pgadmin-org / pgadmin-org/pgadmin4
Database Properties panel always shows empty "Default TABLE/SEQUENCE/FUNCTION/TYPE privileges"
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 891
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 8
Description
Describe the bug
On the read-only Properties panel of a Database node, the Security section always shows empty values for Default TABLE privileges, Default SEQUENCE privileges, Default FUNCTION privileges and Default TYPE privileges, even when the database has default privileges configured.
Opening the same database in the Edit dialog → Default Privileges tab shows all the entries correctly (Grantee / Privileges / Grantor), so the data is fetched fine — only the read-only panel renders nothing.
Root cause (field id mismatch)
The properties endpoint returns the real default ACLs under deftblacl / defseqacl / deffuncacl / deftypeacl, but the read-only panel is bound to tblacl / seqacl / funcacl / typeacl, which are hardcoded to an empty string (and typeacl is never returned at all).
web/pgadmin/browser/server_groups/servers/databases/templates/databases/sql/default/properties.sql:
{### Default ACL for Tables ###}
'' AS tblacl,
{### Default ACL for Sequnces ###}
'' AS seqacl,
{### Default ACL for Functions ###}
'' AS funcacl,
pg_catalog.array_to_string(datacl::text[], ', ') AS acl
web/pgadmin/browser/server_groups/servers/databases/__init__.py (properties()) then runs defacl.sql and merges the rows with formatdbacl(), which keys them by the deftype produced by defacl.sql:
CASE (a.deftype)
WHEN 'r' THEN 'deftblacl'
WHEN 'S' THEN 'defseqacl'
WHEN 'f' THEN 'deffuncacl'
WHEN 'T' THEN 'deftypeacl'
END AS deftype
web/pgadmin/browser/server_groups/servers/databases/static/js/database.ui.js:
{ id: 'tblacl', label: gettext('Default TABLE privileges'), type: 'text', group: gettext('Security'), mode: ['properties'] },
{ id: 'seqacl', label: gettext('Default SEQUENCE privileges'), type: 'text', group: gettext('Security'), mode: ['properties'] },
{ id: 'funcacl', label: gettext('Default FUNCTION privileges'), type: 'text', group: gettext('Security'), mode: ['properties'] },
{ id: 'typeacl', label: gettext('Default TYPE privileges'), type: 'text', group: gettext('Security'), mode: ['properties'], min_version: 90200 },
...
{ type: 'nested-tab', group: gettext('Default Privileges'), mode: ['edit'],
schema: new DefaultPrivSchema(this.getPrivilegeRoleSchema, this.nodeInfo) }, // reads def*acl
So the mode: ['properties'] fields can never be populated.
Verified identical on master and on REL-9_17.
To Reproduce
- Connect to a server as a role that is not the grantor (any login role works).
- On some database, set database-wide default privileges (
defaclnamespace = 0), e.g.:
Confirm they exist:ALTER DEFAULT PRIVILEGES FOR ROLE some_owner GRANT SELECT ON TABLES TO some_reader; ALTER DEFAULT PRIVILEGES FOR ROLE some_owner GRANT SELECT ON SEQUENCES TO some_reader;SELECT pg_get_userbyid(defaclrole) AS grantor, COALESCE(n.nspname, '<global>') AS schema, defaclobjtype, defaclacl::text FROM pg_default_acl d LEFT JOIN pg_namespace n ON n.oid = d.defaclnamespace; - Select the database in the browser tree and open the Properties tab → Security section.
Default TABLE privileges/Default SEQUENCE privileges/Default FUNCTION privileges/Default TYPE privilegesare all empty.- Right-click the database → Properties… (edit dialog) → Default Privileges tab → the entries are listed correctly.
Expected behavior
The read-only Properties panel should show the same default privileges as the edit dialog.
Error message
None — no error is raised, the fields are just empty.
Suggested fix
Either bind the read-only fields to the ids that actually carry the data (deftblacl, defseqacl, deffuncacl, deftypeacl, rendered read-only), or populate tblacl/seqacl/funcacl/typeacl with a text representation in formatdbacl().
Desktop:
- OS: macOS 26.6.2 (Apple Silicon)
- pgAdmin version: 9.17
- Mode: Desktop
- Browser: n/a
- Package type: macOS app bundle (DMG)
Additional context
Server: Azure Database for PostgreSQL — Flexible Server. The default privileges in question were created database-wide (no IN SCHEMA), with two distinct grantors, and the connected role was neither the grantor nor the database owner — but by code inspection none of that matters, the fields are unconditionally empty.
The Privileges (acl) field in the same section is fine — it maps to datacl and is returned by properties.sql.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with web/pgadmin/browser/server_groups/servers/databases/static/js/database.ui.js and compare the read-only privilege field IDs with the deftblacl, defseqacl, deffuncacl and deftypeacl values merged by properties() in init.py. Review properties.sql and defacl.sql to confirm the returned keys, then reproduce the issue with database-wide default privileges. Done means the read-only Security section displays the same default privileges as the edit dialog.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, postgresql, python, sql
- Domain
- backend, database, frontend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100