Message-ID: <c41dff5394b86a581c741a90c13aac2e29cc98c1.camel@cybertec.at>
Subject: Re: Document target_role param of ALTER DEFAULT PRIVILEGES
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Bruce Momjian <bruce@momjian.us>
Cc: Jordi =?ISO-8859-1?Q?Guti=E9rrez?= Hermoso <jordigh@octave.org>,
	pgsql-docs@lists.postgresql.org
Date: Wed, 01 Nov 2023 21:31:52 +0100
In-Reply-To: <ZUKGZ4BSL0p3Pn4p@momjian.us>
References: <72652d72e1816bfc3c05d40f9e0e0373d07823c8.camel@octave.org>
	 <293903c1f00f9b5053c0aa388ddc2850ae537f33.camel@cybertec.at>
	 <ZUKGZ4BSL0p3Pn4p@momjian.us>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/c41dff5394b86a581c741a90c13aac2e29cc98c1.camel%40cybertec.at>
Precedence: bulk

On Wed, 2023-11-01 at 13:09 -0400, Bruce Momjian wrote:
> On Thu, Feb 18, 2021 at 08:16:13AM +0100, Laurenz Albe wrote:
> > On Wed, 2021-02-17 at 15:08 -0500, Jordi Guti=C3=A9rrez Hermoso wrote:
> > > I just had a confusing moment trying to figure out why my roles
> > > weren't creating tables the way I was expecting them to. I didn't
> > > understand what the `target_role` parameter did. No matter how I try
> > > to read this page, I can't see an explanation for that parameter:
> > >=20
> > > https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.ht=
ml
> > >=20
> > > I propose an explanation like the following be added to the
> > > `target_role` parameter:
> > >=20
> > >     This is the role that will create objects with altered default
> > >     privileges. Note that changes in default privileges aren't
> > >     inherited, so altering the default privileges of created objects
> > >     for a parent role will not change the default privileges of
> > >     objects created by inherited roles.
> >=20
> > +1.  I cannot count the number of times I have seen people confused by =
that.
> >=20
> > Suggested patch attached.
>=20
> I see how people can be confused.  I wrote this patch, which I think is
> simpler than the previously posted one.

Oh, I had forgotten about this patch.  I like your version better.

There is another patch in the current commitfest that addresses a similar
problem, triggered by another complaint:
https://commitfest.postgresql.org/45/4633/

That patch does not cover role membership.  Perhaps you could adopt that
patch and merge the information from your patch into it.

Yours,
Laurenz Albe