mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-08-22 02:43:23 +02:00
2b2a50722c
by abandoning the idea that it should say SERIAL in the dump. Instead, dump serial sequences and column defaults just like regular ones. Add a new backend command ALTER SEQUENCE OWNED BY to let pg_dump recreate the sequence-to-column dependency that was formerly created "behind the scenes" by SERIAL. This restores SERIAL to being truly "just a macro" consisting of component operations that can be stated explicitly in SQL. Furthermore, the new command allows sequence ownership to be reassigned, so that old mistakes can be cleaned up. Also, downgrade the OWNED-BY dependency from INTERNAL to AUTO, since there is no longer any very compelling argument why the sequence couldn't be dropped while keeping the column. (This forces initdb, to be sure the right kinds of dependencies are in there.) Along the way, add checks to prevent ALTER OWNER or SET SCHEMA on an owned sequence; you can now only do this indirectly by changing the owning table's owner or schema. This is an oversight in previous releases, but probably not worth back-patching.
120 lines
5.3 KiB
Plaintext
120 lines
5.3 KiB
Plaintext
--
|
|
-- DEPENDENCIES
|
|
--
|
|
CREATE USER regression_user;
|
|
CREATE USER regression_user2;
|
|
CREATE USER regression_user3;
|
|
CREATE GROUP regression_group;
|
|
CREATE TABLE deptest (f1 serial primary key, f2 text);
|
|
NOTICE: CREATE TABLE will create implicit sequence "deptest_f1_seq" for serial column "deptest.f1"
|
|
NOTICE: CREATE TABLE / PRIMARY KEY will create implicit index "deptest_pkey" for table "deptest"
|
|
GRANT SELECT ON TABLE deptest TO GROUP regression_group;
|
|
GRANT ALL ON TABLE deptest TO regression_user, regression_user2;
|
|
-- can't drop neither because they have privileges somewhere
|
|
DROP USER regression_user;
|
|
ERROR: role "regression_user" cannot be dropped because some objects depend on it
|
|
DETAIL: access to table deptest
|
|
DROP GROUP regression_group;
|
|
ERROR: role "regression_group" cannot be dropped because some objects depend on it
|
|
DETAIL: access to table deptest
|
|
-- if we revoke the privileges we can drop the group
|
|
REVOKE SELECT ON deptest FROM GROUP regression_group;
|
|
DROP GROUP regression_group;
|
|
-- can't drop the user if we revoke the privileges partially
|
|
REVOKE SELECT, INSERT, UPDATE, DELETE, RULE, REFERENCES ON deptest FROM regression_user;
|
|
DROP USER regression_user;
|
|
ERROR: role "regression_user" cannot be dropped because some objects depend on it
|
|
DETAIL: access to table deptest
|
|
-- now we are OK to drop him
|
|
REVOKE TRIGGER ON deptest FROM regression_user;
|
|
DROP USER regression_user;
|
|
-- we are OK too if we drop the privileges all at once
|
|
REVOKE ALL ON deptest FROM regression_user2;
|
|
DROP USER regression_user2;
|
|
-- can't drop the owner of an object
|
|
-- the error message detail here would include a pg_toast_nnn name that
|
|
-- is not constant, so suppress it
|
|
\set VERBOSITY terse
|
|
ALTER TABLE deptest OWNER TO regression_user3;
|
|
DROP USER regression_user3;
|
|
ERROR: role "regression_user3" cannot be dropped because some objects depend on it
|
|
\set VERBOSITY default
|
|
-- if we drop the object, we can drop the user too
|
|
DROP TABLE deptest;
|
|
DROP USER regression_user3;
|
|
-- Test DROP OWNED
|
|
CREATE USER regression_user0;
|
|
CREATE USER regression_user1;
