Security

All write-path functions and the sync_mv() procedure are SECURITY DEFINER. This allows pg_relay (connecting as a dedicated role) to execute REFRESH MATERIALIZED VIEW against views owned by any schema owner without requiring superuser privileges on the relay role.

Read-only functions (status(), get_mv(), list_mv(), refresh_frequency(), resolve_base_tables()) are not SECURITY DEFINER.

refresh_materialised_view_now() access control:

Although SECURITY DEFINER, EXECUTE on refresh_materialised_view_now(text, text) is revoked from PUBLIC at install time. This prevents any connected role from triggering ad-hoc refreshes without explicit authorisation. The owning organisation grants this function to specific roles:

GRANT EXECUTE ON FUNCTION pgauto_mv.refresh_materialised_view_now(text, text) TO your_app_role;
GRANT EXECUTE ON FUNCTION pgauto_mv.refresh_materialised_view_now(text, text) TO your_etl_role;

All other public API functions (register_mv, unregister_mv, update_mv, chain_mv, unchain_mv) retain the default EXECUTE granted to PUBLIC — access to those is controlled by the database's role hierarchy in the normal way.

---