From 126204a11ef9efc44560ba638410527ae4859eef Mon Sep 17 00:00:00 2001 From: Diego Imbert Date: Mon, 31 Aug 2026 04:15:21 +0200 Subject: [PATCH] fix(datatables): resolve pg_database_owner to the database's real owner --- backend/windmill-api-workspaces/src/datatable_acl.rs | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/backend/windmill-api-workspaces/src/datatable_acl.rs b/backend/windmill-api-workspaces/src/datatable_acl.rs index 5b15cec274..1f6f79ebff 100644 --- a/backend/windmill-api-workspaces/src/datatable_acl.rs +++ b/backend/windmill-api-workspaces/src/datatable_acl.rs @@ -508,7 +508,14 @@ async fn get_datatable_acl( let owner_row = match &target { AclTarget::Schema { schema } => client .query_opt( - "SELECT pg_get_userbyid(nspowner) FROM pg_namespace WHERE nspname = $1", + // `public` is owned by `pg_database_owner`, a placeholder role + // whose membership is whoever owns the database — naming it back + // would say nothing, so resolve it to that owner. + "SELECT pg_get_userbyid( + CASE WHEN n.nspowner = (SELECT oid FROM pg_roles WHERE rolname = 'pg_database_owner') + THEN (SELECT d.datdba FROM pg_database d WHERE d.datname = current_database()) + ELSE n.nspowner END) + FROM pg_namespace n WHERE n.nspname = $1", &[schema], ) .await