Re: [PoC] Federated Authn/z with OAUTHBEARER

Hi,

On 2025-04-04 17:27:46 -0700, Jacob Champion wrote:
> += Load-Time ABI =
> +
> +This module ABI is an internal implementation detail, so it's subject to change
> +without warning, even during minor releases (however unlikely). The compiled
> +version of libpq-oauth should always match the compiled version of libpq.

Shouldn't we then include the *minor* version in the soname? I think otherwise
we run into the danger of the wrong library version being loaded in some
cases. Imagine a program being told with libpq to use via rpath. But then we
load the oauth module via a dlopen without a specified path - it'll just
search the global library locations.

Which actually makes me wonder if we ought to instead load the library from a
specific location...

> +TODO
> diff --git a/src/interfaces/libpq-oauth/exports.txt b/src/interfaces/libpq-oauth/exports.txt
> new file mode 100644
> index 00000000000..3787b388e04
> --- /dev/null
> +++ b/src/interfaces/libpq-oauth/exports.txt
> @@ -0,0 +1,4 @@
> +# src/interfaces/libpq-oauth/exports.txt
> +pg_fe_run_oauth_flow 1
> +pg_fe_cleanup_oauth_flow 2
> +pg_g_threadlock 3

The pg_g_threadlock thing seems pretty ugly. Can't we just pass that to the
relevant functions? But more fundamentally, are we actually using
pg_g_threadlock anywhere? I removed all the releant code and the tests still
seem to pass?

> diff --git a/src/interfaces/libpq-oauth/meson.build b/src/interfaces/libpq-oauth/meson.build
> new file mode 100644
> index 00000000000..1834afbf7a5
> --- /dev/null
> +++ b/src/interfaces/libpq-oauth/meson.build
> @@ -0,0 +1,32 @@
> +# Copyright (c) 2022-2025, PostgreSQL Global Development Group
> +
> +if not libcurl.found() or host_system == 'windows'
> + subdir_done()
> +endif

Why does this not work on windows? I don't see similar code in the removed
lines?

Greetings,

Andres Freund