TupleDesc pg_authid_dsc;

  HeapTuple tuple,

        new_tuple;

  Form_pg_authid authform;

  ListCell   *option;

  char     *rolename = NULL;

  char     *password = NULL;  /* user password */

  int     issuper = -1; /* Make the user a superuser? */

  int     inherit = -1; /* Auto inherit privileges? */

  int     createrole = -1;  /* Can this user create roles? */

  int     createdb = -1;  /* Can the user create databases? */

  int     canlogin = -1;  /* Can this user login? */

  int     isreplication = -1; /* Is this a replication role? */

  int     connlimit = -1; /* maximum connections allowed */

  List     *rolemembers = NIL; /* roles to be added/removed */

  char     *validUntil = NULL;  /* time the login is valid until */

  Datum   validUntil_datum; /* same, as timestamptz Datum */

  bool    validUntil_null;

  int     bypassrls = -1;

  DefElem    *dpassword = NULL;

  DefElem    *dissuper = NULL;

  DefElem    *dinherit = NULL;

  DefElem    *dcreaterole = NULL;

  DefElem    *dcreatedb = NULL;

  DefElem    *dcanlogin = NULL;

  DefElem    *disreplication = NULL;

  DefElem    *dconnlimit = NULL;

  DefElem    *drolemembers = NULL;

  DefElem    *dvalidUntil = NULL;

  DefElem    *dbypassRLS = NULL;

  Oid     roleid;

  check_rolespec_name(stmt->role,

            "Cannot alter reserved roles.");

  /* Extract options from the statement node tree */

  foreach(option, stmt->options)

  {

    DefElem    *defel = (DefElem *) lfirst(option);

    if (strcmp(defel->defname, "password") == 0)

    {

      if (dpassword)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      dpassword = defel;

    }

    else if (strcmp(defel->defname, "superuser") == 0)

    {

      if (dissuper)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      dissuper = defel;

    }

    else if (strcmp(defel->defname, "inherit") == 0)

    {

      if (dinherit)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      dinherit = defel;

    }

    else if (strcmp(defel->defname, "createrole") == 0)

    {

      if (dcreaterole)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      dcreaterole = defel;

    }

    else if (strcmp(defel->defname, "createdb") == 0)

    {

      if (dcreatedb)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      dcreatedb = defel;

    }

    else if (strcmp(defel->defname, "canlogin") == 0)

    {

      if (dcanlogin)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      dcanlogin = defel;

    }

    else if (strcmp(defel->defname, "isreplication") == 0)

    {

      if (disreplication)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      disreplication = defel;

    }

    else if (strcmp(defel->defname, "connectionlimit") == 0)

    {

      if (dconnlimit)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      dconnlimit = defel;

    }

    else if (strcmp(defel->defname, "rolemembers") == 0 &&

         stmt->action != 0)

    {

      if (drolemembers)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      drolemembers = defel;

    }

    else if (strcmp(defel->defname, "validUntil") == 0)

    {

      if (dvalidUntil)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      dvalidUntil = defel;

    }

    else if (strcmp(defel->defname, "bypassrls") == 0)

    {

      if (dbypassRLS)

        ereport(ERROR,

            (errcode(ERRCODE_SYNTAX_ERROR),

             errmsg("conflicting or redundant options")));

      dbypassRLS = defel;

    }

    else

      elog(ERROR, "option \"%s\" not recognized",

         defel->defname);

  }

  if (dpassword && dpassword->arg)

    password = strVal(dpassword->arg);

  if (dissuper)

    issuper = intVal(dissuper->arg);

  if (dinherit)

    inherit = intVal(dinherit->arg);

  if (dcreaterole)

    createrole = intVal(dcreaterole->arg);

  if (dcreatedb)

    createdb = intVal(dcreatedb->arg);

  if (dcanlogin)

    canlogin = intVal(dcanlogin->arg);

  if (disreplication)

    isreplication = intVal(disreplication->arg);

  if (dconnlimit)