|
|
CREATE USER regression_user2;
|
|
SET SESSION AUTHORIZATION regression_user0;
|
|
-- permission denied
|
|
DROP OWNED BY regression_user1;
|
|
ERROR: permission denied to drop objects
|
|
DROP OWNED BY regression_user0, regression_user2;
|
|
ERROR: permission denied to drop objects
|
|
REASSIGN OWNED BY regression_user0 TO regression_user1;
|
|
ERROR: permission denied to reassign objects
|
|
REASSIGN OWNED BY regression_user1 TO regression_user0;
|
|
ERROR: permission denied to reassign objects
|
|
-- this one is allowed
|
|
DROP OWNED BY regression_user0;
|
|
CREATE TABLE deptest1 (f1 int unique);
|
|
NOTICE: CREATE TABLE / UNIQUE will create implicit index "deptest1_f1_key" for table "deptest1"
|
|
GRANT ALL ON deptest1 TO regression_user1 WITH GRANT OPTION;
|
|
SET SESSION AUTHORIZATION regression_user1;
|
|
CREATE TABLE deptest (a serial primary key, b text);
|
|
NOTICE: CREATE TABLE will create implicit sequence "deptest_a_seq" for serial column "deptest.a"
|
|
NOTICE: CREATE TABLE / PRIMARY KEY will create implicit index "deptest_pkey" for table "deptest"
|
|
GRANT ALL ON deptest1 TO regression_user2;
|
|
RESET SESSION AUTHORIZATION;
|
|
\z deptest1
|
|
Access privileges for database "regression"
|
|
Schema | Name | Type | Access privileges
|
|
--------+----------+-------+----------------------------------------------------------------------------------------------------------------------------------------
|
|
public | deptest1 | table | {regression_user0=arwdRxt/regression_user0,regression_user1=a*r*w*d*R*x*t*/regression_user0,regression_user2=arwdRxt/regression_user1}
|
|
(1 row)
|
|
|
|
DROP OWNED BY regression_user1;
|
|
-- all grants revoked
|
|
\z deptest1
|
|
Access privileges for database "regression"
|
|
Schema | Name | Type | Access privileges
|
|
--------+----------+-------+---------------------------------------------
|
|
public | deptest1 | table | {regression_user0=arwdRxt/regression_user0}
|
|
(1 row)
|
|
|
|
-- table was dropped
|
|
\d deptest
|
|
-- Test REASSIGN OWNED
|
|
GRANT ALL ON deptest1 TO regression_user1;
|
|
SET SESSION AUTHORIZATION regression_user1;
|
|
CREATE TABLE deptest (a serial primary key, b text);
|
|
NOTICE: CREATE TABLE will create implicit sequence "deptest_a_seq" for serial column "deptest.a"
|
|
NOTICE: CREATE TABLE / PRIMARY KEY will create implicit index "deptest_pkey" for table "deptest"
|
|
CREATE TABLE deptest2 (f1 int);
|
|
-- make a serial column the hard way
|
|
CREATE SEQUENCE ss1;
|
|
ALTER TABLE deptest2 ALTER f1 SET DEFAULT nextval('ss1');
|
|
ALTER SEQUENCE ss1 OWNED BY deptest2.f1;
|
|
RESET SESSION AUTHORIZATION;
|
|
REASSIGN OWNED BY regression_user1 TO regression_user2;
|
|
\dt deptest
|
|
List of relations
|
|
Schema | Name | Type | Owner
|
|
--------+---------+-------+------------------
|
|
public | deptest | table | regression_user2
|
|
(1 row)
|
|
|
|
-- doesn't work: grant still exists
|
|
DROP USER regression_user1;
|
|
ERROR: role "regression_user1" cannot be dropped because some objects depend on it
|
|
DETAIL: access to table deptest1
|
|
DROP OWNED BY regression_user1;
|
|
DROP USER regression_user1;
|
|
\set VERBOSITY terse
|
|
DROP USER regression_user2;
|
|
ERROR: role "regression_user2" cannot be dropped because some objects depend on it
|
|
DROP OWNED BY regression_user2, regression_user0;
|
|
DROP USER regression_user2;
|
|
DROP USER regression_user0;
|