Message-ID: <54F64F13.6010509@BlueTreble.com>
Date: Tue, 3 Mar 2015 18:17:23 -0600
From: Jim Nasby <Jim.Nasby@BlueTreble.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9;
 rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Greg Stark <stark@mit.edu>
CC: Abhijit Menon-Sen <ams@2ndquadrant.com>, PostgreSQL-development
 <pgsql-hackers@postgresql.org>, "Prabakaran, Vaishnavi"
 <vaishnavip@fast.au.fujitsu.com>, Magnus Hagander <magnus@hagander.net>,
 Jaime Casanova <jaime@2ndquadrant.com>
Subject: Re: Providing catalog view to pg_hba.conf file - Patch
 submission
References: <F40B0968DB0A904DA78A924E633BE78645FE29@SYDEXCHTMP2.au.fjanz.com>
 <CABUevEwzKy5JR8papHw5Amk=Ok6uddYtwQ+gJntmLdrx2wOgbA@mail.gmail.com>
 <82897A1301080E4B8E461DDAA0FFCF14DDE1@SYD1216>
 <82897A1301080E4B8E461DDAA0FFCF14FD6E@SYD1216>
 <20140629165554.GA5984@toroid.org> <20140630070646.GY31357@toroid.org>
 <CAM-w4HN6Mq7qAGwNKhM7Uy+f0UJHZkE3zNqBXnunoGRrh5C_Sg@mail.gmail.com>
 <54F5F7DD.8020501@BlueTreble.com>
 <CAM-w4HM_s77AdoXq3Xdu7sYOd-SpRr8E6Em_tuV4hH5=4E14tQ@mail.gmail.com>
In-Reply-To: 
 <CAM-w4HM_s77AdoXq3Xdu7sYOd-SpRr8E6Em_tuV4hH5=4E14tQ@mail.gmail.com>
Content-Type: text/plain; charset="windows-1252"; format=flowed
Content-Transfer-Encoding: 7bit
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Mar 2015 00:17:32.9635 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR11MB0343
X-Pg-Spam-Score: -1.9 (-)
List-Archive: <http://archives.postgresql.org/pgsql-hackers>
List-Help: <mailto:majordomo@postgresql.org?body=help>
List-ID: <pgsql-hackers.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@postgresql.org>
List-Post: <mailto:pgsql-hackers@postgresql.org>
List-Subscribe: <mailto:majordomo@postgresql.org?body=sub%20pgsql-hackers>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
X-Mailing-List: pgsql-hackers
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 3/3/15 12:57 PM, Greg Stark wrote:
> On Tue, Mar 3, 2015 at 6:05 PM, Jim Nasby <Jim.Nasby@bluetreble.com> wrote:
>
>> What about a separate column that's just the text from pg_hba? Or is that what you're opposed to?
>
> I'm not sure what you mean by that. There's a rawline field we could
> put somewhere but it contains the entire line.

I mean have a field for each of user/databases that gives you valid 
pg_hba.conf output. That would allow for cut & paste. But perhaps that's 
just not a use case.

>> FWIW, I'd say that having the individual array elements be correct is more
>> important than what the result of array_out is. That way you could always do
>> array_to_string(..., ', ') and get valid pg_hba output.
>
> Well I don't think you can get that without making the view less
> useful for every other purpose.
>
> Like, I would want to be able to do WHERE "user" @> array[?] or WHERE
> database = array[?] or to join against a list of users or databases
> somewhere else.

I think we're screwed in that regard anyway, because of the special 
constructs. You'd need different logic to handle things like +role and 
sameuser. We might even end up painted in a corner where we can't change 
it in the future because it'll break everyone's scripts.

> To do what you suggest would mean the tokens will need to be quoted
> based on pg_hba.conf syntax requirements. That would mean I would need
> to check each variable or join value against pg_hba.conf's quoting
> requirements to compare with it. It seems more practical to have that
> knowledge if you're actually going to generate a pg_hba.conf than to
> pass around these quoted strings all the time.

What about this:

- database_specials enum[] contains all occurrences of all, sameuser, 
samerole and replication (or maybe it doesn't need to be an array)
- in_roles name[] is a list of all cases of +role_name, with the + 
stripped off (I think the @ case is already handled before the SRF is 
called??)
- role_specials enum[] handles all (enum[] for any future expansion)

Alternatively in_roles could just be combined with role_specials as long 
as we preserve the +.

Any tokens that match the special conditions do not show up in 
databases/users, and those fields become name[]. AFAIK that means the 
quoting should be identical (at least looking at check_db() and 
check_role()).

I can make these changes if you want.
-- 
Jim Nasby, Data Architect, Blue Treble Consulting
Data in Trouble? Get it in Treble! http://BlueTreble.com


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers