MIME-Version: 1.0
From: Egor Voynov <egor.voynov@aiven.io>
Date: Wed, 11 Feb 2026 09:53:58 +0100
Message-ID: <CANc5o7aqz7S=7msdLD=WS4MMWC-jEM76QQy6gU7xU39uJ2==rg@mail.gmail.com>
Subject: Access to pg_replication_origin* functions
To: pgsql-general@postgresql.org
Content-Type: multipart/alternative; boundary="000000000000ec91e7064a888335"
Archived-At: <https://www.postgresql.org/message-id/CANc5o7aqz7S%3D7msdLD%3DWS4MMWC-jEM76QQy6gU7xU39uJ2%3D%3Drg%40mail.gmail.com>
Precedence: bulk

--000000000000ec91e7064a888335
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi all,

I have a question regarding access to replication origin functions, such
as  pg_catalog.pg_replication_origin* (e.g. pg_replication_origin_oid(text)=
)
.

At the moment, access to these functions has to be granted individually.
Should users with the REPLICATION attribute be allowed to execute them by
default?

Alternatively, would it make sense to grant this access in bulk via an
existing role like pg_create_subscription, or perhaps introduce a dedicated
predefined role for this purpose?

These functions are closely related to replication, but it=E2=80=99s not en=
tirely
clear what the intended privilege model is here.

Any thoughts?

Best regards,

Egor Voynov

--000000000000ec91e7064a888335
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><p class=3D"gmail-isSelectedEnd">Hi all,</p><p class=3D"gm=
ail-isSelectedEnd">I have a question regarding access=C2=A0to replication o=
rigin functions, such as=C2=A0=C2=A0<span style=3D"font-family:monospace">p=
g_catalog.pg_replication_origin* (e.g.=C2=A0</span><code>pg_replication_ori=
gin_oid(text))</code>.</p><p class=3D"gmail-isSelectedEnd">At the moment, a=
ccess to these functions has to be granted individually. Should users with =
the <code>REPLICATION</code> attribute be allowed to execute them by defaul=
t?</p><p class=3D"gmail-isSelectedEnd">Alternatively, would it make sense t=
o grant this access in bulk via an existing role like <code>pg_create_subsc=
ription</code>, or perhaps introduce a dedicated predefined role for this p=
urpose?</p><p class=3D"gmail-isSelectedEnd">These functions are closely rel=
ated to replication, but it=E2=80=99s not entirely clear what the intended =
privilege model is here.</p><p class=3D"gmail-isSelectedEnd">Any thoughts?<=
/p><p>Best regards,</p><p>Egor Voynov</p></div>

--000000000000ec91e7064a888335--