Cannot grant or revoke privileges to PUBLIC with postgres module

Description of Issue/Question

PostgreSQL has a special pseudo-role called PUBLIC, which basically means "all users". It can be used instead of a role name when granting or revoking privileges, but must not be quoted in the SQL statement.

This is particularly relevant because by default, PostgreSQL puts all tables into a schema called "public", where PUBLIC (i.e. everybody) has USAGE and CREATE permissions. You often want to revoke those.

Controlling privileges for PUBLIC is not possible using salt.modules.postgres.privileges_grant and postgres.privileges_revoke. Judging from the SQL log of a postgresprivileges_grant invocation, it tries to determine the present privileges, decides that it needs to add them and then does a GRANT TO "PUBLIC" (with quotes), which leads to ERROR: role "PUBLIC" does not exist.

The same is true for salt.states.postgres_privileges.present and postgres_privileges.absent.

Steps to Reproduce Issue

Try to run something like:

salt '<minion>' postgres.privileges_grant PUBLIC <database> database CONNECT
salt '<minion>' postgres.privileges_revoke PUBLIC <database> database CONNECT

Versions Report

• Salt 2016.11.2
• PostgreSQL 9.6.6

Start by tracing salt.modules.postgres.privileges_grant and privileges_revoke, then follow the corresponding salt.states.postgres_privileges.present and absent paths. Reproduce the reported commands against PostgreSQL and inspect the generated SQL. Done means PUBLIC can be granted and revoked as PostgreSQL’s special pseudo-role without being quoted as a normal role.