mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-08-22 08:33:22 +02:00
patch is applied: Rewrite rules on relation level work fine now. Event qualifications on insert/update/delete rules work fine now. I added the new keyword OLD to reference the CURRENT tuple. CURRENT will be removed in 6.5. Update rules can reference NEW and OLD in the rule qualification and the actions. Insert/update/delete rules on views can be established to let them behave like real tables. For insert/update/delete rules multiple actions are supported now. The actions can also be surrounded by parantheses to make psql happy. Multiple actions are required if update to a view requires updates to multiple tables. Regular users are permitted to create/drop rules on tables they have RULE permissions for (DefineQueryRewrite() is now able to get around the access restrictions on pg_rewrite). This enables view creation for regular users too. This required an extra boolean parameter to pg_parse_and_plan() that tells to set skipAcl on all rangetable entries of the resulting queries. There is a new function pg_exec_query_acl_override() that could be used by backend utilities to use this facility. All rule actions (not only views) inherit the permissions of the event relations owner. Sample: User A creates tables T1 and T2, creates rules that log INSERT/UPDATE/DELETE on T1 in T2 (like in the regression tests for rules I created) and grants ALL but RULE on T1 to user B. User B can now fully access T1 and the logging happens in T2. But user B cannot access T2 at all, only the rule actions can. And due to missing RULE permissions on T1, user B cannot disable logging. Rules on the attribute level are disabled (they don't work properly and since regular users are now permitted to create rules I decided to disable them). Rules on select must have exactly one action that is a select (so select rules must be a view definition). UPDATE NEW/OLD rules are disabled (still broken, but triggers can do it). There are two new system views (pg_rule and pg_view) that show the definition of the rules or views so the db admin can see what the users do. They use two new functions pg_get_ruledef() and pg_get_viewdef() that are builtins. The functions pg_get_ruledef() and pg_get_viewdef() could be used to implement rule and view support in pg_dump. PostgreSQL is now the only database system I know, that has rewrite rules on the query level. All others (where I found a rule statement at all) use stored database procedures or the like (triggers as we call them) for active rules (as some call them). Future of the rule system: The now disabled parts of the rule system (attribute level, multiple actions on select and update new stuff) require a complete new rewrite handler from scratch. The old one is too badly wired up. After 6.4 I'll start to work on a new rewrite handler, that fully supports the attribute level rules, multiple actions on select and update new. This will be available for 6.5 so we get full rewrite rule capabilities. Jan |
||
---|---|---|
.. | ||
aclchk.c | ||
catalog.c | ||
genbki.sh | ||
heap.c | ||
index.c | ||
indexing.c | ||
Makefile | ||
pg_aggregate.c | ||
pg_operator.c | ||
pg_proc.c | ||
pg_type.c | ||
README |
$Header: /cvsroot/pgsql/src/backend/catalog/README,v 1.1.1.1 1996/07/09 06:21:15 scrappy Exp $ This directory contains .c files that manipulate the system catalogs as well as .h files that define the structure of the system catalogs. When the compile-time scripts (such as Gen_fmgrtab.sh and genbki.sh) execute, they grep the DATA statements out of the .h files and munge these in order to generate the .bki files. The .bki files are then used as input to initdb (which is just a wrapper around postgres running single-user in bootstrapping mode) in order to generate the initial (template) system catalog relation files. ----------------------------------------------------------------- People who are going to hose around with the .h files should be aware of the following facts: - It is very important that the DATA statements be properly formatted (e.g., no broken lines, proper use of white-space and _null_). The scripts are line-oriented and break easily. In addition, the only documentation on the proper format for them is the code in the bootstrap/ directory. Just be careful when adding new DATA statements. - Some catalogs require that OIDs be preallocated to tuples because certain catalogs contain circular references. For example, pg_type contains pointers into pg_proc (pg_type.typinput), and pg_proc contains back-pointers into pg_type (pg_proc.proargtypes). In these cases, the references may be explicitly set by use of the "OID =" clause of the .bki insert statement. If no such pointers are required to a given tuple, then the OID may be set to the wildcard value 0 (i.e., the system generates a random OID in the usual way). If you need to find a valid OID for a set of tuples that refer to each other, use the unused_oids script. It generates inclusive ranges of *unused* OIDs (i.e., the line "45-900" means OIDs 45 through 900 have not been allocated yet). However, you should not rely 100% on this script, since it only looks at the .h files in the catalog/ directory. Do a pg_grepsrc (recursive grep) of the source tree to insure that there aren't any hidden crocks (i.e., explicit use of a numeric OID) anywhere in the code. ----------------------------------------------------------------- When munging the .c files, you should be aware of certain conventions: - The system catalog cache code (and most catalog-munging code in general) assumes that the fixed-length portion of all system catalog tuples are in fact present. That is, only the variable-length portions of a catalog tuple are assumed to be permitted to be non-NULL. For example, if you set pg_type.typdelim to be NULL, a piece of code will likely perform "typetup->typdelim" (or, worse, "typetyp->typelem", which follows typdelim). This will result in random errors or even segmentation violations. Hence, do NOT insert catalog tuples that contain NULL attributes except in their variable-length portions! - Modification of the catalogs must be performed with the proper updating of catalog indexes! That is, several catalogs have indexes on them; when you munge them using the executor, the executor will take care of doing the index updates, but if you make direct access method calls to insert new or modified tuples into a heap, you must also make the calls to insert the tuple into ALL of its indexes! If not, the new tuple will generally be "invisible" to the system because most of the accesses to the catalogs in question will be through the associated indexes.