[GENERAL] Making a schema read-only (was Unexpected message in grant/revoke script)

2008-03-14 Thread Webb Sprague
I have the following function: SNIP Now that I know how to write the function, my design flaws and lack of understanding are more apparent... ... I was trying to give all logged in users read-only access to the public schema, and full access to the schema that corresponds to their username.

Re: [GENERAL] Making a schema read-only (was Unexpected message in grant/revoke script)

2008-03-14 Thread Tom Lane
Webb Sprague [EMAIL PROTECTED] writes: Also, I revoked what I thought was everything possible on the public schema, but a user is still able to create a table in that schema -- could someone explain: oregon=# revoke create on schema public from foobar cascade; REVOKE You've got a conceptual

Re: [GENERAL] Making a schema read-only (was Unexpected message in grant/revoke script)

2008-03-14 Thread Webb Sprague
On Fri, Mar 14, 2008 at 12:55 PM, Tom Lane [EMAIL PROTECTED] wrote: Webb Sprague [EMAIL PROTECTED] writes: Also, I revoked what I thought was everything possible on the public schema, but a user is still able to create a table in that schema -- could someone explain: oregon=# revoke

Re: [GENERAL] Making a schema read-only (was Unexpected message in grant/revoke script)

2008-03-14 Thread Webb Sprague
Start with revoke all on schema public from public and then grant only what you want. Oh -- to grant select permissions on all the tables in the public schema, do I have to do it table-by-table? I know I can write a loop an use information_schema if necessary, but if I don't

Re: [GENERAL] Making a schema read-only (was Unexpected message in grant/revoke script)

2008-03-14 Thread Erik Jones
On Mar 14, 2008, at 3:22 PM, Webb Sprague wrote: Start with revoke all on schema public from public and then grant only what you want. Oh -- to grant select permissions on all the tables in the public schema, do I have to do it table-by-table? I know I can write a loop an use

Re: [GENERAL] Making a schema read-only (was Unexpected message in grant/revoke script)

2008-03-14 Thread Webb Sprague
On Fri, Mar 14, 2008 at 1:30 PM, Erik Jones [EMAIL PROTECTED] wrote: On Mar 14, 2008, at 3:22 PM, Webb Sprague wrote: Start with revoke all on schema public from public and then grant only what you want. Oh -- to grant select permissions on all the tables in the public

Re: [GENERAL] Making a schema read-only (was Unexpected message in grant/revoke script)

2008-03-14 Thread Erik Jones
On Mar 14, 2008, at 3:43 PM, Webb Sprague wrote: On Fri, Mar 14, 2008 at 1:30 PM, Erik Jones [EMAIL PROTECTED] wrote: On Mar 14, 2008, at 3:22 PM, Webb Sprague wrote: Start with revoke all on schema public from public and then grant only what you want. Oh -- to grant select

Re: [GENERAL] Making a schema read-only (was Unexpected message in grant/revoke script)

2008-03-14 Thread Webb Sprague
Thanks to Eric and Tom, I think I have got it. Here is the function for adding a new student, who can select anything in public and can do anything at all in their own schema. revoke all on schema public from public; -- done only once create or replace function new_student (text) returns void