Message-ID: <4B8BC36E.4040007@archonet.com>
Date: Mon, 01 Mar 2010 13:38:54 +0000
From: Richard Huxton <dev@archonet.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
	rv:1.9.1.9pre) Gecko/20100217 Lightning/1.0b1 Shredder/3.0.3pre
MIME-Version: 1.0
To: rawi <only4com@web.de>
CC: pgsql-sql@postgresql.org
Subject: Re: kind of RULE on SELECT depending on existence of a WHERE
 condition
References: <27741669.post@talk.nabble.com> <4B8B983B.4080205@archonet.com>
	<27742718.post@talk.nabble.com>
In-Reply-To: <27742718.post@talk.nabble.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

On 01/03/10 12:16, rawi wrote:
>
>> Not quite the way you suggest. You could build a series of views with
>> the WHERE conditions built in to them, and grant permissions on those
>> though.
>
> Thank you very much for your help.
>
> Unfortunately is this not what I hoped...
> The permissions will be granted dynamic by the application out of the
> user-records and expressed in the WHERE flags.
> I'll need another approach...

You could write a set-returning function that takes either:
1. A list of conditions
2. The text for a WHERE clause

If it gets no conditions or a blank string, it returns nothing.

You will need to create the function with SECURITY DEFINER permissions, 
as a user who can read from the table. Make sure the application cannot 
read from the table and has to use the function.

-- 
   Richard Huxton
   Archonet Ltd