MIME-Version: 1.0
References: <CAFCRh--AXoYUj8-WDuWpUcWXC0UNAL9gjbTp=1hU-NJhRyR0vQ@mail.gmail.com>
 <fa68fc72-e109-452e-8642-2b99c613f870@aklaver.com> <CAFCRh-9AzsOBd6cPFsgmbw=Mf3nN5tHj9YYQQHZG0XqxDSMK=Q@mail.gmail.com>
 <508f71c4-f1b1-4685-921d-bec8b361be10@aklaver.com> <662792ed-810d-46f1-a0c3-d4b55e5469fc@aklaver.com>
 <CAFCRh-8D+R=xufTFYN8SDDeEVwDNCb7kcspt9hsRW2T-QOMoKg@mail.gmail.com>
 <693d1252-89e4-498d-a5a6-5de6524bbb34@dalibo.com> <CAFCRh--tSWRRCMvtSovtRDX1wce5KCOutaDRBD5JKWb9atLC_w@mail.gmail.com>
 <bc2b9760-3597-477a-b199-633ba3ac36e5@aklaver.com>
In-Reply-To: <bc2b9760-3597-477a-b199-633ba3ac36e5@aklaver.com>
From: Dominique Devienne <ddevienne@gmail.com>
Date: Thu, 31 Jul 2025 17:54:27 +0200
Message-ID: <CAFCRh--ZOeWP6euXdXz=yri3-5V0wFHXTd2KGLb+UaTUR7k_LQ@mail.gmail.com>
Subject: Re: SET LOCAL ROLE inside SECURITY INVOKER (LANGUAGE plpgsql) function
To: Adrian Klaver <adrian.klaver@aklaver.com>
Cc: Guillaume Lelarge <guillaume.lelarge@dalibo.com>, pgsql-general@lists.postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAFCRh--ZOeWP6euXdXz%3Dyri3-5V0wFHXTd2KGLb%2BUaTUR7k_LQ%40mail.gmail.com>
Precedence: bulk

On Thu, Jul 31, 2025 at 4:13=E2=80=AFPM Adrian Klaver <adrian.klaver@aklave=
r.com> wrote:
> On 7/31/25 04:37, Dominique Devienne wrote:
> So the below from the original post was not correct:
>
> "My setup ensures that the role I SET LOCAL ROLE to, has (indirectly)
> been granted DMLs on that table."

Not so. DML is Data Modification Language.
I did grant INSERT, UPDATE, DELETE.

As opposed to DQL, Data Query Language.
And yes, I failed to grant SELECT.

Normally SELECT comes from yet another role.
But not in this specific case.