From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
cc: Laurenz Albe <laurenz.albe@cybertec.at>,
        Dominique Devienne <ddevienne@gmail.com>, pgsql-general@postgresql.org
Subject: Re: Why no pg_has_role(..., 'ADMIN')?
In-reply-to: <2468702.1726856198@sss.pgh.pa.us>
References: <CAFCRh-8JNEy+dV4SXFOrWca50u+d=--TO4cq=+ac1oBtfJy4AA@mail.gmail.com> <42cf78d42a376bf05ca9f5776ad29edc30e784d5.camel@cybertec.at> <CA+TgmobvCGAHPZxX1rNgUb1cGcmD5e8ESGVSL=OyVqDYCAV3EQ@mail.gmail.com> <2468702.1726856198@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Fri, 20 Sep 2024 14:16:38 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2470833.1726857267.1@sss.pgh.pa.us>
Date: Fri, 20 Sep 2024 14:34:27 -0400
Message-ID: <2470834.1726857267@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/2470834.1726857267%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
> Robert Haas <robertmhaas@gmail.com> writes:
>> I think this already exists. The full list of modes supported by
>> pg_has_role() is listed in convert_role_priv_string(). You can do
>> something like pg_has_role('alice', 'USAGE WITH ADMIN OPTION'). This
>> is not new: it worked in older releases too, but AFAIK it's never been
>> mentioned in the documentation.

> Surely that's a bad documentation omission.

Actually, it's not true that it's entirely undocumented, because the
text above the table that describes pg_has_role mentions

    Optionally, WITH GRANT OPTION can be added to a privilege type to
    test whether the privilege is held with grant option.

But I concur that it's not immediately obvious that that applies
to role membership, since we don't use the "grant option" terminology
for roles.

I'm now inclined to add wording within the pg_has_role entry, along
the lines of

    WITH ADMIN OPTION or WITH GRANT OPTION can be added to any of
    these privilege types to test whether ADMIN privilege is held
    (all six spellings test the same thing).

			regards, tom lane