1

Let's say I have:
posts

id created_at updated_at ...

The default value for created_at is now(), and I have a trigger for updated_at like so:

create trigger posts_updated_at before update on posts 
for each row execute procedure moddatetime (updated_at);

How do I prevent everyone from updating the dates manually?

  • created_at
  • updated_at

I imagine there is a standard way to protect these field (column level security maybe)?

Something like this...

CREATE POLICY no_date_change ON posts
    FOR UPDATE
    USING (created_at === created_at);

Either created_at does not change or created_at before = created_at after?

What is the standard way to protect these fields?

J

1

2 Answers 2

4

Best way to implement this is to use column privilege and security group together.

GRANT ... update(<column_name>..) on <table_name> to ....

The post is long because I am trying to demonstrate it with steps and examples. Otherwise its simple few steps.

Demo Scenario

Experiment table: pgvpd
Experiment schema: demo_schema
Admin User(full privilege on expriment table): postgres
General user (restricted access on necessary column): demo_user.

Table

select current_user;
create table demo_schema.pgvpd(txt varchar(10),createat date,updateat date);
insert into demo_schema.pgvpd values('one',current_date,current_date);
select * from demo_schema.pgvpd;

Output:

postgres=# select current_user;
 current_user
--------------
 postgres
(1 row)
postgres=# create table demo_schema.pgvpd(txt varchar(10),createat date,updateat date);
CREATE TABLE
postgres=# insert into demo_schema.pgvpd values('one',current_date,current_date);
INSERT 0 1
postgres=# select * from demo_schema.pgvpd;
 txt |  createat  |  updateat
-----+------------+------------
 one | 2022-02-06 | 2022-02-06
(1 row)

General User

create user demo_user password 'demo_user' valid until 'infinity';

Output:

postgres=# create user demo_user password 'demo_user' valid until 'infinity';
CREATE ROLE

Revoke the table from general availability and verify

revoke all on demo_schema.pgvpd from public;
set session authorization demo_user;
select current_user;
select * from demo_schema.pgvpd; 

Output:

postgres=# revoke all on demo_schema.pgvpd from public;
REVOKE
postgres=# set session authorization demo_user;
SET
postgres=> select current_user;
 current_user
--------------
 demo_user
(1 row)
postgres=> select * from demo_schema.pgvpd;
ERROR:  permission denied for schema demo_schema
LINE 1: select * from demo_schema.pgvpd;

Create two security groups one for Admin (all privilege) and one for the needed restriction. Note: the all important piece ...update(txt) -> update is allowed only on 'txt' column, not on the date columns.

create group general_users;
grant usage on schema demo_schema to group general_users;
grant select,delete,insert,update(txt) on demo_schema.pgvpd to group general_users;
alter group general_users add user demo_user;

create group admin_users;
grant usage on schema demo_schema to group admin_users;
grant all on demo_schema.pgvpd to admin_users;
alter group admin_users add user postgres;

Output:

postgres=# create group general_users;
CREATE ROLE
postgres=# grant usage on schema demo_schema to group general_users;
GRANT
postgres=# grant select,delete,insert,update(txt) on demo_schema.pgvpd to group general_users;
GRANT
postgres=# alter group general_users add user demo_user;
ALTER ROLE

postgres=# create group admin_users;
CREATE ROLE
postgres=# grant usage on schema demo_schema to group admin_users;
GRANT
postgres=# grant all on demo_schema.pgvpd to admin_users;
GRANT
postgres=# alter group admin_users add user postgres;
ALTER ROLE

Verify the update on the column that needs protection is NOT ALLOWED for the general user but allowed for admin user.

