Add sequence USAGE privileges to information schema

The sequence USAGE privilege is sufficiently similar to the SQL
standard that it seems reasonable to show in the information schema.
Also add some compatibility notes about it on the GRANT reference
page.

diff --git a/doc/src/sgml/information_schema.sgml b/doc/src/sgml/information_schema.sgml
index d8e42e4f630780c085bd99a4858d3d55d424f5c4..df806a3c853c72c9c64fc1d27792ce5f8c178bce 100644 (file)
--- a/doc/src/sgml/information_schema.sgml
+++ b/doc/src/sgml/information_schema.sgml
@@ -3839,7 +3839,7 @@ ORDER BY c.ordinal_position;
      
       object_type
       character_data
-      COLLATION or DOMAIN or FOREIGN DATA WRAPPER or FOREIGN SERVER
+      COLLATION or DOMAIN or FOREIGN DATA WRAPPER or FOREIGN SERVER or SEQUENCE
      
 
      
@@ -5859,7 +5859,7 @@ ORDER BY c.ordinal_position;
    USAGE privileges granted on various kinds of
    objects to a currently enabled role or by a currently enabled role.
    In PostgreSQL, this currently applies to
-   collations, domains, foreign-data wrappers, and foreign servers.  There is one
+   collations, domains, foreign-data wrappers, foreign servers, and sequences.  There is one
    row for each combination of object, grantor, and grantee.
   
 
@@ -5871,6 +5871,13 @@ ORDER BY c.ordinal_position;
    object types, however, show real privileges.
   
 
+  
+   In PostgreSQL, sequences also support SELECT
+   and UPDATE privileges in addition to
+   the USAGE privilege.  These are nonstandard and therefore
+   not visible in the information schema.
+  
+
       <literal>usage_privileges</literal> Columns @@ -5918,7 +5925,7 @@ ORDER BY c.ordinal_position;             object_type       character_data-      COLLATION or DOMAIN or FOREIGN DATA WRAPPER or FOREIGN SERVER+      COLLATION or DOMAIN or FOREIGN DATA WRAPPER or FOREIGN SERVER or SEQUENCE             
diff --git a/doc/src/sgml/ref/grant.sgml b/doc/src/sgml/ref/grant.sgml

index c5edaed153ae7817c07857c97a297d6a3032871c..05f98bb6bb5085ab3bd20fb7210bb44e5ade763c 100644 (file)

--- a/doc/src/sgml/ref/grant.sgml
+++ b/doc/src/sgml/ref/grant.sgml
@@ -642,6 +642,18 @@ GRANT admins TO joe;
     translations.
    
 
+   
+    In the SQL standard, sequences only have a USAGE
+    privilege, which controls the use of the NEXT VALUE FOR
+    expression, which is equivalent to the
+    function nextval in PostgreSQL.  The sequence
+    privileges SELECT and UPDATE are
+    PostgreSQL extensions.  The application of the
+    sequence USAGE privilege to
+    the currval function is also a PostgreSQL extension (as
+    is the function itself).
+   
+
    
     Privileges on databases, tablespaces, schemas, and languages are
     PostgreSQL extensions.

diff --git a/src/backend/catalog/information_schema.sql b/src/backend/catalog/information_schema.sql

index f591f64caf74f4776c7f256a704662c3f8717a8e..c4f8f0f4eaa6bcf3cfe0ccf1a2c0b083ae1e2510 100644 (file)

--- a/src/backend/catalog/information_schema.sql
+++ b/src/backend/catalog/information_schema.sql
@@ -2212,6 +2212,43 @@ CREATE VIEW usage_privileges AS
     WHERE u_grantor.oid = srv.grantor
           AND grantee.oid = srv.grantee
           AND srv.prtype IN ('USAGE')
+          AND (pg_has_role(u_grantor.oid, 'USAGE')
+               OR pg_has_role(grantee.oid, 'USAGE')
+               OR grantee.rolname = 'PUBLIC')
+
+    UNION ALL
+
+    /* sequences */
+    SELECT CAST(u_grantor.rolname AS sql_identifier) AS grantor,
+           CAST(grantee.rolname AS sql_identifier) AS grantee,
+           CAST(current_database() AS sql_identifier) AS object_catalog,
+           CAST(n.nspname AS sql_identifier) AS object_schema,
+           CAST(c.relname AS sql_identifier) AS object_name,
+           CAST('SEQUENCE' AS character_data) AS object_type,
+           CAST('USAGE' AS character_data) AS privilege_type,
+           CAST(
+             CASE WHEN
+                  -- object owner always has grant options
+                  pg_has_role(grantee.oid, c.relowner, 'USAGE')
+                  OR c.grantable
+                  THEN 'YES' ELSE 'NO' END AS yes_or_no) AS is_grantable
+
+    FROM (
+            SELECT oid, relname, relnamespace, relkind, relowner, (aclexplode(coalesce(relacl, acldefault('r', relowner)))).* FROM pg_class
+         ) AS c (oid, relname, relnamespace, relkind, relowner, grantor, grantee, prtype, grantable),
+         pg_namespace n,
+         pg_authid u_grantor,
+         (
+           SELECT oid, rolname FROM pg_authid
+           UNION ALL
+           SELECT 0::oid, 'PUBLIC'
+         ) AS grantee (oid, rolname)
+
+    WHERE c.relnamespace = n.oid
+          AND c.relkind = 'S'
+          AND c.grantee = grantee.oid
+          AND c.grantor = u_grantor.oid
+          AND c.prtype IN ('USAGE')
           AND (pg_has_role(u_grantor.oid, 'USAGE')
                OR pg_has_role(grantee.oid, 'USAGE')
                OR grantee.rolname = 'PUBLIC');

This is the main PostgreSQL git repository.
RSS
Atom




















window.onload = function () {
	var tz_cookie = { name: 'gitweb_tz', expires: 14, path: '/' };
	onloadTZSetup('local', tz_cookie, 'datetime');
};

diff --git a/doc/src/sgml/ref/grant.sgml b/doc/src/sgml/ref/grant.sgml
index c5edaed153ae7817c07857c97a297d6a3032871c..05f98bb6bb5085ab3bd20fb7210bb44e5ade763c 100644 (file)
--- a/doc/src/sgml/ref/grant.sgml
+++ b/doc/src/sgml/ref/grant.sgml
@@ -642,6 +642,18 @@ GRANT admins TO joe;
     translations.
    
 
+   
+    In the SQL standard, sequences only have a USAGE
+    privilege, which controls the use of the NEXT VALUE FOR
+    expression, which is equivalent to the
+    function nextval in PostgreSQL.  The sequence
+    privileges SELECT and UPDATE are
+    PostgreSQL extensions.  The application of the
+    sequence USAGE privilege to
+    the currval function is also a PostgreSQL extension (as
+    is the function itself).
+   
+
    
     Privileges on databases, tablespaces, schemas, and languages are
     PostgreSQL extensions.

diff --git a/src/backend/catalog/information_schema.sql b/src/backend/catalog/information_schema.sql
index f591f64caf74f4776c7f256a704662c3f8717a8e..c4f8f0f4eaa6bcf3cfe0ccf1a2c0b083ae1e2510 100644 (file)
--- a/src/backend/catalog/information_schema.sql
+++ b/src/backend/catalog/information_schema.sql
@@ -2212,6 +2212,43 @@ CREATE VIEW usage_privileges AS
     WHERE u_grantor.oid = srv.grantor
           AND grantee.oid = srv.grantee
           AND srv.prtype IN ('USAGE')
+          AND (pg_has_role(u_grantor.oid, 'USAGE')
+               OR pg_has_role(grantee.oid, 'USAGE')
+               OR grantee.rolname = 'PUBLIC')
+
+    UNION ALL
+
+    /* sequences */
+    SELECT CAST(u_grantor.rolname AS sql_identifier) AS grantor,
+           CAST(grantee.rolname AS sql_identifier) AS grantee,
+           CAST(current_database() AS sql_identifier) AS object_catalog,
+           CAST(n.nspname AS sql_identifier) AS object_schema,
+           CAST(c.relname AS sql_identifier) AS object_name,
+           CAST('SEQUENCE' AS character_data) AS object_type,
+           CAST('USAGE' AS character_data) AS privilege_type,
+           CAST(
+             CASE WHEN
+                  -- object owner always has grant options
+                  pg_has_role(grantee.oid, c.relowner, 'USAGE')
+                  OR c.grantable
+                  THEN 'YES' ELSE 'NO' END AS yes_or_no) AS is_grantable
+
+    FROM (
+            SELECT oid, relname, relnamespace, relkind, relowner, (aclexplode(coalesce(relacl, acldefault('r', relowner)))).* FROM pg_class
+         ) AS c (oid, relname, relnamespace, relkind, relowner, grantor, grantee, prtype, grantable),
+         pg_namespace n,
+         pg_authid u_grantor,
+         (
+           SELECT oid, rolname FROM pg_authid
+           UNION ALL
+           SELECT 0::oid, 'PUBLIC'
+         ) AS grantee (oid, rolname)
+
+    WHERE c.relnamespace = n.oid
+          AND c.relkind = 'S'
+          AND c.grantee = grantee.oid
+          AND c.grantor = u_grantor.oid
+          AND c.prtype IN ('USAGE')
           AND (pg_has_role(u_grantor.oid, 'USAGE')
                OR pg_has_role(grantee.oid, 'USAGE')
                OR grantee.rolname = 'PUBLIC');