Merge branch 'develop' into sam/postgis-tiger-fix

ansible/files/postgresql_extension_custom_scripts/pgsodium/after-create.sql

@@ -1,3 +1,26 @@
 grant execute on function pgsodium.crypto_aead_det_decrypt(bytea, bytea, uuid, bytea) to service_role;
 grant execute on function pgsodium.crypto_aead_det_encrypt(bytea, bytea, uuid, bytea) to service_role;
 grant execute on function pgsodium.crypto_aead_det_keygen to service_role;
+
+CREATE OR REPLACE FUNCTION pgsodium.mask_role(masked_role regrole, source_name text, view_name text)
+RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $function$
+BEGIN
+  EXECUTE format(
+    'GRANT SELECT ON pgsodium.key TO %s',
+    masked_role);
+
+  EXECUTE format(
+    'GRANT pgsodium_keyiduser, pgsodium_keyholder TO %s',
+    masked_role);
+
+  EXECUTE format(
+    'GRANT ALL ON %I TO %s',
+    view_name,
+    masked_role);
+  RETURN;
+END
+$function$;

ansible/files/postgresql_extension_custom_scripts/pgsodium/before-create.sql

@@ -0,0 +1,9 @@
+do $$
+declare
+  _extversion text := @extversion@;
+  _r record;
+begin
+  if _extversion is not null and _extversion != '3.1.8' then
+    raise exception 'only pgsodium 3.1.8 is supported';
+  end if;
+end $$;