--On Mittwoch, Juni 17, 2009 16:44:53 +0300 Peter Eisentraut
<pete...@gmx.net> wrote:
I think you should design this with a bit wider scope. Instead of just
"all tables in this schema", think "all tables satisfying some
condition". It has been requested, for example, to be able to grant on
all tables that match a pattern.
My experience shows that having such a thing is often leading to "bad
practices". People tend to grant everything to every login role instead of
using an intelligent role privilege mechanism.
MySQL for example has such wildcards (using '_' and '%' wildcard patterns),
which often confuses people when having such characters in their
table/database names (of course, i forgot to escape them more than once).
The unpredictable results of messing up a complete schema when using a
broken pattern expression is going to reduce the usefulness of such a
feature, i think.
Also since this patch introduces VIEWS as object with grantable
privileges, I added GRANT ON VIEW foo syntax which is more or less
synonymous to GRANT ON TABLE foo syntax. It felt weird to have GRANT ON
ALL VIEWS but not GRANT ON VIEW.
As far as GRANT is concerned, a view is a table, so I would omit the
VIEW/VIEWS stuff completely.
We have ALTER VIEW now, so why don't implement the same synonym for GRANT?
--
Thanks
Bernd
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
