Re: ALTER DEFAULT PRIVILEGES FOR ROLE is broken

> Hm. I defended that restriction earlier, but it now occurs to me to
> wonder if it doesn't create a dump/reload sequencing hazard. I don't
> recall that pg_dump is aware of any particular constraints on the order
> in which it dumps privilege-grant commands. If it gets this right,
> that's mostly luck, I suspect.

For that matter, it raises a serious practical obstacle to implementing
schema-specific default privs by script, if you have to first check
whether the user in question has create privs ... something we don't
make it at all easy to do.

For 9.4, I'm going to argue that the ALTER DEFAULT PRIVs feature has
completely failed in its goal to make database permissions easier to
manage. Expect more detail on that after beta.

--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com