commas separated privileges for default_privileges doesn't work as expected.

Describe the Bug

I tried to set several privileges as default privileges for a role in a schema but it failed in error during execution (Illegal value for $privilege parameter.)

Expected Behavior

ALTER DEFAULT PRIVILEGES FOR ROLE xyz_dml IN SCHEMA xyz_sch GRANT INSERT,SELECT,UPDATE,DELETE ON TABLES TO "xyz_aoo"

Steps to Reproduce

Hi there,

I have created a type called t_default_privileges

type Db_profile::Postgresql::T_default_privileges =
  Struct[
    user => String,
    ensure => Enum['present','absent'],
    db => String,
    owner => Optional[String],
    privilege => String,
    schema => String,
    object_type => Enum['FUNCTIONS','ROUTINES','SEQUENCES','TABLES','TYPES'],
  ]

Then i have created a class default_privileges

class db_profile::postgresql::server::default_privileges (
  Boolean $is_primary = $db_profile::postgresql::server::is_primary,
  Optional[Array[Db_profile::Postgresql::T_default_privileges]]
    $default_privileges      = $db_profile::postgresql::server::default_privileges,
) {
  Anchor['postgresql::server::service::end']
  -> Class['db_profile::postgresql::server::default_privileges']

  if $is_primary {
    each($default_privileges) |$default_privilege| {

      notify {"Running DDP ----> Custom ------> $default_privilege":}

      if $default_privilege['ensure'] == 'present' {
        postgresql::server::default_privileges{$default_privilege['user']:
          target_role => $default_privilege['owner'],
          ensure => 'present',
          db  => $default_privilege['db'],
          role   => $default_privilege['user'],
          privilege => $default_privilege['privilege'],
          schema => $default_privilege['schema'],
          object_type => $default_privilege['object_type'],
        }
       }else{
        postgresql::server::default_privileges{$default_privilege['user']:
          target_role => $default_privilege['owner'],
          ensure => 'absent',
          db  => $default_privilege['db'],
          role   => $default_privilege['user'],
          privilege => $default_privilege['privilege'],
          schema => $default_privilege['schema'],
          object_type => $default_privilege['object_type'],
        }
      }
    }
  }
}

Then in hiera, i have defined

db_profile::postgresql::server::default_privileges:
    - user: xyz_aoo
      ensure: present
      db: xyz
      privilege: INSERT,SELECT,UPDATE,DELETE
      owner: xyz_dml 
      schema: xyz_sch
      object_type: TABLES

The result is that it goes directly in default: { fail('Illegal value for $privilege parameter') } while testing $_privilege in /manifest/servers/default_privileges.pp

    'TABLES': {
      case $_privilege {
        /^ALL$/: { $_check_privilege = 'arwdDxt' }
        /^DELETE$/: { $_check_privilege = 'd' }
        /^INSERT$/: { $_check_privilege = 'a' }
        /^REFERENCES$/: { $_check_privilege = 'x' }
        /^SELECT$/: { $_check_privilege = 'r' }
        /^TRIGGER$/: { $_check_privilege = 'd' }
        /^TRUNCATE$/: { $_check_privilege = 'D' }
        /^UPDATE$/: { $_check_privilege = 'w' }
        default: { fail('Illegal value for $privilege parameter') }
      }

It seems that the regexp used does not match expression with comma separated values if $_privilege is build like priv1,priv2,priv3 etc.

If i change fail by notify in default then there is a problem with the unless command as it has not retrieved the correct $_check_privilege variable.
But the grant_command is correct with ALTER DEFAULT PRIVILEGES FOR ROLE xyz_dml IN SCHEMA xyz_sch GRANT INSERT,SELECT,UPDATE,DELETE ON TABLES TO "xyz_aoo"'

However, it is stated in the header
# @param privilege Specifies comma-separated list of privileges to grant. Valid options: depends on object type.

With only one privilege it is working, with several ones separated by commas, it doesnt 't work.

Am i doing something wrong ?

Thanks

Environment

Red Hat 8.7
Postgres 13

Start in manifest/servers/default_privileges.pp at the TABLES privilege validation shown in the report, then reproduce the failure with the comma-separated privilege value from the Hiera example. Check how the privilege parameter is parsed and validated, and verify that the generated ALTER DEFAULT PRIVILEGES command still contains all requested privileges.