Review changes for pg16 update GRANT and REVOKE

pg16_grant_inherit_set
Jodi-Ann Francis 2023-09-07 12:12:16 -04:00
parent 71a2932355
commit 1bfef9d5c5
4 changed files with 75 additions and 24 deletions

View File

@ -878,7 +878,9 @@ GenerateGrantRoleStmtsOfRole(Oid roleid)
if (membership->admin_option) if (membership->admin_option)
{ {
DefElem *opt = makeDefElem("admin", (Node *) makeBoolean(true), -1); DefElem *opt = makeDefElem("admin", (Node *) makeBoolean(true), -1);
grantRoleStmt->opt = list_make1(opt); DefElem *inherit_opt = makeDefElem("inherit", (Node *) makeBoolean(true), -1);
DefElem *set_opt = makeDefElem("set", (Node *) makeBoolean(true), -1);
grantRoleStmt->opt = list_make3(opt, inherit_opt, set_opt);
} }
#else #else
grantRoleStmt->admin_opt = membership->admin_option; grantRoleStmt->admin_opt = membership->admin_option;

View File

@ -354,20 +354,33 @@ AppendGrantRoleStmt(StringInfo buf, GrantRoleStmt *stmt)
if (!stmt->is_grant) if (!stmt->is_grant)
{ {
DefElem *opt = NULL; DefElem *opt = NULL;
int opt_count = 0 ;
foreach_ptr(opt, stmt->opt) foreach_ptr(opt, stmt->opt)
{ {
if (strcmp(opt->defname, "admin") == 0) switch (opt->defname)
{ {
case "admin":
appendStringInfo(buf, "ADMIN OPTION FOR "); appendStringInfo(buf, "ADMIN OPTION FOR ");
} opt_count++;
else if (strcmp(opt->defname, "inherit") == 0); break;
case "inherit":
if (opt_count > 0)
{ {
appendStringInfo(buf, "INHERIT TRUE"); appendStringInfo(buf, ", ");
appendStringInfo(buf, "GRANT x TO y WITH INHERIT TRUE, SET TRUE;");
} }
else if (strcmp(opt->defname, "set") == 0) appendStringInfo(buf, "INHERIT OPTION FOR ");
opt_count++;
break;
case "set":
if (opt_count > 0)
{ {
appendStringInfo(buf, "SET TRUE"); appendStringInfo(buf, ", ");
}
appendStringInfo(buf, "SET OPTION FOR ");
opt_count++;
break;
} }
} }
} }
@ -388,12 +401,35 @@ AppendGrantRoleStmt(StringInfo buf, GrantRoleStmt *stmt)
{ {
#if PG_VERSION_NUM >= PG_VERSION_16 #if PG_VERSION_NUM >= PG_VERSION_16
DefElem *opt = NULL; DefElem *opt = NULL;
int opt_count = 0;
foreach_ptr(opt, stmt->opt) foreach_ptr(opt, stmt->opt)
{ {
if (strcmp(opt->defname, "admin") == 0) switch (opt->defname)
{ {
case "admin":
appendStringInfo(buf, " WITH ADMIN OPTION"); appendStringInfo(buf, " WITH ADMIN OPTION");
opt_count++;
break; break;
case "inherit":
if (opt_count > 0)
{
appendStringInfo(buf, ", ");
}
appendStringInfo(buf, "INHERIT OPTION ");
opt_count++;
break;
case "set":
if (opt_count > 0)
{
appendStringInfo(buf, ", ");
}
appendStringInfo(buf, "SET OPTION ");
opt_count++;
break;
}
} }
} }
#else #else

View File

@ -545,3 +545,16 @@ SET search_path TO pg16;
\set VERBOSITY terse \set VERBOSITY terse
SET client_min_messages TO ERROR; SET client_min_messages TO ERROR;
DROP SCHEMA pg16 CASCADE; DROP SCHEMA pg16 CASCADE;
-- Grant role
GRANT ADMIN TO joe;
GRANT INHERIT ON ROLE joe TO james;
GRANT SELECT ON companies TO joe WITH GRANT OPTION;
GRANT SET (SELECT) ON companies TO james;
---------------------------------------------------------------------
GRANT ROLE
GRANT ROLE
GRANT
GRANT

View File

@ -332,10 +332,6 @@ SELECT pg_get_viewdef('pg16.prop_view_1', true);
\c - - - :master_port \c - - - :master_port
SET search_path TO pg16; SET search_path TO pg16;
\set VERBOSITY terse
SET client_min_messages TO ERROR;
DROP SCHEMA pg16 CASCADE;
-- --
-- PG16 allows GRANT WITH ADMIN | INHERIT | SET -- PG16 allows GRANT WITH ADMIN | INHERIT | SET
-- --
@ -359,10 +355,14 @@ GRANT create_group TO create_role_4 WITH SET;
-- ADMIN role can perfom administrative tasks -- ADMIN role can perfom administrative tasks
-- role can now access the data and permissions of the table (owner of table) -- role can now access the data and permissions of the table (owner of table)
-- role can change current user to any other user/role that has access -- role can change current user to any other user/role that has access
GRANT ADMIN ON DATABASE db_name TO role_name; GRANT ADMIN TO joe;
GRANT INHERIT ON TABLE table_name TO role_name; GRANT INHERIT ON ROLE joe TO james;
GRANT SET SESSION AUTHORIZATION TO role_name;
SELECT * FROM table_name WHERE column_name = 'value'; GRANT SELECT ON companies TO joe WITH GRANT OPTION;
GRANT SET (SELECT) ON companies TO james;
\set VERBOSITY terse
SET client_min_messages TO ERROR;
DROP SCHEMA pg16 CASCADE;
SELECT COUNT(*) FROM table_name WHERE column_name = 'value';