In commit
31eae6028eca4, some documents were not updated to show the new
capability; fix that. Also, the error message you get when CURRENT_USER
and SESSION_USER are used in a context that doesn't accept them could be
clearer about it being a problem only in those contexts; so add the
word "here".
Author: Kyotaro HORIGUCHI
His patch submission also included changes to GRANT/REVOKE, but those
seemed more controversial, so I left them out. We can reconsider these
changes later.
ALTER POLICY name ON table_name
[ RENAME TO new_name ]
- [ TO { role_name | PUBLIC } [, ...] ]
+ [ TO { role_name | PUBLIC | CURRENT_USER | SESSION_USER } [, ...] ]
[ USING ( using_expression ) ]
[ WITH CHECK ( check_expression ) ]
CREATE POLICY name ON table_name
[ FOR { ALL | SELECT | INSERT | UPDATE | DELETE } ]
- [ TO { role_name | PUBLIC } [, ...] ]
+ [ TO { role_name | PUBLIC | CURRENT_USER | SESSION_USER } [, ...] ]
[ USING ( using_expression ) ]
[ WITH CHECK ( check_expression ) ]
CREATE TABLESPACE tablespace_name
- [ OWNER user_name ]
+ [ OWNER { new_owner | CURRENT_USER | SESSION_USER } ]
LOCATION 'directory'
[ WITH ( tablespace_option = value [, ... ] ) ]
-DROP OWNED BY name [, ...] [ CASCADE | RESTRICT ]
+DROP OWNED BY { name | CURRENT_USER | SESSION_USER } [, ...] [ CASCADE | RESTRICT ]
-REASSIGN OWNED BY old_role [, ...] TO new_role
+REASSIGN OWNED BY { old_role | CURRENT_USER | SESSION_USER } [, ...]
+ TO { new_role | CURRENT_USER | SESSION_USER }
case ROLESPEC_SESSION_USER:
ereport(ERROR,
(errcode(ERRCODE_RESERVED_NAME),
- errmsg("%s cannot be used as a role name",
+ errmsg("%s cannot be used as a role name here",
"SESSION_USER"),
parser_errposition(@1)));
case ROLESPEC_CURRENT_USER:
ereport(ERROR,
(errcode(ERRCODE_RESERVED_NAME),
- errmsg("%s cannot be used as a role name",
+ errmsg("%s cannot be used as a role name here",
"CURRENT_USER"),
parser_errposition(@1)));
}
CREATE ROLE "session_user";
CREATE ROLE "user";
CREATE ROLE current_user; -- error
-ERROR: CURRENT_USER cannot be used as a role name
+ERROR: CURRENT_USER cannot be used as a role name here
LINE 1: CREATE ROLE current_user;
^
CREATE ROLE current_role; -- error
LINE 1: CREATE ROLE current_role;
^
CREATE ROLE session_user; -- error
-ERROR: SESSION_USER cannot be used as a role name
+ERROR: SESSION_USER cannot be used as a role name here
LINE 1: CREATE ROLE session_user;
^
CREATE ROLE user; -- error