Received: from sss2.sss.pgh.pa.us (sss.pgh.pa.us [209.114.166.2]) by hub.org (8.9.3/8.9.3) with ESMTP id RAA46999 for ; Wed, 16 Feb 2000 17:13:38 -0500 (EST) (envelope-from tgl@sss.pgh.pa.us) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss2.sss.pgh.pa.us (8.9.3/8.9.3) with ESMTP id RAA04629; Wed, 16 Feb 2000 17:13:13 -0500 (EST) To: Constantin Teodorescu cc: Ed Loehr , PostgreSQL Interfaces Subject: Re: [INTERFACES] A question on triggers In-reply-to: <38AAEB22.19CF1C6B@flex.ro> References: <38AAAD16.C05F47C3@flex.ro> <38AACF15.E7148A20@austin.rr.com> <38AAEB22.19CF1C6B@flex.ro> Comments: In-reply-to Constantin Teodorescu message dated "Wed, 16 Feb 2000 20:23:30 +0200" Date: Wed, 16 Feb 2000 17:13:13 -0500 Message-ID: <4624.950739193@sss.pgh.pa.us> From: Tom Lane >>>> Is there any chance to restrict the direct updates of any user to the >>>> "stock" table? >>>> So that the information in the "stock" table should be updated ONLY by >>>> those triggers? > But wouldn't be nice if PostgreSQL could offer a more elegant solution? Can't you do it with the normal GRANT/REVOKE access-control mechanism? I'm pretty sure that for rules (views), the access rights for queries issued within the rule are checked based on the owner of the rule, not the user who invoked the rule. Triggers ought to work the same way, though I haven't tried it. So you could make the trigger function and the protected table owned by the same user, and then not grant write permission on that table to anyone else. regards, tom lane