dml_reworks_kaigai.4-C.patch

*** a/src/backend/catalog/aclchk.c
--- b/src/backend/catalog/aclchk.c
***************
*** 135,140 **** static AclMode pg_aclmask(AclObjectKind objkind, Oid table_oid, AttrNumber attnu
--- 135,144 ----
  
  static AclResult check_rte_privileges(RangeTblEntry *rte, bool error_on_violation);
  
+ /*
+  * External security provider hooks
+  */
+ check_relation_privileges_hook_type check_relation_privileges_hook = NULL;
  
  #ifdef ACLDEBUG
  static void
***************
*** 4730,4735 **** get_user_default_acl(GrantObjectType objtype, Oid ownerId, Oid nsp_oid)
--- 4734,4742 ----
   *	It checks access permissions for all relations listed in a range table.
   *	If violated, it raises an error or returns false depending on the 'abort'
   *	argument.
+  *	It also invokes an external security provide to check the permissions.
+  *	If it is available, both of the default PG checks and external checks
+  *	have to allow the required accesses for the relations.
   */
  AclResult
  check_relation_privileges(List *rangeTable, bool error_on_violation)
***************
*** 4746,4751 **** check_relation_privileges(List *rangeTable, bool error_on_violation)
--- 4753,4763 ----
  		if (retval != ACLCHECK_OK)
  			return retval;
  	}
+ 
+ 	/* External security provider invocation */
+ 	if (check_relation_privileges_hook)
+ 		retval = (*check_relation_privileges_hook)(rangeTable,
+ 												   error_on_violation);
  	return retval;
  }
  
*** a/src/backend/executor/execMain.c
--- b/src/backend/executor/execMain.c
***************
*** 466,471 **** InitPlan(QueryDesc *queryDesc, int eflags)
--- 466,475 ----
  	 * check anything for other RTE types (function, join, subquery, ...).
  	 * Function RTEs are checked by init_fcache when the function is prepared
  	 * for execution. Join, subquery, and special RTEs need no checks.
+ 	 *
+ 	 * If available, it also invokes an external security provider. In this
+ 	 * case, both of the default PG checks and the external checks have to
+ 	 * allow the required accesses on the relation
  	 */
  	check_relation_privileges(rangeTable, true);
  
*** a/src/include/utils/acl.h
--- b/src/include/utils/acl.h
***************
*** 196,201 **** typedef enum AclObjectKind
--- 196,216 ----
  	MAX_ACL_KIND				/* MUST BE LAST */
  } AclObjectKind;
  
+ /*
+  * External security provider hooks
+  */
+ 
+ /*
+  * check_relation_privileges_hook
+  *	It allows an ESP to get control at check_relation_privileges().
+  *	A list of RangeTblEntry to be referenced and a flag to inform preferable
+  *	bahavior on access violations.
+  *	The ESP shall return ACLCHECK_OK if it allows the required access.
+  *	Elsewhere, it raises an error or return other AclResult status depending
+  *	on the given flag.
+  */
+ typedef AclResult (*check_relation_privileges_hook_type)(List *, bool);
+ extern PGDLLIMPORT check_relation_privileges_hook_type check_relation_privileges_hook;
  
  /*
   * routines used internally