  {

    connlimit = intVal(dconnlimit->arg);

    if (connlimit < -1)

      ereport(ERROR,

          (errcode(ERRCODE_INVALID_PARAMETER_VALUE),

           errmsg("invalid connection limit: %d", connlimit)));

  }

  if (drolemembers)

    rolemembers = (List *) drolemembers->arg;

  if (dvalidUntil)

    validUntil = strVal(dvalidUntil->arg);

  if (dbypassRLS)

    bypassrls = intVal(dbypassRLS->arg);

  /*

   * Scan the pg_authid relation to be certain the user exists.

   */

  pg_authid_rel = heap_open(AuthIdRelationId, RowExclusiveLock);

  pg_authid_dsc = RelationGetDescr(pg_authid_rel);

  tuple = get_rolespec_tuple(stmt->role);

  authform = (Form_pg_authid) GETSTRUCT(tuple);

  rolename = pstrdup(NameStr(authform->rolname));

  roleid = HeapTupleGetOid(tuple);

  /*

   * To mess with a superuser or replication role in any way you gotta be

   * superuser.  We also insist on superuser to change the BYPASSRLS

   * property.  Otherwise, if you don't have createrole, you're only allowed

   * to change your own password.

   */

  if (authform->rolsuper || issuper >= 0)

  {

    if (!superuser())

      ereport(ERROR,

          (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

           errmsg("must be superuser to alter superusers")));

  }

  else if (authform->rolreplication || isreplication >= 0)

  {

    if (!superuser())

      ereport(ERROR,

          (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

           errmsg("must be superuser to alter replication users")));

  }

  else if (bypassrls >= 0)

  {

    if (!superuser())

      ereport(ERROR,

          (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

           errmsg("must be superuser to change bypassrls attribute")));

  }

  else if (!have_createrole_privilege())

  {

    /* We already checked issuper, isreplication, and bypassrls */

    if (!(inherit < 0 &&

        createrole < 0 &&

        createdb < 0 &&

        canlogin < 0 &&

        !dconnlimit &&

        !rolemembers &&

        !validUntil &&

        dpassword &&

        roleid == GetUserId()))

      ereport(ERROR,

          (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

           errmsg("permission denied")));

  }

  /* Convert validuntil to internal form */

  if (validUntil)

  {

    validUntil_datum = DirectFunctionCall3(timestamptz_in,

                         CStringGetDatum(validUntil),

                         ObjectIdGetDatum(InvalidOid),

                         Int32GetDatum(-1));

    validUntil_null = false;

  }

  else

  {

    /* fetch existing setting in case hook needs it */

    validUntil_datum = SysCacheGetAttr(AUTHNAME, tuple,

                       Anum_pg_authid_rolvaliduntil,

                       &validUntil_null);

  }

  /*

   * Call the password checking hook if there is one defined

   */

  if (check_password_hook && password)

    (*check_password_hook) (rolename,

                password,

                get_password_type(password),

                validUntil_datum,

                validUntil_null);

  /*

   * Build an updated tuple, perusing the information just obtained

   */

  MemSet(new_record, 0, sizeof(new_record));

  MemSet(new_record_nulls, false, sizeof(new_record_nulls));

  MemSet(new_record_repl, false, sizeof(new_record_repl));

  /*

   * issuper/createrole/etc

   */

  if (issuper >= 0)

  {

    new_record[Anum_pg_authid_rolsuper - 1] = BoolGetDatum(issuper > 0);

    new_record_repl[Anum_pg_authid_rolsuper - 1] = true;

  }

  if (inherit >= 0)

  {

    new_record[Anum_pg_authid_rolinherit - 1] = BoolGetDatum(inherit > 0);

    new_record_repl[Anum_pg_authid_rolinherit - 1] = true;

  }

  if (createrole >= 0)

