Add SET search_path to all SECURITY DEFINER functions

Add SET search_path = sql_saga, pg_catalog, public to all 25 SECURITY
DEFINER functions that lacked it. This prevents schema-spoofing attacks
where a caller's search_path could cause unqualified references to
resolve to attacker-controlled schemas.

Add regression test 009_security_definer_search_path that queries
pg_proc.proconfig to verify every SECURITY DEFINER function in the
sql_saga schema has a search_path setting. This guards against future
regressions when new functions are added.

Expected output changes are from PostgreSQL showing unqualified function
names in CONTEXT lines when search_path is set on the function.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jhf

expected/003_api_symmetry.out

@@ -279,7 +279,7 @@ SELECT sql_saga.drop_era('era_symmetry_test'::regclass, cleanup => true);
 SAVEPOINT before_fail;
 SELECT sql_saga.add_era('era_symmetry_test'::regclass, 'v');
 ERROR:  range column "v" not found in table "era_symmetry_test"
-CONTEXT:  PL/pgSQL function sql_saga.add_era(regclass,name,name,boolean,name,name,name,boolean,boolean,boolean,regtype,name,name[]) line 167 at RAISE
+CONTEXT:  PL/pgSQL function add_era(regclass,name,name,boolean,name,name,name,boolean,boolean,boolean,regtype,name,name[]) line 167 at RAISE
 ROLLBACK TO SAVEPOINT before_fail;
 -- 4. Create columns manually, then add era
 ALTER TABLE era_symmetry_test ADD COLUMN v tstzrange;

expected/007_era_validation.out

@@ -41,7 +41,7 @@ SELECT sql_saga.add_era(
     range_column_name => 'invalid_range_col'
 );
 ERROR:  column "invalid_range_col" is of type date which is not a range type
-CONTEXT:  PL/pgSQL function sql_saga.add_era(regclass,name,name,boolean,name,name,name,boolean,boolean,boolean,regtype,name,name[]) line 175 at RAISE
+CONTEXT:  PL/pgSQL function add_era(regclass,name,name,boolean,name,name,name,boolean,boolean,boolean,regtype,name,name[]) line 175 at RAISE
 ROLLBACK;
 \i sql/include/test_teardown.sql
 --

expected/009_security_definer_search_path.out

@@ -0,0 +1,73 @@
+\i sql/include/test_setup.sql
+--
+-- test_setup.sql
+--
+-- Common setup for regression tests that need to be self-contained.
+-- This script creates the extension, a user role, and grants permissions.
+--
+SET datestyle = 'ISO, YMD';
+CREATE EXTENSION IF NOT EXISTS btree_gist;
+CREATE EXTENSION IF NOT EXISTS sql_saga CASCADE;
+DO $$
+BEGIN
+    CREATE ROLE sql_saga_unprivileged_user;
+EXCEPTION WHEN duplicate_object THEN
+END
+$$;
+GRANT USAGE ON SCHEMA sql_saga TO sql_saga_unprivileged_user;
+GRANT SELECT ON ALL TABLES IN SCHEMA sql_saga TO sql_saga_unprivileged_user;
+GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA sql_saga TO sql_saga_unprivileged_user;
+/*
+ * Allow the unprivileged user to create tables in the public schema.
+ * This is required for tests that create their own tables.
+ * PG 15+ restricts this by default.
+ */
+GRANT CREATE ON SCHEMA public TO PUBLIC;
+BEGIN;
+-- =============================================================================
+-- Test: Every SECURITY DEFINER function must have SET search_path
+-- =============================================================================
+-- This test guards against regressions where a new SECURITY DEFINER function
+-- is added without a safe search_path. Without SET search_path, a SECURITY
+-- DEFINER function executes with the caller's search_path, which could allow
+-- schema-spoofing attacks.
+\echo '--- Verify all SECURITY DEFINER functions have search_path ---'
+--- Verify all SECURITY DEFINER functions have search_path ---
+-- This query finds SECURITY DEFINER functions in the sql_saga schema that
+-- do NOT have a search_path in their proconfig (SET options).
+SELECT p.proname AS missing_search_path
+FROM pg_catalog.pg_proc AS p
+JOIN pg_catalog.pg_namespace AS n ON n.oid = p.pronamespace
+WHERE n.nspname = 'sql_saga'
+  AND p.prosecdef = true
+  AND (
+    p.proconfig IS NULL
+    OR NOT EXISTS (
+      SELECT FROM unnest(p.proconfig) AS c(setting)
+      WHERE c.setting LIKE 'search_path=%'
+    )
+  )
+ORDER BY p.proname;
+ missing_search_path 
+---------------------
+(0 rows)
+
+ROLLBACK;
+\i sql/include/test_teardown.sql
+--
+-- test_teardown.sql
+--
+-- Common teardown for regression tests. This script drops the unprivileged
+-- user role created by test_setup.sql.
+--
+-- It is important to reset the role first, in case a test fails and
+-- leaves the session role set to the user that is about to be dropped.
+RESET ROLE;
+-- Drop the extensions to ensure a clean state for the next test.
+-- Use CASCADE to remove any dependent objects created by sql_saga.
+DROP EXTENSION IF EXISTS sql_saga CASCADE;
+DROP EXTENSION IF EXISTS btree_gist CASCADE;
+-- Revoke any privileges held by the test user and drop any objects they own.
+-- This is necessary before the role can be dropped.
+DROP OWNED BY sql_saga_unprivileged_user;
+DROP ROLE IF EXISTS sql_saga_unprivileged_user;

