Re: GRANT ON ALL IN schema

--On Mittwoch, Juni 17, 2009 16:44:53 +0300 Peter Eisentraut
<peter_e(at)gmx(dot)net> wrote:

> I think you should design this with a bit wider scope. Instead of just
> "all tables in this schema", think "all tables satisfying some
> condition". It has been requested, for example, to be able to grant on
> all tables that match a pattern.
>

My experience shows that having such a thing is often leading to "bad
practices". People tend to grant everything to every login role instead of
using an intelligent role privilege mechanism.

MySQL for example has such wildcards (using '_' and '%' wildcard patterns),
which often confuses people when having such characters in their
table/database names (of course, i forgot to escape them more than once).
The unpredictable results of messing up a complete schema when using a
broken pattern expression is going to reduce the usefulness of such a
feature, i think.

>> Also since this patch introduces VIEWS as object with grantable
>> privileges, I added GRANT ON VIEW foo syntax which is more or less
>> synonymous to GRANT ON TABLE foo syntax. It felt weird to have GRANT ON
>> ALL VIEWS but not GRANT ON VIEW.
>
> As far as GRANT is concerned, a view is a table, so I would omit the
> VIEW/VIEWS stuff completely.

We have ALTER VIEW now, so why don't implement the same synonym for GRANT?

--
Thanks

Bernd