fix: strict qualification

Makefile

@@ -29,7 +29,7 @@ else
 endif
 
 EXTENSION = supabase_vault
-EXTVERSION = 0.3.2
+EXTVERSION = 0.3.3
 
 DATA = $(wildcard sql/*--*.sql)
 

nix/plpgsql-check.nix

@@ -7,13 +7,15 @@
 
 stdenv.mkDerivation rec {
   pname = "plpgsql-check";
-  version = "2.10.15";
+  version = "6afcb44a5f9ec06de7b74d8f8ebbeb638ac7b945";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = "plpgsql_check";
-    rev = "v${version}";
-    hash = "sha256-war+GVHMDegfDXjxdIsUkrPPDntKeyb/bGxibHVbpDo=";
+    #  rev = "v${version}";
+    rev = "6afcb44a5f9ec06de7b74d8f8ebbeb638ac7b945";
+
+    hash = "sha256-AQGJglOiuUC5djHNiJHpzDErfpmqglvs7djxfX8mHEc=";
   };
 
   buildInputs = [ postgresql ];

sql/supabase_vault--0.3.2--0.3.3.sql

@@ -0,0 +1,56 @@
+CREATE OR REPLACE FUNCTION vault.create_secret(new_secret text
+                                  , new_name text = CAST(NULL AS text)
+                                  , new_description text = CAST('' AS text)
+                                  , new_key_id uuid = CAST(NULL AS uuid))
+RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'pg_catalog', 'pg_temp'
+AS $$
+DECLARE
+  rec record;
+BEGIN
+  INSERT INTO vault.secrets (secret, name, description)
+  VALUES (
+    new_secret,
+    new_name,
+    new_description
+  )
+  RETURNING * INTO rec;
+  UPDATE vault.secrets s
+  SET secret = pg_catalog.encode(vault._crypto_aead_det_encrypt(
+    message := pg_catalog.convert_to(rec.secret, 'utf8'),
+    additional := pg_catalog.convert_to(s.id::pg_catalog.text, 'utf8'),
+    key_id := 0,
+    context := 'pgsodium'::pg_catalog.bytea,
+    nonce := rec.nonce
+  ), 'base64')
+  WHERE s.id OPERATOR(pg_catalog.=) rec.id;
+  RETURN rec.id;
+END
+$$;
+
+
+CREATE OR REPLACE FUNCTION vault.update_secret(secret_id uuid
+                                  , new_secret text = CAST(NULL AS text)
+                                  , new_name text = CAST(NULL AS text)
+                                  , new_description text = CAST(NULL AS text)
+                                  , new_key_id uuid = CAST(NULL AS uuid))
+RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'pg_catalog', 'pg_temp'
+AS $$
+BEGIN
+  UPDATE vault.secrets s
+  SET
+    secret = CASE WHEN new_secret IS NULL THEN s.secret
+                  ELSE pg_catalog.encode(vault._crypto_aead_det_encrypt(
+                    message := pg_catalog.convert_to(new_secret, 'utf8'),
+                    additional := pg_catalog.convert_to(s.id::pg_catalog.text, 'utf8'),
+                    key_id := 0,
+                    context := 'pgsodium'::pg_catalog.bytea,
+                    nonce := s.nonce
+                  ), 'base64') END,
+    name = coalesce(new_name, s.name),
+    description = coalesce(new_description, s.description),
+    updated_at = pg_catalog.now()
+  WHERE s.id OPERATOR(pg_catalog.=) secret_id;
+END
+$$;

supabase_vault.sql

@@ -49,14 +49,14 @@ BEGIN
   )
   RETURNING * INTO rec;
   UPDATE vault.secrets s
-  SET secret = encode(vault._crypto_aead_det_encrypt(
-    message := convert_to(rec.secret, 'utf8'),
-    additional := convert_to(s.id::text, 'utf8'),
+  SET secret = pg_catalog.encode(vault._crypto_aead_det_encrypt(
+    message := pg_catalog.convert_to(rec.secret, 'utf8'),
+    additional := pg_catalog.convert_to(s.id::pg_catalog.text, 'utf8'),
     key_id := 0,
-    context := 'pgsodium'::bytea,
+    context := 'pgsodium'::pg_catalog.bytea,
     nonce := rec.nonce
   ), 'base64')
-  WHERE id = rec.id;
+  WHERE s.id OPERATOR(pg_catalog.=) rec.id;
   RETURN rec.id;
 END
 $$;
@@ -75,17 +75,17 @@ BEGIN
   UPDATE vault.secrets s
   SET
     secret = CASE WHEN new_secret IS NULL THEN s.secret
-                  ELSE encode(vault._crypto_aead_det_encrypt(
-                    message := convert_to(new_secret, 'utf8'),
-                    additional := convert_to(s.id::text, 'utf8'),
+                  ELSE pg_catalog.encode(vault._crypto_aead_det_encrypt(
+                    message := pg_catalog.convert_to(new_secret, 'utf8'),
+                    additional := pg_catalog.convert_to(s.id::pg_catalog.text, 'utf8'),
                     key_id := 0,
-                    context := 'pgsodium'::bytea,
+                    context := 'pgsodium'::pg_catalog.bytea,
                     nonce := s.nonce
                   ), 'base64') END,
     name = coalesce(new_name, s.name),
     description = coalesce(new_description, s.description),
-    updated_at = now()
-  WHERE s.id = secret_id;
+    updated_at = pg_catalog.now()
+  WHERE s.id OPERATOR(pg_catalog.=) secret_id;
 END
 $$;
 

test/expected/test.out

@@ -85,7 +85,7 @@ where name = 'empty_secret';
 SELECT extversion FROM pg_extension where extname = 'supabase_vault';
  extversion 
 ------------
- 0.3.2
+ 0.3.3
 (1 row)
 
 -- Validate that each security definer function explicitly specifies pg_temp and 
@@ -139,7 +139,8 @@ FROM
     SELECT
         plpgsql_check_function_tb(pg_proc.oid, COALESCE(pg_trigger.tgrelid, 0),
                                   oldtable=>pg_trigger.tgoldtable,
-                                  newtable=>pg_trigger.tgnewtable) AS pcf
+                                  newtable=>pg_trigger.tgnewtable,
+			          extra_security_warnings_level=>4) AS pcf
     FROM pg_proc
     LEFT JOIN pg_trigger
         ON (pg_trigger.tgfoid = pg_proc.oid)

test/sql/test.sql

@@ -114,7 +114,8 @@ FROM
     SELECT
         plpgsql_check_function_tb(pg_proc.oid, COALESCE(pg_trigger.tgrelid, 0),
                                   oldtable=>pg_trigger.tgoldtable,
-                                  newtable=>pg_trigger.tgnewtable) AS pcf
+                                  newtable=>pg_trigger.tgnewtable,
+			          extra_security_warnings_level=>4) AS pcf
     FROM pg_proc
     LEFT JOIN pg_trigger
         ON (pg_trigger.tgfoid = pg_proc.oid)