Claude pointed out that pg_hba_file_rules leaves the validator options out:
host all all 127.0.0.1/32 oauth issuer="https://issuer.example";
scope="pg" validator.log="hi" validator.typo=1
SELECT options FROM pg_hba_file_rules WHERE line_number = 2;
options
-----------------------------------------------------------
{issuer=https://issuer.example,scope=pg,validator=validator}
I think this matters a bit more than for the builtin options, because
unknown validator.* names can't be detected at reload time, and the
view is the only place where an admin can see what the server actually
parsed. The values still won't go through validations, e.g. in the
above example typo will be simply displayed, but I think that's
already better than hiding them and is worth doing.
The attached patch emits them as validator.<name>=<value>, in the
order they appear on the line. Since there's no limit on how many
options a line can have, the fixed MAX_HBA_OPTIONS array doesn't work
anymore, so options are sized dynamically now (MAX_HBA_OPTIONS plus
the number of validator options).
v1-0001-oauth-Show-validator.-options-in-pg_hba_file_rule.patch
Description: Binary data
