From: Peter Eisentraut <peter_e@gmx.net>
To: pgsql-hackers@postgresql.org
Subject: Re: GRANT ON ALL IN schema
Date: Wed, 17 Jun 2009 17:44:24 +0300
User-Agent: KMail/1.11.2 (Linux/2.6.26-2-686; KDE/4.2.2; i686; ; )
Cc: Tom Lane <tgl@sss.pgh.pa.us>,
 Petr Jelinek <pjmodos@pjmodos.net>
References: <4A37BF63.50008@pjmodos.net> <200906171644.53717.peter_e@gmx.net>
	<25515.1245248104@sss.pgh.pa.us>
In-Reply-To: <25515.1245248104@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="iso-8859-15"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200906171744.24456.peter_e@gmx.net>

On Wednesday 17 June 2009 17:15:04 Tom Lane wrote:
> Peter Eisentraut <peter_e@gmx.net> writes:
> > I think you should design this with a bit wider scope.  Instead of just
> > "all tables in this schema", think "all tables satisfying some
> > condition".  It has been requested, for example, to be able to grant on
> > all tables that match a pattern.
>
> I'm against that.  Functionality of that sort is available now if you
> really need it (write a plpgsql loop around an EXECUTE) and it's fairly
> hard to see a clean syntax that is significantly more general than
> "GRANT ON schema.*".  In particular I strongly advise against getting
> into supporting user-defined predicates in GRANT.  There are good
> reasons for not having utility statements evaluate random expressions.

Why don't we tell people to write a plpgsql loop for the schema.* case as 
well?

I haven't seen any evidence that the schema.* case is more common than other 
bulk DDL cases like "matches pattern" or "owned by $user" or "grant on all 
functions that are not security definer" etc.