For General User:

set session authorization demo_user;
select current_user;
select * from demo_schema.pgvpd;
insert into demo_schema.pgvpd values('two',current_date,current_date);
select * from demo_schema.pgvpd;
update  demo_schema.pgvpd set txt = 'two again' where txt='two';
select * from demo_schema.pgvpd;
update  demo_schema.pgvpd set createat = current_date where txt='two';

Output:

postgres=# set session authorization demo_user;
SET
postgres=> select current_user;
 current_user
--------------
 demo_user
(1 row)

postgres=> select * from demo_schema.pgvpd;
 txt |  createat  |  updateat
-----+------------+------------
 one | 2022-02-06 | 2022-02-06
(1 row)

postgres=> insert into demo_schema.pgvpd values('two',current_date,current_date);
INSERT 0 1
postgres=> select * from demo_schema.pgvpd;
 txt |  createat  |  updateat
-----+------------+------------
 one | 2022-02-06 | 2022-02-06
 two | 2022-02-06 | 2022-02-06
(2 rows)

postgres=> update  demo_schema.pgvpd set txt = 'two again' where txt='two';
UPDATE 1
postgres=> select * from demo_schema.pgvpd;
    txt    |  createat  |  updateat
-----------+------------+------------
 one       | 2022-02-06 | 2022-02-06
 two again | 2022-02-06 | 2022-02-06
(2 rows)

postgres=> update  demo_schema.pgvpd set createat = current_date where txt='two';
ERROR:  permission denied for table pgvpd

For admin user:

postgres=> set session authorization postgres;
SET
postgres=# select current_user;
 current_user
--------------
 postgres
(1 row)
postgres=# update  demo_schema.pgvpd set createat = current_date where txt='two again';
UPDATE 1

Advice: Keep the number of Triggers as low as possible on production tables and also perfectly tuned for performance. Triggers are overhead on production tables for every DML that executes on it.

Edit: 7th February 2022 Demonstration through Row Level Security Policy.

Step 1: Create & populate the table with test data.

create table posts
(
 id serial primary key,
 created_at timestamp,
 updated_at timestamp
);
grant all on posts to public;
grant all on posts_id_seq to public;

insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
select pg_catalog.pg_sleep(10);
insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);

Step 2: Enable row level security policy.

alter table posts enable row level security;

Step 3: Create a permissive policy for SELECT,INSERT,DELETE.

create policy posts_insert on posts for insert with check(true);
create policy posts_delete on posts for delete using(true);
create policy posts_select on posts for select using(true);

Step 4: Create the function that returns TRUE or FALSE for the permissive policy for UPDATE.

create or replace function posts_update_check(id_new int,updated_at_new timestamp, created_at_new timestamp)
returns boolean
language plpgsql
as
$$
declare 
    row_variable posts%rowtype;
    flag boolean;
begin
    flag := true;
    select * from posts into row_variable where id=id_new;
    if (row_variable.updated_at != updated_at_new or row_variable.created_at != created_at_new) 
        then flag := false;
    end if;
    return flag; 
end; $$;

Step 5: Create the final all important permission policy for UPDATE.

create policy posts_update on posts for update using(true) with check(posts_update_check(id,updated_at,created_at));

Step 6: Run test as non-owner of the table.

set session authorization demo_user;
select current_user;
select * from posts;
insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
select pg_catalog.pg_sleep(5);
insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
select * from posts;
delete from posts where id= 1;
update posts set id=1 where id=2;
update posts set created_at = current_timestamp where id=1;
update posts set updated_at = current_timestamp where id=1;

Trail:

postgres=# create table posts
postgres-# (
postgres(#  id serial primary key,
postgres(#  created_at timestamp,
postgres(#  updated_at timestamp
postgres(# );
CREATE TABLE
postgres=# grant all on posts to public;
GRANT
postgres=# grant all on posts_id_seq to public;
GRANT
postgres=#
postgres=#
postgres=# insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
INSERT 0 1
postgres=# select pg_catalog.pg_sleep(10);
 pg_sleep
----------

