Date: Mon, 6 Nov 2023 10:55:55 -0500
From: Bruce Momjian <bruce@momjian.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Michael Banck <mbanck@gmx.net>, David Burns <david.burns@fedex.com>,
	pgsql-hackers@lists.postgresql.org
Subject: Re: Version 14/15 documentation Section "Alter Default Privileges"
Message-ID: <ZUkMi9UhnfHyIQMf@momjian.us>
References: <a6671d5651e64fceff340c68dbdc41a9c5098748.camel@cybertec.at>
 <653b841d.a70a0220.17f72.2c12@mx.google.com>
 <7de5f33f49a91d7b30b8c01fe46fc280713ebae1.camel@cybertec.at>
 <653cce08.050a0220.a10fb.7878@mx.google.com>
 <ZUUlmpxzsZMSZ7N_@momjian.us>
 <b227432f87266b680fd6f31e37b202b2fae5d9b6.camel@cybertec.at>
 <ZUaLgyKdfWeh6nlj@momjian.us>
 <244e0f9e3300f165ff578302e942fa3145dedfc7.camel@cybertec.at>
 <ZUbsWcPypVORlYCg@momjian.us>
 <ceac8e2df89a5eb1335ad8ce39c6ba0beaeddde3.camel@cybertec.at>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="pZBDanP6HC8LB2Jz"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <ceac8e2df89a5eb1335ad8ce39c6ba0beaeddde3.camel@cybertec.at>
Archived-At: 
 <https://www.postgresql.org/message-id/ZUkMi9UhnfHyIQMf%40momjian.us>
Precedence: bulk


--pZBDanP6HC8LB2Jz
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

On Mon, Nov  6, 2023 at 09:44:14AM +0100, Laurenz Albe wrote:
> On Sat, 2023-11-04 at 21:14 -0400, Bruce Momjian wrote:
> > > It is not the role that is modified.  Perhaps:
> > > 
> > >    [...]; if omitted, the current role is used.
> > 
> > Sure, attached.  Here is the issue I have though, we are really not
> > changing default privileges for objects created in the future, we are
> > changing the role _now_ so future objects will have different default
> > privileges, right?  I think wording like the above is kind of odd.
> 
> I see what you mean.  The alternative is to be precise, at the risk of
> repeating ourselves:
> 
>   if omitted, default privileges will be changed for objects created by
>   the current role.

Okay, I think I have good wording for this.  I didn't like the wording
of other roles, so I restructured that in the attached patch too.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Only you can decide what is important to you.

--pZBDanP6HC8LB2Jz
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="role.diff"

diff --git a/doc/src/sgml/ref/alter_default_privileges.sgml b/doc/src/sgml/ref/alter_default_privileges.sgml
new file mode 100644
index 8a60061..a868779
*** a/doc/src/sgml/ref/alter_default_privileges.sgml
--- b/doc/src/sgml/ref/alter_default_privileges.sgml
*************** REVOKE [ GRANT OPTION FOR ]
*** 90,112 ****
    <para>
     <command>ALTER DEFAULT PRIVILEGES</command> allows you to set the privileges
     that will be applied to objects created in the future.  (It does not
!    affect privileges assigned to already-existing objects.)  Currently,
!    only the privileges for schemas, tables (including views and foreign
!    tables), sequences, functions, and types (including domains) can be
!    altered.  For this command, functions include aggregates and procedures.
!    The words <literal>FUNCTIONS</literal> and <literal>ROUTINES</literal> are
!    equivalent in this command.  (<literal>ROUTINES</literal> is preferred
!    going forward as the standard term for functions and procedures taken
!    together.  In earlier PostgreSQL releases, only the
!    word <literal>FUNCTIONS</literal> was allowed.  It is not possible to set
!    default privileges for functions and procedures separately.)
    </para>
  
    <para>
!    You can change default privileges only for objects that will be created by
!    yourself or by roles that you are a member of.  The privileges can be set
!    globally (i.e., for all objects created in the current database),
!    or just for objects created in specified schemas.
    </para>
  
    <para>
--- 90,113 ----
    <para>
     <command>ALTER DEFAULT PRIVILEGES</command> allows you to set the privileges
     that will be applied to objects created in the future.  (It does not
!    affect privileges assigned to already-existing objects.)   Privileges can be
!    set globally (i.e., for all objects created in the current database), or
!    just for objects created in specified schemas.
    </para>
  
    <para>
!    Default privileges apply only to the active role;  the default
!    privileges of member roles have no affect on object permissions.
!    <command>SET ROLE</command> can be used to change the active user and
!    apply their default privileges.
!   </para>
! 
!   <para>
!    As a non-superuser, you can change your own default privileges and
!    the defauls of roles that you are a member of.  There is no way to
!    set default privileges for a role and all its members with a single
!    command;  individual <command>ALTER DEFAULT PRIVILEGES</command>
!    commands must be run to achieve this.
    </para>
  
    <para>
*************** REVOKE [ GRANT OPTION FOR ]
*** 119,124 ****
--- 120,138 ----
    </para>
  
    <para>
+    Currently,
+    only the privileges for schemas, tables (including views and foreign
+    tables), sequences, functions, and types (including domains) can be
+    altered.  For this command, functions include aggregates and procedures.
+    The words <literal>FUNCTIONS</literal> and <literal>ROUTINES</literal> are
+    equivalent in this command.  (<literal>ROUTINES</literal> is preferred
+    going forward as the standard term for functions and procedures taken
+    together.  In earlier PostgreSQL releases, only the
+    word <literal>FUNCTIONS</literal> was allowed.  It is not possible to set
+    default privileges for functions and procedures separately.)
+   </para>
+ 
+   <para>
     Default privileges that are specified per-schema are added to whatever
     the global default privileges are for the particular object type.
     This means you cannot revoke privileges per-schema if they are granted
*************** REVOKE [ GRANT OPTION FOR ]
*** 136,147 ****
      <term><replaceable>target_role</replaceable></term>
      <listitem>
       <para>
!       The name of an existing role of which the current role is a member.
!       Default access privileges are not inherited, so member roles
!       must use <command>SET ROLE</command> to access these privileges,
!       or <command>ALTER DEFAULT PRIVILEGES</command> must be run for
!       each member role.  If <literal>FOR ROLE</literal> is omitted,
!       the current role is assumed.
       </para>
      </listitem>
     </varlistentry>
--- 150,158 ----
      <term><replaceable>target_role</replaceable></term>
      <listitem>
       <para>
!       Change default privileges for objects created by the
!       <replaceable>target_role</replaceable>, or the current
!       role if unspecified.
       </para>
      </listitem>
     </varlistentry>

--pZBDanP6HC8LB2Jz--