Feedback-ID: ie0a040ee:Fastmail
Message-ID: <ba95edda-ea40-47bf-b549-99b02514b2c7@eisentraut.org>
Date: Tue, 14 Jan 2025 10:42:37 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Virtual generated columns
To: jian he <jian.universality@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>,
 Dean Rasheed <dean.a.rasheed@gmail.com>
References: <a368248e-69e4-40be-9c07-6c3b5880b0a6@eisentraut.org>
 <732a9543-0312-4f0c-a471-857b507a3546@eisentraut.org>
 <ebd1e0e9-115f-4dfa-98b8-e9b8e2f9eb2d@eisentraut.org>
 <CAEZATCV=RX0M58-uqSR6tFjwQAFnEcx3hvW-9ZZfRQJLg5LzRw@mail.gmail.com>
 <0f811f71-8c86-4e1b-b3bb-6a535674a440@eisentraut.org>
 <CAEZATCU3q=znAL7X1aSxuMpjfSyB1cT5j398HPb9ix9ci_HUqA@mail.gmail.com>
 <cd7c0fea-6c4b-4bdd-af3b-4d4dabb32ca1@eisentraut.org>
 <CAEZATCVLfMzNwT1J0bnvtv6YbmNSN9QSXb+1QSGyX6vK4q67Ow@mail.gmail.com>
 <ef7c466d-e3b9-4d60-bc03-cd9b48581442@eisentraut.org>
 <09800cb1-43aa-4239-8918-46b71ede4900@eisentraut.org>
 <536b281b-2cb3-4477-971f-c64838bc6263@eisentraut.org>
 <CAEZATCUHnmOu7RtDuP+PCtS_dqvU8hFsAYYFPdiB8gyFszj5WQ@mail.gmail.com>
 <51875199-d5f5-41ed-92dc-3e7b1b996991@eisentraut.org>
 <e5075513-2a0e-4550-bf45-41942af2b676@eisentraut.org>
 <84adfb1b-826c-42b2-a907-b327d3760c7e@eisentraut.org>
 <CACJufxHtarAYA7LZUKbc1NnJ7k-t3+kzicD0ZtHMvJBxvFONpQ@mail.gmail.com>
Content-Language: en-US
From: Peter Eisentraut <peter@eisentraut.org>
In-Reply-To: <CACJufxHtarAYA7LZUKbc1NnJ7k-t3+kzicD0ZtHMvJBxvFONpQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <https://www.postgresql.org/message-id/ba95edda-ea40-47bf-b549-99b02514b2c7%40eisentraut.org>
Precedence: bulk

On 09.01.25 09:38, jian he wrote:
>> create user foo;
>> create user bar;
>> grant create on schema public to foo;
>> \c - foo
>> create table t1 (id int, ccnum text, ccredacted text generated always as
>> (repeat('*', 12) || substr(ccnum, 13, 4)) virtual);
>> grant select (id, ccredacted) on table t1 to bar;
>> insert into t1 values (1, '1234567890123456');
>> \c - bar
>> select * from t1;  -- permission denied
>> select id, ccredacted from t1;  -- ok
> 
> I think this is expected.
> however once the user can access the pg_catalog,
> then he can use pg_get_expr
> figure out the generation expression.
> 
> so here "bar" can figure out the column value of ccnum, i think.

Having access to the expression definition doesn't help you reverse the 
computation, if the computation itself is not reversible.