expected/010_unique_key.out

@@ -243,7 +243,7 @@ SAVEPOINT expect_error;
 Attempting to add a temporal primary key to a table with a simple primary key (should fail)
 SELECT sql_saga.add_unique_key('public.simple_pk', '{id}', key_type => 'primary');
 ERROR:  table "simple_pk" has a simple PRIMARY KEY that does not include the temporal range column ("valid_range"); this is incompatible with SCD Type 2 history
-CONTEXT:  PL/pgSQL function sql_saga.add_unique_key(regclass,name[],name,sql_saga.unique_key_type,boolean,name,name,name,text,name[]) line 159 at RAISE
+CONTEXT:  PL/pgSQL function add_unique_key(regclass,name[],name,unique_key_type,boolean,name,name,name,text,name[]) line 159 at RAISE
 ROLLBACK TO SAVEPOINT expect_error;
 DROP TABLE public.simple_pk;
 \echo '--- Test: add_unique_key validation for GENERATED ALWAYS identity column ---'
@@ -271,7 +271,7 @@ SAVEPOINT expect_error_2;
 Attempting to add a temporal primary key to a table with a GENERATED ALWAYS identity (should fail)
 SELECT sql_saga.add_unique_key('public.generated_always', '{id}', key_type => 'primary');
 ERROR:  table "generated_always" has a GENERATED ALWAYS AS IDENTITY column ("id"); this is incompatible with SCD Type 2 history as it prevents inserting new historical versions of an entity
-CONTEXT:  PL/pgSQL function sql_saga.add_unique_key(regclass,name[],name,sql_saga.unique_key_type,boolean,name,name,name,text,name[]) line 140 at RAISE
+CONTEXT:  PL/pgSQL function add_unique_key(regclass,name[],name,unique_key_type,boolean,name,name,name,text,name[]) line 140 at RAISE
 ROLLBACK TO SAVEPOINT expect_error_2;
 DROP TABLE public.generated_always;
 ROLLBACK;

expected/011_unique_key_search_path_bug.out

@@ -103,15 +103,15 @@ CREATE TABLE saga_bug_test.establishment (
     PRIMARY KEY (id, valid_range)
 );
 SELECT sql_saga.add_era('saga_bug_test.establishment', 'valid_range');
-NOTICE:  sql_saga: Created trigger "establishment_synchronize_temporal_columns_trigger" on table establishment to synchronize columns: valid_from, valid_until
+NOTICE:  sql_saga: Created trigger "establishment_synchronize_temporal_columns_trigger" on table saga_bug_test.establishment to synchronize columns: valid_from, valid_until
 NOTICE:  sql_saga: Created GIST index "establishment_valid_range_gist_idx" on column saga_bug_test.establishment.valid_range for temporal_merge performance
  add_era 
 ---------
  t
 (1 row)
 
