MIME-Version: 1.0
References: <aKc855Ez-iHiJ6ww@hermes.hilbert.loc> <3662a9b9-3e58-4977-8bd1-e1ed0e25b2a8@aklaver.com>
 <aKdCfim8i_TNw16S@hermes.hilbert.loc> <CAFCRh-8O-zBaruts-9jpQXsZr5sGo46UNdW+tftoVVzBxkzxEQ@mail.gmail.com>
 <aKdLW7a-MN8vlKnJ@hermes.hilbert.loc>
In-Reply-To: <aKdLW7a-MN8vlKnJ@hermes.hilbert.loc>
From: Dominique Devienne <ddevienne@gmail.com>
Date: Thu, 21 Aug 2025 18:43:47 +0200
Message-ID: <CAFCRh-__JJ8uOL=GPzuZ8khC6rg2Q7+SxOe6YcyBVSfv25RmRQ@mail.gmail.com>
Subject: Re: Q: GRANT ... WITH ADMIN on PG 17
To: Karsten Hilbert <Karsten.Hilbert@gmx.net>
Cc: pgsql-general@lists.postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAFCRh-__JJ8uOL%3DGPzuZ8khC6rg2Q7%2BSxOe6YcyBVSfv25RmRQ%40mail.gmail.com>
Precedence: bulk

On Thu, Aug 21, 2025 at 6:37=E2=80=AFPM Karsten Hilbert <Karsten.Hilbert@gm=
x.net> wrote:
> Am Thu, Aug 21, 2025 at 06:29:36PM +0200 schrieb Dominique Devienne:
> > > Thanks, I did, but did not find the answer to: Is there a
> > > way for a role that can manage membership in a group role to
> > > not itself be a member of that group role ?
> >
> > Yes and no. Depends what you mean by MEMBER...
> ...
> > So I didn't spend time studying your specific use case. That's your job=
 :).
> > But given my painful experience of the past year, I'd answer yes to you=
r
> > question, on logical grounds. If you see what I mean. --DD
>
> I followed your posts back then when you worked out your use
> case so I did have _some_ idea where to look ;-)

Glad it helped someone, maybe.

> I just wanted to confirm my understanding in relation to my
> current usage. David kindly provided the needed affirmation.

Well, I disagree with David that you're a MEMBER with just ADMIN.
pg_has_role(..., 'MEMBER') says yes. But pg_has_role(..., 'SET') says no.
If you can't endorse the role's privileges, you're not a member in my book.
That was kinda my point. --DD