  {

    new_record[Anum_pg_authid_rolcreaterole - 1] = BoolGetDatum(createrole > 0);

    new_record_repl[Anum_pg_authid_rolcreaterole - 1] = true;

  }

  if (createdb >= 0)

  {

    new_record[Anum_pg_authid_rolcreatedb - 1] = BoolGetDatum(createdb > 0);

    new_record_repl[Anum_pg_authid_rolcreatedb - 1] = true;

  }

  if (canlogin >= 0)

  {

    new_record[Anum_pg_authid_rolcanlogin - 1] = BoolGetDatum(canlogin > 0);

    new_record_repl[Anum_pg_authid_rolcanlogin - 1] = true;

  }

  if (isreplication >= 0)

  {

    new_record[Anum_pg_authid_rolreplication - 1] = BoolGetDatum(isreplication > 0);

    new_record_repl[Anum_pg_authid_rolreplication - 1] = true;

  }

  if (dconnlimit)

  {

    /* Check connection limit for postgres. */

    if (roleid == 10 && connlimit != -1)

      ereport(ERROR,

          (errcode(ERRCODE_SYNTAX_ERROR),

           errmsg("cannot set connection limit for postgres"),

           errhint("did you mean ALTER ROLE %s CONNECTION LIMIT -1", rolename)));

    new_record[Anum_pg_authid_rolconnlimit - 1] = Int32GetDatum(connlimit);

    new_record_repl[Anum_pg_authid_rolconnlimit - 1] = true;

  }

  /* password */

  if (password)

  {

    char     *shadow_pass;

    char     *logdetail;

    /* Like in CREATE USER, don't allow an empty password. */

    if (password[0] == '\0' ||

      plain_crypt_verify(rolename, password, "", &logdetail) == STATUS_OK)

    {

      ereport(NOTICE,

          (errmsg("empty string is not a valid password, clearing password")));

      new_record_nulls[Anum_pg_authid_rolpassword - 1] = true;

    }

    else

    {

      /* Encrypt the password to the requested format. */

      shadow_pass = encrypt_password(Password_encryption, rolename,

                       password);

      new_record[Anum_pg_authid_rolpassword - 1] =

        CStringGetTextDatum(shadow_pass);

    }

    new_record_repl[Anum_pg_authid_rolpassword - 1] = true;

  }

  /* unset password */

  if (dpassword && dpassword->arg == NULL)

  {

    new_record_repl[Anum_pg_authid_rolpassword - 1] = true;

    new_record_nulls[Anum_pg_authid_rolpassword - 1] = true;

  }

  /* valid until */

  new_record[Anum_pg_authid_rolvaliduntil - 1] = validUntil_datum;

  new_record_nulls[Anum_pg_authid_rolvaliduntil - 1] = validUntil_null;

  new_record_repl[Anum_pg_authid_rolvaliduntil - 1] = true;

  if (bypassrls >= 0)

  {

    new_record[Anum_pg_authid_rolbypassrls - 1] = BoolGetDatum(bypassrls > 0);

    new_record_repl[Anum_pg_authid_rolbypassrls - 1] = true;

  }

  new_tuple = heap_modify_tuple(tuple, pg_authid_dsc, new_record,

                  new_record_nulls, new_record_repl);

  CatalogTupleUpdate(pg_authid_rel, &tuple->t_self, new_tuple);

  InvokeObjectPostAlterHook(AuthIdRelationId, roleid, 0);

  ReleaseSysCache(tuple);

  heap_freetuple(new_tuple);

  /*

   * Advance command counter so we can see new record; else tests in

   * AddRoleMems may fail.

   */

  if (rolemembers)

    CommandCounterIncrement();

  if (stmt->action == +1)    /* add members to role */

    AddRoleMems(rolename, roleid,

          rolemembers, roleSpecsToIds(rolemembers),

          GetUserId(), false);

  else if (stmt->action == -1)  /* drop members from role */

    DelRoleMems(rolename, roleid,

          rolemembers, roleSpecsToIds(rolemembers),

          false);

  /*

   * Close pg_authid, but keep lock till commit.