 SELECT sql_saga.add_unique_key('saga_bug_test.establishment', ARRAY['id'], key_type => 'natural');
-NOTICE:  sql_saga: Added constraints to table establishment: ADD CONSTRAINT establishment_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
+NOTICE:  sql_saga: Added constraints to table saga_bug_test.establishment: ADD CONSTRAINT establishment_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
      add_unique_key     
 ------------------------
  establishment_id_valid
@@ -129,7 +129,7 @@ SELECT sql_saga.add_temporal_foreign_key(
     'valid',
     'correct_table_uk' -- This UK is on saga_bug_test.legal_unit
 );
-NOTICE:  sql_saga: No compatible index found for foreign key on table establishment. Creating new index: CREATE INDEX establishment_legal_unit_id_valid_gist_idx ON establishment USING GIST (legal_unit_id, valid_range)
+NOTICE:  sql_saga: No compatible index found for foreign key on table saga_bug_test.establishment. Creating new index: CREATE INDEX establishment_legal_unit_id_valid_gist_idx ON saga_bug_test.establishment USING GIST (legal_unit_id, valid_range)
      add_temporal_foreign_key      
 -----------------------------------
  establishment_legal_unit_id_valid

expected/013_unique_key_predicate.out

@@ -168,7 +168,7 @@ SELECT sql_saga.add_unique_key(
 ERROR:  could not create exclusion constraint "contractors_name_valid_excl"
 DETAIL:  Key (name, valid_range)=(David, [2020-01-01,2022-01-01)) conflicts with key (name, valid_range)=(David, [2021-01-01,2023-01-01)).
 CONTEXT:  SQL statement "ALTER TABLE public.contractors ADD CONSTRAINT contractors_name_valid_excl EXCLUDE USING gist (name WITH =, valid_range WITH &&) WHERE (agency_id IS NOT NULL) DEFERRABLE"
-PL/pgSQL function sql_saga.add_unique_key(regclass,name[],name,sql_saga.unique_key_type,boolean,name,name,name,text,name[]) line 459 at EXECUTE
+PL/pgSQL function add_unique_key(regclass,name[],name,unique_key_type,boolean,name,name,name,text,name[]) line 459 at EXECUTE
 -- Correct the data by deleting one of the conflicting records.
 DELETE FROM contractors WHERE id = 102;
 -- Try adding the unique key again. This should now succeed.

expected/016_unique_key_pk_consistency.out

@@ -365,7 +365,7 @@ SAVEPOINT expect_error;
 SELECT sql_saga.add_unique_key('pk_consistency.composite_pk_b', ARRAY['org_id', 'unit_id'], key_type => 'primary'); -- fails
 NOTICE:  sql_saga: Added constraints to table pk_consistency.composite_pk_b: ALTER COLUMN org_id SET NOT NULL; ALTER COLUMN unit_id SET NOT NULL; ADD PRIMARY KEY (org_id, unit_id, valid_range WITHOUT OVERLAPS)
 ERROR:  cannot add primary key (org_id, unit_id) to table "pk_consistency.composite_pk_b" because its stable part (org_id, unit_id) is composite, which is not supported for consistency enforcement required by existing natural keys
-CONTEXT:  PL/pgSQL function sql_saga.add_unique_key(regclass,name[],name,sql_saga.unique_key_type,boolean,name,name,name,text,name[]) line 545 at RAISE
+CONTEXT:  PL/pgSQL function add_unique_key(regclass,name[],name,unique_key_type,boolean,name,name,name,text,name[]) line 545 at RAISE
 ROLLBACK TO SAVEPOINT expect_error;
 ROLLBACK TO SAVEPOINT s4b;
 -- Scenario 5: API Symmetry (Drop Key)

