Date: Tue, 9 Jun 2026 18:04:20 +0000
From: Bertrand Drouvot <bertranddrouvot.pg@gmail.com>
To: Jeff Davis <pgsql@j-davis.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>,
	Robert Haas <robertmhaas@gmail.com>,
	Roman Eskin <r.eskin@arenadata.io>,
	Michael Paquier <michael@paquier.xyz>,
	Alexander Lakhin <exclusion@gmail.com>,
	pgsql-hackers@lists.postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
Subject: Re: Avoid orphaned objects dependencies, take 3
Message-ID: <aihVpLpRqMnyBXSk@bdtpg>
References: 
 <CA+TgmobtzkG9HzGtDXbgb3KVE46qHuSvGcuKHgAGQ1aejCoLLw@mail.gmail.com>
 <agsCqlLTytZCudMv@bdtpg>
 <aebf583b-b904-4035-a1c1-a4c5ad064dec@iki.fi>
 <ahYAKgbx05IQdjwR@bdtpg>
 <3963e573-4852-4d25-b741-7c5c7e1f9140@iki.fi>
 <ah1PIyqtT+427dWb@bdtpg>
 <02e28438bd448ff4ee8f6fd78e6b74e657172d73.camel@j-davis.com>
 <aiLKkTC6QBt8i35P@bdtpg>
 <71eb9a8835a28165939da567a9d649fe6d21bfa7.camel@j-davis.com>
 <aie26jMSoEMrHLaI@bdtpg>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <aie26jMSoEMrHLaI@bdtpg>
Archived-At: <https://www.postgresql.org/message-id/aihVpLpRqMnyBXSk%40bdtpg>
Precedence: bulk

Hi,

On Tue, Jun 09, 2026 at 06:47:06AM +0000, Bertrand Drouvot wrote:
> Hi,
> 
> On Mon, Jun 08, 2026 at 02:55:19PM -0700, Jeff Davis wrote:
> > On Fri, 2026-06-05 at 13:09 +0000, Bertrand Drouvot wrote:
> > > the current patch
> > 
> >   /*
> >    * Look up a tracked aclcheck entry for the given object.
> >    * Returns true if found, filling in roleId, mode, and inval_count.
> >    * Searches from the end to find the most recent check (the one with
> > the
> >    * freshest inval_count).
> > 
> > What if two tracked ACL checks had different modes? Don't you need to
> > do both checks or somehow combine the modes in the tracking entry?
> > 
> > (I'm not sure if this is a practical problem or not.)
> 
> Humm, good point. I was focusing on a "full" role revoke but maybe what you
> describe could be a practical problem (in case of privilege revoke from the
> role).
> 
> In order to be on the safe side of things, the attached now iterates through all
> matching entries (and not only the last one). It's still a flat array as its
> linear scan is O(n) in the number of tracked entries, but that's fine since a
> typical DDL statement tracks only a few objects.

I just realized that the cfbot is complaining, let me fix it and come back with
an updated patch.

Regards,

-- 
Bertrand Drouvot
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com