On Tue, Jul 21, 2026 at 3:23 PM Fujii Masao <[email protected]> wrote:
> Hi, > > While tryng the new v19 feature CREATE/ALTER SUBSCRIPTION ... SERVER, > I found that ALTER SUBSCRIPTION ... OWNER TO can change the effective > conninfo for a SERVER subscription, but does not validate the new owner's > generated conninfo with walrcv_check_conninfo(). > > As a result, the owner of a SERVER subscription with password_required=true > can be changed to a non-superuser whose generated connection string does > not > contain a password. The ownership change succeeds, but the subscription is > left in a state that will fail later when a worker or another command > tries to > connect. > > Isn't this problematic? > > The attached patch fixes this by making ALTER SUBSCRIPTION ... OWNER TO > validate the new owner's generated conninfo with walrcv_check_conninfo(). > It also updates the ALTER SUBSCRIPTION documentation to mention > the SERVER-specific requirements for changing the owner. > > Thought? > > Regards, > > -- > Fujii Masao > Sounds correct to me to do the conninfo validation. A small comment on the documentation change: + for the new owner or for <literal>PUBLIC</literal> must exist, and the + connection string generated for the new owner must satisfy the subscription's + <literal>password_required</literal> setting. >From the implementation, only when a new owner is not superuser, it needs to satisfy the password_required setting. Regards, Yuanchao Zhang
