From: Alexey Kuleshevich <lehins@yandex.com>
Envelope-From: lehins@yandex.by
To: "pgsql-docs@postgresql.org" <pgsql-docs@postgresql.org>
In-Reply-To: <867731519651440@web58j.yandex.ru>
References: <867731519651440@web58j.yandex.ru>
Subject: Re: GRANT and REVOKE grammar.
MIME-Version: 1.0
Message-Id: <503671519807072@web43j.yandex.ru>
Date: Wed, 28 Feb 2018 11:37:52 +0300
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=utf-8
Precedence: bulk


Just noticed that formatting isn't rendered properly in the mailing list archive on the postgresql website. Here is the plaintext version of the original email:


Hi all.

The way it is described in the documentation for GRANT syntax (https://www.postgresql.org/docs/10/static/sql-grant.html end all prior versions) doesn't look quite right. According to the doc, something like that shouldn't be possible: GRANT SELECT(field), TRUNCATE, INSERT(abc) ON TABLE foobar TO alexey, namely mixing privileges with column name in parens (eg. INSERT(abc)) and without (eg. TRUNCATE) in the same GRANT statement, but clearly it is correct syntax.

So instead of current grammar in the doc:

GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
    [, ...] | ALL [ PRIVILEGES ] }
    ON { [ TABLE ] table_name [, ...]
         | ALL TABLES IN SCHEMA schema_name [, ...] }
    TO role_specification [, ...] [ WITH GRANT OPTION ]

GRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( column_name [, ...] )
    [, ...] | ALL [ PRIVILEGES ] ( column_name [, ...] ) }
    ON [ TABLE ] table_name [, ...]
    TO role_specification [, ...] [ WITH GRANT OPTION ]
I suggest it should be:

GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
    [, ...] | ALL [ PRIVILEGES ] }
    ON { ALL TABLES IN SCHEMA schema_name [, ...] }
    TO role_specification [, ...] [ WITH GRANT OPTION ]

GRANT { { { SELECT | INSERT | UPDATE | REFERENCES } [ ( column_name [, ...] ) ]
        | { DELETE | TRUNCATE | TRIGGER } }
    [, ...] | ALL [ PRIVILEGES ] [ ( column_name [, ...] ) ] }
    ON [ TABLE ] table_name [, ...]
    TO role_specification [, ...] [ WITH GRANT OPTION ]
Does it make sense, or am I tripping?

Alternatively it could be:

GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
    [, ...] | ALL [ PRIVILEGES ] }
    ON { [ TABLE ] table_name [, ...]
         | ALL TABLES IN SCHEMA schema_name [, ...] }
    TO role_specification [, ...] [ WITH GRANT OPTION ]

GRANT { { SELECT | INSERT | UPDATE | REFERENCES } [ ( column_name [, ...] ) ]
    [, ...] | ALL [ PRIVILEGES ] [ ( column_name [, ...] ) ] }
    ON [ TABLE ] table_name [, ...]
    TO role_specification [, ...] [ WITH GRANT OPTION ]
Note the [] around [ ( column_name [, ...] ) ], but the former is a bit clearer, I think.

Identical issue and solution applies to REVOKE syntax: https://www.postgresql.org/docs/10/static/sql-revoke.html

Forgive me if I am wrong, not a daily PostgreSQL user.


Thank you.

Alexey.