   */

  heap_close(pg_authid_rel, NoLock);

  return roleid;

}

/*

 * ALTER ROLE ... SET

 */

Oid

AlterRoleSet(AlterRoleSetStmt *stmt)

{

  HeapTuple roletuple;

  Oid     databaseid = InvalidOid;

  Oid     roleid = InvalidOid;

  if (stmt->role)

  {

    check_rolespec_name(stmt->role,

              "Cannot alter reserved roles.");

    roletuple = get_rolespec_tuple(stmt->role);

    roleid = HeapTupleGetOid(roletuple);

    /*

     * Obtain a lock on the role and make sure it didn't go away in the

     * meantime.

     */

    shdepLockAndCheckObject(AuthIdRelationId, HeapTupleGetOid(roletuple));

    /*

     * To mess with a superuser you gotta be superuser; else you need

     * createrole, or just want to change your own settings

     */

    if (((Form_pg_authid) GETSTRUCT(roletuple))->rolsuper)

    {

      if (!superuser())

        ereport(ERROR,

            (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

             errmsg("must be superuser to alter superusers")));

    }

    else

    {

      if (!have_createrole_privilege() &&

        HeapTupleGetOid(roletuple) != GetUserId())

        ereport(ERROR,

            (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

             errmsg("permission denied")));

    }

    ReleaseSysCache(roletuple);

  }

  /* look up and lock the database, if specified */

  if (stmt->database != NULL)

  {

    databaseid = get_database_oid(stmt->database, false);

    shdepLockAndCheckObject(DatabaseRelationId, databaseid);

    if (!stmt->role)

    {

      /*

       * If no role is specified, then this is effectively the same as

       * ALTER DATABASE ... SET, so use the same permission check.

       */

      if (!pg_database_ownercheck(databaseid, GetUserId()))

        aclcheck_error(ACLCHECK_NOT_OWNER, OBJECT_DATABASE,

                 stmt->database);

    }

  }

  if (!stmt->role && !stmt->database)

  {

    /* Must be superuser to alter settings globally. */

    if (!superuser())

      ereport(ERROR,

          (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

           errmsg("must be superuser to alter settings globally")));

  }

  AlterSetting(databaseid, roleid, stmt->setstmt);

  return roleid;

}

/*

 * DROP ROLE

 */

void

DropRole(DropRoleStmt *stmt)

{

  Relation  pg_authid_rel,

        pg_auth_members_rel;

  ListCell   *item;

  if (!have_createrole_privilege())

    ereport(ERROR,

        (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),

         errmsg("permission denied to drop role")));

  /*

   * Scan the pg_authid relation to find the Oid of the role(s) to be

   * deleted.

   */

  pg_authid_rel = heap_open(AuthIdRelationId, RowExclusiveLock);

  pg_auth_members_rel = heap_open(AuthMemRelationId, RowExclusiveLock);

  foreach(item, stmt->roles)

  {

    RoleSpec   *rolspec = lfirst(item);

    char     *role;

    HeapTuple tuple,

          tmp_tuple;

    ScanKeyData scankey;

    char     *detail;

    char     *detail_log;

    SysScanDesc sscan;

    Oid     roleid;

    if (rolspec->roletype != ROLESPEC_CSTRING)

      ereport(ERROR,

          (errcode(ERRCODE_INVALID_PARAMETER_VALUE),

           errmsg("cannot use special role specifier in DROP ROLE")));

    role = rolspec->rolename;

    tuple = SearchSysCache1(AUTHNAME, PointerGetDatum(role));

    if (!HeapTupleIsValid(tuple))

    {

      if (!stmt->missing_ok)

      {

        ereport(ERROR,

            (errcode(ERRCODE_UNDEFINED_OBJECT),

             errmsg("role \"%s\" does not exist", role)));