expected/021_system_versioning_excluded_columns.out

@@ -98,11 +98,11 @@ SELECT id, value, null_value, flap FROM excl_history ORDER BY system_valid_range
 -- Test that excluding a non-existent column fails.
 SELECT sql_saga.set_system_time_era_excluded_columns('excl', '{nonexistent}');
 ERROR:  column "nonexistent" does not exist in table excl
-CONTEXT:  PL/pgSQL function sql_saga.set_system_time_era_excluded_columns(regclass,name[]) line 24 at RAISE
+CONTEXT:  PL/pgSQL function set_system_time_era_excluded_columns(regclass,name[]) line 24 at RAISE
 -- Test that excluding a system column fails.
 SELECT sql_saga.set_system_time_era_excluded_columns('excl', '{xmin}');
 ERROR:  cannot exclude system column "xmin"
-CONTEXT:  PL/pgSQL function sql_saga.set_system_time_era_excluded_columns(regclass,name[]) line 34 at RAISE
+CONTEXT:  PL/pgSQL function set_system_time_era_excluded_columns(regclass,name[]) line 34 at RAISE
 \i sql/include/test_teardown.sql
 --
 -- test_teardown.sql

expected/040_fk_temporal_to_temporal.out

@@ -385,7 +385,7 @@ CONTEXT:  SQL statement "
         MATCH SIMPLE ON UPDATE NO ACTION ON DELETE NO ACTION
         DEFERRABLE
         "
-PL/pgSQL function sql_saga.add_temporal_foreign_key(regclass,name[],name,name,sql_saga.fk_match_types,sql_saga.fk_actions,sql_saga.fk_actions,name,name,name,boolean) line 111 at EXECUTE
+PL/pgSQL function add_temporal_foreign_key(regclass,name[],name,name,fk_match_types,fk_actions,fk_actions,name,name,name,boolean) line 111 at EXECUTE
 ROLLBACK TO SAVEPOINT s;
 -- it fails on a table with a completely-uncovered foreign key
 SAVEPOINT s;
@@ -455,7 +455,7 @@ CONTEXT:  SQL statement "
         MATCH SIMPLE ON UPDATE NO ACTION ON DELETE NO ACTION
         DEFERRABLE
         "
-PL/pgSQL function sql_saga.add_temporal_foreign_key(regclass,name[],name,name,sql_saga.fk_match_types,sql_saga.fk_actions,sql_saga.fk_actions,name,name,name,boolean) line 111 at EXECUTE
+PL/pgSQL function add_temporal_foreign_key(regclass,name[],name,name,fk_match_types,fk_actions,fk_actions,name,name,name,boolean) line 111 at EXECUTE
 ROLLBACK TO SAVEPOINT s;
 -- it fails on a table with a partially-covered foreign key
 SAVEPOINT s;
@@ -525,7 +525,7 @@ CONTEXT:  SQL statement "
         MATCH SIMPLE ON UPDATE NO ACTION ON DELETE NO ACTION
         DEFERRABLE
         "
-PL/pgSQL function sql_saga.add_temporal_foreign_key(regclass,name[],name,name,sql_saga.fk_match_types,sql_saga.fk_actions,sql_saga.fk_actions,name,name,name,boolean) line 111 at EXECUTE
+PL/pgSQL function add_temporal_foreign_key(regclass,name[],name,name,fk_match_types,fk_actions,fk_actions,name,name,name,boolean) line 111 at EXECUTE
 ROLLBACK TO SAVEPOINT s;
 ROLLBACK;
 \i sql/include/test_teardown.sql

expected/047_fk_index_management.out

@@ -41,7 +41,7 @@ NOTICE:  sql_saga: Created GIST index "parent_t_valid_range_gist_idx" on column
 (1 row)
 
