-
Notifications
You must be signed in to change notification settings - Fork 10
PG-1605, PG-1606 Remove grant/revoke helper functions #381
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just a documentation question: don't we allow pg_tde_is_encrypted
and some other informational functions by default? Because now the documentation states that everything is locked down.
(and maybe we could enable more readonly/informational functions by default?)
Yeah, we should make the documentation more clear but not sure if iut is in the scope of this ticket or not. |
da1f839
to
f85c2d1
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
❌ Your project status has failed because the head coverage (85.39%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## TDE_REL_17_STABLE #381 +/- ##
==================================================
Coverage 85.39% 85.39%
==================================================
Files 22 22
Lines 2602 2602
Branches 393 393
==================================================
Hits 2222 2222
Misses 304 304
Partials 76 76
🚀 New features to boost your workflow:
|
I'm all for this! Honestly the only way I see these grant function being usable is if it was meant to grant to a non-login role that was then granted to whoever should have it. Since we can't control roles it would only be a helper for superusers pretty much. The list of grants that makes sense could just as well be in the documentation ofc. |
These helper functions were tricky to use correctly and did not add much vaule. Emulating a role this way does not really work in PostgreSQL. If people want this behavior they should use a real role.
f85c2d1
to
d5bbb20
Compare
It could be added to the documentation but I am not sure it should. I do not want to encourage people to blindly run grants without understanding why. |
These helper functions were tricky to use correctly and did not add much vaule. Emulating a role this way does not really work in PostgreSQL. If people want this behavior they should use a real role.