While tryng the new v19 feature CREATE/ALTER SUBSCRIPTION ... SERVER, I found that ALTER SUBSCRIPTION ... OWNER TO can change the effective conninfo for a SERVER subscription, but does not validate the new owner's generated conninfo with walrcv_check_conninfo().
As a result, the owner of a SERVER subscription with password_required=true can be changed to a non-superuser whose generated connection string does not contain a password. The ownership change succeeds, but the subscription is left in a state that will fail later when a worker or another command tries to connect.
Isn't this problematic?
The attached patch fixes this by making ALTER SUBSCRIPTION ... OWNER TO validate the new owner's generated conninfo with walrcv_check_conninfo(). It also updates the ALTER SUBSCRIPTION documentation to mention the SERVER-specific requirements for changing the owner.
Thought?
Regards,
-- Fujii Masao
Sounds correct to me to do the conninfo validation.
A small comment on the documentation change:
+ for the new owner or for <literal>PUBLIC</literal> must exist, and the + connection string generated for the new owner must satisfy the subscription's + <literal>password_required</literal> setting.
From the implementation, only when a new owner is not superuser, it needs to satisfy the password_required setting.
