Message-ID: <c36ec1311c8ded32bef4dd95dda6dba4f5ca65ff.camel@cybertec.at>
Subject: Re: Triggers on underlying tables of updatable views
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Max Ziermann <max.ziermann@htw-dresden.de>,
	pgsql-docs@lists.postgresql.org
Date: Tue, 23 Nov 2021 11:28:11 +0100
In-Reply-To: <cde3a45c440fd64884565725fc6f98b6dae8446d.camel@cybertec.at>
References: 
	<163758281947.26190.10251137266467665332@wrigleys.postgresql.org>
	 <2f54dbb7d59aacacbc4654b0bc56faaebe993e09.camel@cybertec.at>
	 <3e14b477-40ce-4b6a-047a-9fea3843427c@htw-dresden.de>
	 <cde3a45c440fd64884565725fc6f98b6dae8446d.camel@cybertec.at>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.40.4 (3.40.4-2.fc34) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/c36ec1311c8ded32bef4dd95dda6dba4f5ca65ff.camel%40cybertec.at>
Precedence: bulk

On Mon, 2021-11-22 at 21:02 +0100, Laurenz Albe wrote:
> On Mon, 2021-11-22 at 19:54 +0100, Max Ziermann wrote:
> > Am 22.11.21 um 16:41 schrieb Laurenz Albe:
> > > On Mon, 2021-11-22 at 12:06 +0000, PG Doc comments form wrote:
> > > > "Note that the user performing the insert, update or delete on the view must
> > > > have the corresponding insert, update or delete privilege on the view. In
> > > > addition the view's owner must have the relevant privileges on the
> > > > underlying base relations, but the user performing the update does not need
> > > > any permissions on the underlying base relations (see Section 41.5)."
> > > > 
> > > > Could it be made more clear that triggers on a underlying table of an
> > > > updatable view are still executed with the permissions of the user
> > > > performing an insert/update/delete on the view?
> > > 
> > > But that is not the case: that trigger will be executed with the permissions
> > > of the owner of the underlying table.
> > 
> > Maybe I am missing an obvious point, but I don't think that's the case.
> > SQL example:

After some more thinking and experimenting, I realize that was wrong.

The trigger will always execute with the permissions of the user
running the query.
Only the permissions on the underlying tables are checked for the
view owner, the actual query is executed in the security context of
the user that queries the view.

I don't think that requires special mention on the CREATE VIEW page,
since it is no different when views are not involved.
It might be worth mentioning on
https://www.postgresql.org/docs/current/trigger-definition.html
that triggers (unless the function is SECURITY DEFINER) are executed
under the security context of the user that runs the query, rather
than under the security context of the table owner.

Yours,
Laurenz Albe