Repository: ansible-collections/community.general

Issue:
postgresql_privs commits when nothing changed
<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Explain the problem briefly below -->
I understand that postgresql_privs checks whether something changed by always executing REVOKE ALL followed by the requested GRANT/REVOKE ALTER statements and then comparing the result sets of selects against some postgres `pg_*` catalog tables before and after.

AFAICS, (if not in check mode) it unconditionally commits the transaction then, even if it detected that nothing has changed (and thus the `changed` module return value is set to `False`).

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
postgresql_privs

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below
ansible 2.9.11
  config file = /home/gms/program/linode/ansible.cfg
  configured module search path = ['/home/juser/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.7.8 (default, Jul  1 2020, 15:39:07) [GCC 9.3.1 20200408 (Red Hat 9.3.1-2)]
```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below

```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->

Fedora 31, ansible-2.9.11-1.fc31.noarch

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->

Execute some task that adds privileges two times, such that the second time the task is green (i.e. it reports nothing changed).

For example:

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: check privs
  postgresql_privs:
      db: fubardb
      schema: public
      type: default_privs
      objs: TABLES
      privs: SELECT
      target_roles: import_user
      role: frontend_user
  become: yes
  become_user: postgres
```

<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->

Transaction is rolled back.

##### ACTUAL RESULTS
<!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->

Transaction is committed.

<!--- Paste verbatim command output between quotes -->
```paste below

```

This is the single location where commit is conditionally invoked:

https://github.com/ansible-collections/community.general/blob/2b0879cdc4db1fba684acfe1f6d447285b8e979b/plugins/modules/database/postgresql/postgresql_privs.py#L1105-L1109

Basically I'm proposing to change that to something like this:

```python
    if module.check_mode or changed == False:
        conn.rollback()
    else:
        conn.commit()
    module.exit_json(changed=changed, queries=executed_queries)
```
postgresql_privs commits when nothing changed
<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Explain the problem briefly below -->
I understand that postgresql_privs checks whether something changed by always executing REVOKE ALL followed by the requested GRANT/REVOKE ALTER statements and then comparing the result sets of selects against some postgres `pg_*` catalog tables before and after.

AFAICS, (if not in check mode) it unconditionally commits the transaction then, even if it detected that nothing has changed (and thus the `changed` module return value is set to `False`).

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
postgresql_privs

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below
ansible 2.9.11
  config file = /home/gms/program/linode/ansible.cfg
  configured module search path = ['/home/juser/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.7.8 (default, Jul  1 2020, 15:39:07) [GCC 9.3.1 20200408 (Red Hat 9.3.1-2)]
```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below

```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->

Fedora 31, ansible-2.9.11-1.fc31.noarch

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->

Execute some task that adds privileges two times, such that the second time the task is green (i.e. it reports nothing changed).

For example:

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: check privs
  postgresql_privs:
      db: fubardb
      schema: public
      type: default_privs
      objs: TABLES
      privs: SELECT
      target_roles: import_user
      role: frontend_user
  become: yes
  become_user: postgres
```

<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->

Transaction is rolled back.

##### ACTUAL RESULTS
<!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->

Transaction is committed.

<!--- Paste verbatim command output between quotes -->
```paste below

```

This is the single location where commit is conditionally invoked:

https://github.com/ansible-collections/community.general/blob/2b0879cdc4db1fba684acfe1f6d447285b8e979b/plugins/modules/database/postgresql/postgresql_privs.py#L1105-L1109

Basically I'm proposing to change that to something like this:

```python
    if module.check_mode or changed == False:
        conn.rollback()
    else:
        conn.commit()
    module.exit_json(changed=changed, queries=executed_queries)
```


Discussion:
Files identified in the description:
* [`plugins/modules/database/postgresql/postgresql_privs.py`](https://github.com/ansible-collections/community.general/blob/master/plugins/modules/database/postgresql/postgresql_privs.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @Andersson007 @Dorn- @amenonsen @andytom @b6d @jbscalia @kostiantyn-nemchenko @matburt @nerzhul @sebasmannem @tcraxs
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
@gsauthof hi, thanks for reporting this! We could try, would you like to do it yourself?
Files identified in the description:
* [`plugins/modules/database/postgresql/postgresql_privs.py`](https://github.com/ansible-collections/community.general/blob/master/plugins/modules/database/postgresql/postgresql_privs.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @Andersson007 @Dorn- @amenonsen @andytom @b6d @jbscalia @kostiantyn-nemchenko @matburt @nerzhul @sebasmannem @tcraxs
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
@gsauthof hi, thanks for reporting this! We could try, would you like to do it yourself?

Resolving patch:
diff --git a/plugins/modules/database/postgresql/postgresql_privs.py b/plugins/modules/database/postgresql/postgresql_privs.py
--- a/plugins/modules/database/postgresql/postgresql_privs.py
+++ b/plugins/modules/database/postgresql/postgresql_privs.py
@@ -1098,7 +1098,7 @@ def main():
         conn.rollback()
         module.fail_json(msg=to_native(e.message))
 
-    if module.check_mode:
+    if module.check_mode or not changed:
         conn.rollback()
     else:
         conn.commit()


Test patch: