Horton

Re: allow granting CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX

Pavel Luzanov <p.luzanov@postgrespro.ru>

View thread View on postgr.es
From: Pavel Luzanov <p.luzanov@postgrespro.ru>
To: Jeff Davis <pgsql@j-davis.com>, Justin Pryzby <pryzby@telsasoft.com>
Cc: Nathan Bossart <nathandbossart@gmail.com>, pgsql-hackers@postgresql.org
Date: 2022-12-15T09:31:00Z
Lists: pgsql-hackers 
On 15.12.2022 03:18, Jeff Davis wrote:
> Right, that's what I had in mind: a user is only granted operations on
> the partitioned table, not the partitions.

It's all clear now.

> There's definitely a problem with this patch and partitioning, because
> REINDEX affects the partitions, CLUSTER is a no-op, and VACUUM/ANALYZE
> skip them.

I think the approach that Nathan implemented [1] for TOAST tables
in the latest version can be used for partitioned tables as well.
Skipping the privilege check for partitions while working with
a partitioned table. In that case we would get exactly the same behavior
as for INSERT, SELECT, etc privileges - the MAINTAIN privilege would 
work for
the whole partitioned table, but not for individual partitions.

[1] 
https://www.postgresql.org/message-id/20221215002705.GA889413%40nathanxps13

-- 
Pavel Luzanov
Postgres Professional: https://postgrespro.com

Commits

  1. Improve privilege documentation for maintenance commands.

  2. Fix cache lookup hazards introduced by ff9618e82a.

  3. Move bool parameter for vacuum_rel() to option bits.

  4. Fix MAINTAIN privileges for toast tables and partitions.

  5. Add grantable MAINTAIN privilege and pg_maintain role.