To: Peter Eisentraut <peter_e@gmx.net>
cc: pgsql-hackers@postgresql.org, Petr Jelinek <pjmodos@pjmodos.net>
Subject: Re: GRANT ON ALL IN schema 
In-reply-to: <200906171644.53717.peter_e@gmx.net> 
References: <4A37BF63.50008@pjmodos.net> <4A37E122.8070303@pjmodos.net>
	<4A38A956.8080600@pjmodos.net> <200906171644.53717.peter_e@gmx.net>
Comments: In-reply-to Peter Eisentraut <peter_e@gmx.net>
	message dated "Wed, 17 Jun 2009 16:44:53 +0300"
Date: Wed, 17 Jun 2009 10:15:04 -0400
Message-ID: <25515.1245248104@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>

Peter Eisentraut <peter_e@gmx.net> writes:
> I think you should design this with a bit wider scope.  Instead of just "all 
> tables in this schema", think "all tables satisfying some condition".  It has 
> been requested, for example, to be able to grant on all tables that match a 
> pattern.

I'm against that.  Functionality of that sort is available now if you
really need it (write a plpgsql loop around an EXECUTE) and it's fairly
hard to see a clean syntax that is significantly more general than
"GRANT ON schema.*".  In particular I strongly advise against getting
into supporting user-defined predicates in GRANT.  There are good
reasons for not having utility statements evaluate random expressions.

			regards, tom lane