Feedback-ID: i4271461c:Fastmail
Message-ID: <e7387e04-0a17-3a77-8e0c-da6794625a30@mtneva.com>
Date: Tue, 29 Aug 2023 14:44:48 -0600
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.11.0
Subject: Re: Restoring default privileges on objects
Content-Language: en-US
To: pgsql-general@lists.postgresql.org
Cc: Erik Wienhold <ewie@ewie.name>, Tom Lane <tgl@sss.pgh.pa.us>
References: <96d6885a-5e25-9ae8-4a1a-d7e557a5fe9c@mtneva.com>
 <1166048641.281962.1693308151542@office.mailbox.org>
 <1006397.1693318485@sss.pgh.pa.us>
 <efdd465d-a795-6188-7f71-7cdb4b2be031@mtneva.com>
 <1550267563.330669.1693335893138@office.mailbox.org>
 <31246.1693337238@sss.pgh.pa.us>
From: Stuart McGraw <smcg4191@mtneva.com>
In-Reply-To: <31246.1693337238@sss.pgh.pa.us>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <https://www.postgresql.org/message-id/e7387e04-0a17-3a77-8e0c-da6794625a30%40mtneva.com>
Precedence: bulk

On 8/29/23 13:27, Tom Lane wrote:
> Erik Wienhold <ewie@ewie.name> writes:
>> On 29/08/2023 18:43 CEST Stuart McGraw <smcg4191@mtneva.com> wrote:
>>> Shouldn't psql put *something* (like "(default)" or "-") in the
>>> "Access privileges" column to indicate that?  Or conversely,
>>> something (like "(none)"?) in the revoked case?
> 
>> Indeed, that's confusing.  Command \dp always prints null as empty string [1].
>> So \pset null '(null)' has no effect.
> 
> Yeah, perhaps.  The reason it so seldom comes up is that a state of
> zero privileges is extremely rare (because it's useless in practice).
> 
> That being the case, if we were to do something about this, I'd vote
> for changing the display of zero-privileges to "(none)" or something
> along that line, rather than changing the display of NULL, which
> people are accustomed to.
> 
> Fixing \dp to honor "\pset null" for this might be a reasonable
> thing to do too.  I'm actually a bit surprised that that doesn't
> work already.
> 
> 			regards, tom lane

That change would still require someone using \dp to realize that
the "Access privileges" value could be either '' or NULL (I guess
that could be pointed out more obviously in the psql doc), and then
do a '\pset null' before doing \dp?  That seems a little inconvenient.

As a possible alternative, in the query that \dp sends, what about
replacing the line:

   select ...,
     pg_catalog.array_to_string(c.relacl, E'\n') as "Access privileges"
     ...

with something like:

     CASE array_length(c.relacl,1) WHEN 0 THEN '(none)' ELSE pg_catalog.array_to_string(c.relacl, E'\n') END as "Access privileges"

I realize that removes the ability to control with pset what is
displayed, but maybe a little more foolproof for naive users like
myself?