Laurenz Albe <[email protected]> writes:
> On Fri, 2026-10-23 at 14:20 -0700, Dustin Sanza wrote:
>> The narrow question: under the privileges above, is there supported
>> SQL that prevents or safely serializes concurrent ALTER ROLE attribute
>> changes until COMMIT without first rewriting those attributes and
>> potentially concealing unexpected drift?
> I don't think so.
> You could use a SECURITY DEFINER function owned by a superuser that
> LOCK pg_catalog.pg_authid IN SHARE MODE;
> to prevent concurrent role modifications.
Or SELECT ... FROM pg_catalog.pg_authid FOR UPDATE, which would have
the advantage of locking only relevant rows not the whole catalog.
regards, tom lane
