From: Richard Huxton <dev@archonet.com>
To: rawi <only4com@web.de>
Cc: pgsql-sql@postgresql.org
Subject: Re: kind of RULE on SELECT depending on existence of a WHERE condition
Date: Mon, 01 Mar 2010 13:38:54 +0000
Message-ID: <4B8BC36E.4040007@archonet.com> (raw)
In-Reply-To: <27742718.post@talk.nabble.com>
References: <27741669.post@talk.nabble.com>
<4B8B983B.4080205@archonet.com>
<27742718.post@talk.nabble.com>
On 01/03/10 12:16, rawi wrote:
>
>> Not quite the way you suggest. You could build a series of views with
>> the WHERE conditions built in to them, and grant permissions on those
>> though.
>
> Thank you very much for your help.
>
> Unfortunately is this not what I hoped...
> The permissions will be granted dynamic by the application out of the
> user-records and expressed in the WHERE flags.
> I'll need another approach...
You could write a set-returning function that takes either:
1. A list of conditions
2. The text for a WHERE clause
If it gets no conditions or a blank string, it returns nothing.
You will need to create the function with SECURITY DEFINER permissions,
as a user who can read from the table. Make sure the application cannot
read from the table and has to use the function.
--
Richard Huxton
Archonet Ltd
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: dev@archonet.com, only4com@web.de
Subject: Re: kind of RULE on SELECT depending on existence of a WHERE condition
In-Reply-To: <4B8BC36E.4040007@archonet.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox