MIME-Version: 1.0
References: <CAFCRh-8JNEy+dV4SXFOrWca50u+d=--TO4cq=+ac1oBtfJy4AA@mail.gmail.com>
 <42cf78d42a376bf05ca9f5776ad29edc30e784d5.camel@cybertec.at>
In-Reply-To: <42cf78d42a376bf05ca9f5776ad29edc30e784d5.camel@cybertec.at>
From: Robert Haas <robertmhaas@gmail.com>
Date: Fri, 20 Sep 2024 12:51:01 -0400
Message-ID: <CA+TgmobvCGAHPZxX1rNgUb1cGcmD5e8ESGVSL=OyVqDYCAV3EQ@mail.gmail.com>
Subject: Re: Why no pg_has_role(..., 'ADMIN')?
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Dominique Devienne <ddevienne@gmail.com>, pgsql-general@postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CA%2BTgmobvCGAHPZxX1rNgUb1cGcmD5e8ESGVSL%3DOyVqDYCAV3EQ%40mail.gmail.com>
Precedence: bulk

On Fri, Sep 20, 2024 at 12:37=E2=80=AFPM Laurenz Albe <laurenz.albe@cyberte=
c.at> wrote:
> > But knowing whether DROP ROLE will work,
> > w/o invalidating the current transaction,
> > seems like something quite useful to know now, no?
> >
> > I can query pg_auth_members for admin_option,
> > but only easily for direct membership. Taking into
> > account indirect membership, which I assume applies,
> > is exactly why pg_has_role() exists, no?
>
> That would be a useful addition, yes.

I think this already exists. The full list of modes supported by
pg_has_role() is listed in convert_role_priv_string(). You can do
something like pg_has_role('alice', 'USAGE WITH ADMIN OPTION'). This
is not new: it worked in older releases too, but AFAIK it's never been
mentioned in the documentation.

However, the precise rule for DROP ROLE in v16+ is not just that you
need to have ADMIN OPTION on the role. The rule is:

1. You must have ADMIN OPTION on the target role.
2. You must also have CREATEROLE.
3. If the target role is SUPERUSER, you must be SUPERUSER.

If I'm not wrong, pg_has_role(..., 'USAGE WITH ADMIN OPTION') will
test #1 for you, but not #2 or #3.

--=20
Robert Haas
EDB: http://www.enterprisedb.com