 SELECT add_unique_key('parent_t'::regclass, ARRAY['id'], unique_key_name => 'parent_t_id_valid');
-NOTICE:  sql_saga: Added constraints to table parent_t: ADD CONSTRAINT parent_t_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
+NOTICE:  sql_saga: Added constraints to table fk_idx.parent_t: ADD CONSTRAINT parent_t_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
   add_unique_key   
 -------------------
  parent_t_id_valid
@@ -60,7 +60,7 @@ SELECT add_foreign_key(
     pk_table_oid => 'parent_t'::regclass, pk_column_names => ARRAY['id'],
     foreign_key_name => 'child_parent_fk_1'
 );
-NOTICE:  sql_saga: No compatible index found for foreign key on table child_t. Creating new index: CREATE INDEX child_t_parent_id_valid_gist_idx ON child_t USING GIST (parent_id, valid_range)
+NOTICE:  sql_saga: No compatible index found for foreign key on table fk_idx.child_t. Creating new index: CREATE INDEX child_t_parent_id_valid_gist_idx ON fk_idx.child_t USING GIST (parent_id, valid_range)
   add_foreign_key  
 -------------------
  child_parent_fk_1
@@ -120,7 +120,7 @@ NOTICE:  sql_saga: Created GIST index "parent_t_valid_range_gist_idx" on column
 (1 row)
 
 SELECT add_unique_key('parent_t'::regclass, ARRAY['id'], unique_key_name => 'parent_t_id_valid');
-NOTICE:  sql_saga: Added constraints to table parent_t: ADD CONSTRAINT parent_t_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
+NOTICE:  sql_saga: Added constraints to table fk_idx.parent_t: ADD CONSTRAINT parent_t_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
   add_unique_key   
 -------------------
  parent_t_id_valid
@@ -139,8 +139,8 @@ SELECT add_foreign_key(
     pk_table_oid => 'parent_t'::regclass, pk_column_names => ARRAY['id'],
     foreign_key_name => 'child_parent_fk_2', create_index => false
 );
-WARNING:  No index found on table child_t for foreign key columns ({parent_id}). Performance may be poor.
-HINT:  Consider creating this index: CREATE INDEX child_t_parent_id_valid_gist_idx ON child_t USING GIST (parent_id, valid_range)
+WARNING:  No index found on table fk_idx.child_t for foreign key columns ({parent_id}). Performance may be poor.
+HINT:  Consider creating this index: CREATE INDEX child_t_parent_id_valid_gist_idx ON fk_idx.child_t USING GIST (parent_id, valid_range)
   add_foreign_key  
 -------------------
  child_parent_fk_2
@@ -184,7 +184,7 @@ NOTICE:  sql_saga: Created GIST index "parent_t_valid_range_gist_idx" on column
 (1 row)
 
 SELECT add_unique_key('parent_t'::regclass, ARRAY['id'], unique_key_name => 'parent_t_id_valid');
-NOTICE:  sql_saga: Added constraints to table parent_t: ADD CONSTRAINT parent_t_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
+NOTICE:  sql_saga: Added constraints to table fk_idx.parent_t: ADD CONSTRAINT parent_t_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
   add_unique_key   
 -------------------
  parent_t_id_valid
@@ -248,7 +248,7 @@ NOTICE:  sql_saga: Created GIST index "parent_t_valid_range_gist_idx" on column
 (1 row)
 