(1 row)

postgres=# insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
INSERT 0 1
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=# alter table posts enable row level security;
ALTER TABLE
postgres=#
postgres=#
postgres=#
postgres=# create policy posts_insert on posts for insert with check(true);
CREATE POLICY
postgres=# create policy posts_delete on posts for delete using(true);
CREATE POLICY
postgres=# create policy posts_select on posts for select using(true);
CREATE POLICY
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=# create or replace function posts_update_check(id_new int,updated_at_new timestamp, created_at_new timestamp)
postgres-# returns boolean
postgres-# language plpgsql
postgres-# as
postgres-# $$
postgres$# declare
postgres$# row_variable posts%rowtype;
postgres$# flag boolean;
postgres$# begin
postgres$# flag := true;
postgres$# select * from posts into row_variable where id=id_new;
postgres$# if (row_variable.updated_at != updated_at_new or row_variable.created_at != created_at_new)
postgres$#

postgres$# then flag := false;
postgres$# end if;
postgres$# return flag;
postgres$# end; $$;
CREATE FUNCTION
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=# create policy posts_update on posts for update using(true) with check(posts_update_check(id,updated_at,created_at));
CREATE POLICY
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=# set session authorization demo_user;
SET
postgres=> select current_user;
 current_user
--------------
 demo_user
(1 row)

postgres=> select * from posts;
 id |         created_at         |         updated_at
----+----------------------------+----------------------------
  1 | 2022-02-08 08:32:41.527004 | 2022-02-08 08:32:41.527004
  2 | 2022-02-08 08:32:51.536821 | 2022-02-08 08:32:51.536821
(2 rows)

postgres=> insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
INSERT 0 1
postgres=> select pg_catalog.pg_sleep(5);
 pg_sleep
----------

(1 row)

postgres=> insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
INSERT 0 1
postgres=> select * from posts;
 id |         created_at         |         updated_at
----+----------------------------+----------------------------
  1 | 2022-02-08 08:32:41.527004 | 2022-02-08 08:32:41.527004
  2 | 2022-02-08 08:32:51.536821 | 2022-02-08 08:32:51.536821
  3 | 2022-02-08 08:33:41.400015 | 2022-02-08 08:33:41.400015
  4 | 2022-02-08 08:33:46.411654 | 2022-02-08 08:33:46.411654
(4 rows)

postgres=> delete from posts where id= 1;
DELETE 1
postgres=> update posts set id=1 where id=2;
UPDATE 1
postgres=> update posts set created_at = current_timestamp where id=1;
ERROR:  new row violates row-level security policy for table "posts"
postgres=> update posts set updated_at = current_timestamp where id=1;
ERROR:  new row violates row-level security policy for table "posts"
postgres=>


Edit 2: 7th February 2022 , demonstrating the impact of triggers.

Set up: Identical tables

Posts - have security rules

Posts_1 - have triggers

Both freshly created tables with identical rows.

posts:

postgres=> \d posts
                                        Table "public.posts"
   Column   |            Type             | Collation | Nullable |              Default
------------+-----------------------------+-----------+----------+-----------------------------------
 id         | integer                     |           | not null | nextval('posts_id_seq'::regclass)
 created_at | timestamp without time zone |           |          |
 updated_at | timestamp without time zone |           |          |
Indexes:
    "posts_pkey" PRIMARY KEY, btree (id)
Policies (forced row security enabled):
    POLICY "posts_delete" FOR DELETE
      USING (true)
    POLICY "posts_insert" FOR INSERT
      WITH CHECK (true)
    POLICY "posts_select" FOR SELECT
      USING (true)
    POLICY "posts_update" FOR UPDATE
      USING (true)
      WITH CHECK (posts_update_check(id, updated_at, created_at))
  postgres=> select * from posts;
 id |         created_at         |         updated_at
----+----------------------------+----------------------------
  8 | 2022-02-08 16:23:20.48457  | 2022-02-08 16:23:20.48457
  9 | 2022-02-08 16:23:30.501669 | 2022-02-08 16:23:30.501669
(2 rows)

posts_1:

