Date: Wed, 17 Jun 2009 10:09:04 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter_e@gmx.net>
Cc: pgsql-hackers@postgresql.org, Petr Jelinek <pjmodos@pjmodos.net>
Subject: Re: GRANT ON ALL IN schema
Message-ID: <20090617140904.GL20436@tamriel.snowman.net>
References: <4A37BF63.50008@pjmodos.net> <4A37E122.8070303@pjmodos.net>
	<4A38A956.8080600@pjmodos.net> <200906171644.53717.peter_e@gmx.net>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="4e5ZDkbgLEOfWmLx"
Content-Disposition: inline
In-Reply-To: <200906171644.53717.peter_e@gmx.net>
User-Agent: Mutt/1.5.18 (2008-05-17)


--4e5ZDkbgLEOfWmLx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Peter,

* Peter Eisentraut (peter_e@gmx.net) wrote:
> > Also since this patch introduces VIEWS as object with grantable
> > privileges, I added GRANT ON VIEW foo syntax which is more or less
> > synonymous to GRANT ON TABLE foo syntax. It felt weird to have GRANT ON
> > ALL VIEWS but not GRANT ON VIEW.
>=20
> As far as GRANT is concerned, a view is a table, so I would omit the=20
> VIEW/VIEWS stuff completely.

I would disagree with this.  While an explicit GRANT doesn't need to
care, because you can't have a view and a table with the same name, I
feel *users* (like me) make a distinction there and may want to limit
the grant to just views or just tables.

What we do here will also impact the DefaultACL system that I'm working
on since I think we should be consistant between these two systems.

http://wiki.postgresql.org/wiki/DefaultACL

I don't like the idea that a 'GRANT ALL' would actually change default
ACLs for a schema though.  These are two separate and distinct things-
one is implementing a change to existing objects, the other is setting a
default for new objects.  Mixing them would lead to confusion.

	Thanks,

		Stephen

--4e5ZDkbgLEOfWmLx
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAko4+QAACgkQrzgMPqB3kijdiQCfY+jz5b4yurBy+x0kF33vFaeH
ussAnAvqJkN6QDgXSVKW882e9dUu1fIQ
=sePY
-----END PGP SIGNATURE-----

--4e5ZDkbgLEOfWmLx--