 SELECT add_unique_key('parent_t'::regclass, ARRAY['id'], unique_key_name => 'parent_t_id_valid');
-NOTICE:  sql_saga: Added constraints to table parent_t: ADD CONSTRAINT parent_t_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
+NOTICE:  sql_saga: Added constraints to table fk_idx.parent_t: ADD CONSTRAINT parent_t_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
   add_unique_key   
 -------------------
  parent_t_id_valid
@@ -267,7 +267,7 @@ SELECT add_foreign_key(
     pk_table_oid => 'parent_t'::regclass, pk_column_names => ARRAY['id'],
     foreign_key_name => 'child_parent_fk_4'
 );
-NOTICE:  sql_saga: No compatible index found for foreign key on table child_t. Creating new index: CREATE INDEX child_t_parent_id_valid_gist_idx ON child_t USING GIST (parent_id, valid_range)
+NOTICE:  sql_saga: No compatible index found for foreign key on table fk_idx.child_t. Creating new index: CREATE INDEX child_t_parent_id_valid_gist_idx ON fk_idx.child_t USING GIST (parent_id, valid_range)
   add_foreign_key  
 -------------------
  child_parent_fk_4
@@ -326,7 +326,7 @@ NOTICE:  sql_saga: Created GIST index "parent_r_valid_range_gist_idx" on column
 (1 row)
 
 SELECT add_unique_key('parent_r'::regclass, ARRAY['id'], unique_key_name => 'parent_r_id_valid');
-NOTICE:  sql_saga: Added constraints to table parent_r: ADD CONSTRAINT parent_r_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
+NOTICE:  sql_saga: Added constraints to table fk_idx.parent_r: ADD CONSTRAINT parent_r_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
   add_unique_key   
 -------------------
  parent_r_id_valid
@@ -338,7 +338,7 @@ SELECT add_foreign_key(
     pk_table_oid => 'parent_r'::regclass, pk_column_names => ARRAY['id'],
     foreign_key_name => 'child_parent_r_fk_1'
 );
-NOTICE:  sql_saga: No compatible index found for foreign key on table child_r. Creating new index: CREATE INDEX child_r_parent_id_idx ON child_r USING BTREE (parent_id)
+NOTICE:  sql_saga: No compatible index found for foreign key on table fk_idx.child_r. Creating new index: CREATE INDEX child_r_parent_id_idx ON fk_idx.child_r USING BTREE (parent_id)
    add_foreign_key   
 ---------------------
  child_parent_r_fk_1
@@ -389,7 +389,7 @@ NOTICE:  sql_saga: Created GIST index "parent_r_valid_range_gist_idx" on column
 (1 row)
 
 SELECT add_unique_key('parent_r'::regclass, ARRAY['id'], unique_key_name => 'parent_r_id_valid');
-NOTICE:  sql_saga: Added constraints to table parent_r: ADD CONSTRAINT parent_r_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
+NOTICE:  sql_saga: Added constraints to table fk_idx.parent_r: ADD CONSTRAINT parent_r_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
   add_unique_key   
 -------------------
  parent_r_id_valid
@@ -401,8 +401,8 @@ SELECT add_foreign_key(
     pk_table_oid => 'parent_r'::regclass, pk_column_names => ARRAY['id'],
     foreign_key_name => 'child_parent_r_fk_2', create_index => false
 );
-WARNING:  No index found on table child_r for foreign key columns ({parent_id}). Performance may be poor.
-HINT:  Consider creating this index: CREATE INDEX child_r_parent_id_idx ON child_r USING BTREE (parent_id)
+WARNING:  No index found on table fk_idx.child_r for foreign key columns ({parent_id}). Performance may be poor.
+HINT:  Consider creating this index: CREATE INDEX child_r_parent_id_idx ON fk_idx.child_r USING BTREE (parent_id)
    add_foreign_key   
 ---------------------
  child_parent_r_fk_2
@@ -441,7 +441,7 @@ NOTICE:  sql_saga: Created GIST index "parent_r_valid_range_gist_idx" on column
 (1 row)
 
 SELECT add_unique_key('parent_r'::regclass, ARRAY['id'], unique_key_name => 'parent_r_id_valid');
-NOTICE:  sql_saga: Added constraints to table parent_r: ADD CONSTRAINT parent_r_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
+NOTICE:  sql_saga: Added constraints to table fk_idx.parent_r: ADD CONSTRAINT parent_r_id_valid_uniq UNIQUE (id, valid_range WITHOUT OVERLAPS)
   add_unique_key   
 -------------------
  parent_r_id_valid