postgres=> \d posts_1
                                        Table "public.posts_1"
   Column   |            Type             | Collation | Nullable |               Default
------------+-----------------------------+-----------+----------+-------------------------------------
 id         | integer                     |           | not null | nextval('posts_1_id_seq'::regclass)
 created_at | timestamp without time zone |           |          |
 updated_at | timestamp without time zone |           |          |
Indexes:
    "posts_1_pkey" PRIMARY KEY, btree (id)
Triggers:
    on_posts_1_update BEFORE UPDATE ON posts_1 FOR EACH ROW EXECUTE FUNCTION posts_1_created_at()

postgres=> select * from posts_1;
 id |         created_at         |         updated_at
----+----------------------------+----------------------------
  3 | 2022-02-08 16:17:11.792555 | 2022-02-08 16:17:11.792555
  4 | 2022-02-08 16:17:21.800956 | 2022-02-08 16:17:21.800956
(2 rows)

Performance Comparison on posts and posts_1

posts (policy based)

postgres=> explain (analyze,timing,buffers)   update posts_1 set id=80 where id=8;
                                               QUERY PLAN
--------------------------------------------------------------------------------------------------------
 Update on posts_1  (cost=0.00..1.02 rows=1 width=26) (actual time=0.017..0.020 rows=0 loops=1)
   Buffers: shared hit=1
   ->  Seq Scan on posts_1  (cost=0.00..1.02 rows=1 width=26) (actual time=0.014..0.015 rows=0 loops=1)
         Filter: (id = 8)
         Rows Removed by Filter: 2
         Buffers: shared hit=1
 Planning Time: 0.076 ms
 Execution Time: 0.054 ms
(8 rows)

posts_1 (trigger based)

postgres=> explain (analyze,timing,buffers)   update posts_1 set id=40 where id=4;
                                               QUERY PLAN
--------------------------------------------------------------------------------------------------------
 Update on posts_1  (cost=0.00..1.02 rows=1 width=26) (actual time=0.112..0.115 rows=0 loops=1)
   Buffers: shared hit=3 read=1 dirtied=2
   ->  Seq Scan on posts_1  (cost=0.00..1.02 rows=1 width=26) (actual time=0.015..0.017 rows=1 loops=1)
         Filter: (id = 4)
         Rows Removed by Filter: 1
         Buffers: shared hit=1
 Planning Time: 0.075 ms
 Trigger on_posts_1_update: time=0.033 calls=1
 Execution Time: 0.150 ms
(9 rows)

The difference in the execution plan is the extra line for the trigger.

Trigger on_posts_1_update: time=0.033 calls=1

I believe even the policy has to execute code but it appears triggers are more costly. However, trade-off can be ignored if the amount of updates and the latency introduced through trigger is acceptable. You can really discern it through benchmarking.

4
  • Thanks for the detailed answer. So, I'm using supabase and it turns out I do not have direct access to roles or grants. Eitherway, I want to disable it for everyone using a trigger or policy
    – Jonathan
    Feb 7, 2022 at 3:31
  • @Jonathan since you have restriction on grants , I have demonstrated the steps using ROW-LEVEL-SECURITY policy.
    – rajorshi
    Feb 7, 2022 at 23:41
  • Thanks! You definitively covered all bases! - I wrote a simpler version for my use case - dev.to/jdgamble555/supabase-date-protection-on-postgresql-1n91
    – Jonathan
    Feb 8, 2022 at 4:51
  • @Jonathan Thanks for accepting the answer. My order of preference is : No trigger/No Security policy -> Security Policy -> Trigger. I have the reason with an additional EDIT .. I know its kinda getting long but I promise this will be the last. It was a great question to work with.
    – rajorshi
    Feb 8, 2022 at 7:47
1

I have a trigger for updated_at

So you have a trigger that sets updated_at. So there's already no way for anybody to update this field, as the trigger will overwrite it.

Then you just need additional check in the trigger - something like if OLD.created_at<>NEW.created_at then raise ERROR.

I'd also run similar trigger on CREATE, to force created_at and updated_at also while creating rows.

1
  • The updated_at runs before, but I can change it to run after. Do you know what the exact code would be. I don't know anthing about triggers, errors, etc except for the basics.
    – Jonathan
    Feb 7, 2022 at 3:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.