pgadmin-org / pgadmin-org/pgadmin4

Database Properties panel always shows empty "Default TABLE/SEQUENCE/FUNCTION/TYPE privileges"

Open Beginner friendly
#10,401 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
3.8k
Forks
891
Avg merge
4d 7h
Merged PRs (30d)
8

Description

Describe the bug

On the read-only Properties panel of a Database node, the Security section always shows empty values for Default TABLE privileges, Default SEQUENCE privileges, Default FUNCTION privileges and Default TYPE privileges, even when the database has default privileges configured.

Opening the same database in the Edit dialog → Default Privileges tab shows all the entries correctly (Grantee / Privileges / Grantor), so the data is fetched fine — only the read-only panel renders nothing.

Root cause (field id mismatch)

The properties endpoint returns the real default ACLs under deftblacl / defseqacl / deffuncacl / deftypeacl, but the read-only panel is bound to tblacl / seqacl / funcacl / typeacl, which are hardcoded to an empty string (and typeacl is never returned at all).

web/pgadmin/browser/server_groups/servers/databases/templates/databases/sql/default/properties.sql:

{### Default ACL for Tables ###}
'' AS tblacl,
{### Default ACL for Sequnces ###}
'' AS seqacl,
{### Default ACL for Functions ###}
'' AS funcacl,
pg_catalog.array_to_string(datacl::text[], ', ') AS acl

web/pgadmin/browser/server_groups/servers/databases/__init__.py (properties()) then runs defacl.sql and merges the rows with formatdbacl(), which keys them by the deftype produced by defacl.sql:

CASE (a.deftype)
WHEN 'r' THEN 'deftblacl'
WHEN 'S' THEN 'defseqacl'
WHEN 'f' THEN 'deffuncacl'
WHEN 'T' THEN 'deftypeacl'
END AS deftype

web/pgadmin/browser/server_groups/servers/databases/static/js/database.ui.js:

{ id: 'tblacl',  label: gettext('Default TABLE privileges'),    type: 'text', group: gettext('Security'), mode: ['properties'] },
{ id: 'seqacl',  label: gettext('Default SEQUENCE privileges'), type: 'text', group: gettext('Security'), mode: ['properties'] },
{ id: 'funcacl', label: gettext('Default FUNCTION privileges'), type: 'text', group: gettext('Security'), mode: ['properties'] },
{ id: 'typeacl', label: gettext('Default TYPE privileges'),     type: 'text', group: gettext('Security'), mode: ['properties'], min_version: 90200 },
...
{ type: 'nested-tab', group: gettext('Default Privileges'), mode: ['edit'],
  schema: new DefaultPrivSchema(this.getPrivilegeRoleSchema, this.nodeInfo) },  // reads def*acl

So the mode: ['properties'] fields can never be populated.

Verified identical on master and on REL-9_17.

To Reproduce

  1. Connect to a server as a role that is not the grantor (any login role works).
  2. On some database, set database-wide default privileges (defaclnamespace = 0), e.g.:
    ALTER DEFAULT PRIVILEGES FOR ROLE some_owner GRANT SELECT ON TABLES TO some_reader;
    ALTER DEFAULT PRIVILEGES FOR ROLE some_owner GRANT SELECT ON SEQUENCES TO some_reader;
    
    Confirm they exist:
    SELECT pg_get_userbyid(defaclrole) AS grantor,
           COALESCE(n.nspname, '<global>') AS schema,
           defaclobjtype, defaclacl::text
    FROM pg_default_acl d
    LEFT JOIN pg_namespace n ON n.oid = d.defaclnamespace;
    
  3. Select the database in the browser tree and open the Properties tab → Security section.
  4. Default TABLE privileges / Default SEQUENCE privileges / Default FUNCTION privileges / Default TYPE privileges are all empty.
  5. Right-click the database → Properties… (edit dialog) → Default Privileges tab → the entries are listed correctly.

Expected behavior

The read-only Properties panel should show the same default privileges as the edit dialog.

Error message

None — no error is raised, the fields are just empty.

Suggested fix

Either bind the read-only fields to the ids that actually carry the data (deftblacl, defseqacl, deffuncacl, deftypeacl, rendered read-only), or populate tblacl/seqacl/funcacl/typeacl with a text representation in formatdbacl().

Desktop:

  • OS: macOS 26.6.2 (Apple Silicon)
  • pgAdmin version: 9.17
  • Mode: Desktop
  • Browser: n/a
  • Package type: macOS app bundle (DMG)

Additional context

Server: Azure Database for PostgreSQL — Flexible Server. The default privileges in question were created database-wide (no IN SCHEMA), with two distinct grantors, and the connected role was neither the grantor nor the database owner — but by code inspection none of that matters, the fields are unconditionally empty.

The Privileges (acl) field in the same section is fine — it maps to datacl and is returned by properties.sql.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with web/pgadmin/browser/server_groups/servers/databases/static/js/database.ui.js and compare the read-only privilege field IDs with the deftblacl, defseqacl, deffuncacl and deftypeacl values merged by properties() in init.py. Review properties.sql and defacl.sql to confirm the returned keys, then reproduce the issue with database-wide default privileges. Done means the read-only Security section displays the same default privileges as the edit dialog.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, postgresql, python, sql
Domain
backend, database, frontend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.