Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1UpbRp-0007vI-47 for pgsql-admin@arkaria.postgresql.org; Thu, 20 Jun 2013 09:46:33 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1UpbRo-0002tw-KJ for pgsql-admin@arkaria.postgresql.org; Thu, 20 Jun 2013 09:46:32 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1UpbRn-0002tq-Kq for pgsql-admin@postgresql.org; Thu, 20 Jun 2013 09:46:31 +0000 Received: from adsltrust.ath.forthnet.gr ([194.219.204.174] helo=smadev.internal.net) by magus.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1UpbRf-0002Go-1e for pgsql-admin@postgresql.org; Thu, 20 Jun 2013 09:46:29 +0000 Received: from smadev.internal.net (smadev [10.9.200.131]) by smadev.internal.net (8.14.5/8.14.5) with ESMTP id r5K9kLdF018676 for ; Thu, 20 Jun 2013 12:46:21 +0300 (EEST) (envelope-from achill@matrix.gatewaynet.com) Message-ID: <51C2CF6D.8070704@matrix.gatewaynet.com> Date: Thu, 20 Jun 2013 12:46:21 +0300 From: Achilleas Mantzios User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:17.0) Gecko/20130601 Thunderbird/17.0.6 MIME-Version: 1.0 To: pgsql-admin@postgresql.org Subject: Re: Why sequence grant is separated from table? References: <51C17B74.4070109@gmail.com> In-Reply-To: Content-Type: multipart/alternative; boundary="------------060708010400050503000402" X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org This is a multi-part message in MIME format. --------------060708010400050503000402 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 19/06/2013 12:47, Szymon Guz wrote: > On 19 June 2013 11:35, Rural Hunter > wrote: > > I really hate the error "permission denied for sequence xxxxx" > when I grant on a table but forget to grant additionally on the > related sequence to users. Can the permission of table and related > sequences be merged? > > > I can imagine a situation where you want a user to be granted rights > on a table, to use sequence with curval and nextval functions, but not > setval, as it can provide some database problems. > > What's more, in general, you cannot say which sequence is used for > which table, if the sequence is not owned by the table. Right, there might be cases, when one sequence is used by more than one table. Like for instance when the user wishes to create a view on a union of two tables, with their IDs included, and still those IDs to be guaranteed to be unique across the union. However, after I dumped a table recently whose sequence is shared by another table as wee i noticed this : ALTER SEQUENCE vessels_id_seq OWNED BY vessels.id; Which means that the initial relationship between the "creating" table and the sequence is preserved for the whole life of the table. This could tempt new users to think that it could be meaningful to bind those two in the GRANT. > > Which permissions of a table do you want to merge with which > permissions of sequences? > > regards > Szymon -- Achilleas Mantzios --------------060708010400050503000402 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
On 19/06/2013 12:47, Szymon Guz wrote:
On 19 June 2013 11:35, Rural Hunter <ruralhunter@gmail.com> wrote:
I really hate the error "permission denied for sequence xxxxx" when I grant on a table but forget to grant additionally on the related sequence to users. Can the permission of table and related sequences be merged?


I can imagine a situation where you want a user to be granted rights on a table, to use sequence with curval and nextval functions, but not setval, as it can provide some database problems.

What's more, in general, you cannot say which sequence is used for which table, if the sequence is not owned by the table.

Right, there might be cases, when one sequence is used by more than one table. Like for instance when the user wishes to create a view on a union of two tables, with their IDs included, and still those IDs to be guaranteed to be unique across the union.
However, after I dumped a table recently whose sequence is shared by another table as wee i noticed this :

ALTER SEQUENCE vessels_id_seq OWNED BY vessels.id;

Which means that the initial relationship between the "creating" table and the sequence is preserved for the whole life of the table. This could tempt new users to think that it could be meaningful to bind those two in the GRANT.


Which permissions of a table do you want to merge with which permissions of sequences?

regards
Szymon


-- 
Achilleas Mantzios
--------------060708010400050503000402--