Re: Why no pg_has_role(..., 'ADMIN')?
Tom Lane <tgl@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Laurenz Albe <laurenz.albe@cybertec.at>,
Dominique Devienne <ddevienne@gmail.com>, pgsql-general@postgresql.org
Date: 2024-09-20T18:34:27Z
Lists: pgsql-general
I wrote:
> Robert Haas <robertmhaas@gmail.com> writes:
>> I think this already exists. The full list of modes supported by
>> pg_has_role() is listed in convert_role_priv_string(). You can do
>> something like pg_has_role('alice', 'USAGE WITH ADMIN OPTION'). This
>> is not new: it worked in older releases too, but AFAIK it's never been
>> mentioned in the documentation.
> Surely that's a bad documentation omission.
Actually, it's not true that it's entirely undocumented, because the
text above the table that describes pg_has_role mentions
Optionally, WITH GRANT OPTION can be added to a privilege type to
test whether the privilege is held with grant option.
But I concur that it's not immediately obvious that that applies
to role membership, since we don't use the "grant option" terminology
for roles.
I'm now inclined to add wording within the pg_has_role entry, along
the lines of
WITH ADMIN OPTION or WITH GRANT OPTION can be added to any of
these privilege types to test whether ADMIN privilege is held
(all six spellings test the same thing).
regards, tom lane
Commits
-
Doc: explain how to test ADMIN privilege with pg_has_role().
- cf9f6b468862 14.14 landed
- a47ad3a42ddd 17.0 landed
- a2ebf3274a43 18.0 landed
- 8e16522163ef 16.5 landed
- 77930c5e92d9 13.17 landed
- 23d44397321f 15.9 landed
- 0ce8008386ca 12.21 landed