Re: "grant usage on schema" confers the ability to execute all user-defined functions in that schema, with needing to grant "execute"

On Sat, Feb 12, 2022 at 8:43 PM Bryn Llewellyn <bryn(at)yugabyte(dot)com> wrote:
> I.e. three facts per row: grantee, privilege, and grantee. Then I did this:
> with c as (
> select
> proname::text as name,
> pronamespace::regnamespace::text as schema,
> aclexplode(proacl) as "aclexplode(proacl)"
> from pg_catalog.pg_proc)
> select "aclexplode(proacl)" from c
> where name = 'q' and schema = 's';
>
> This is the result:
> aclexplode(proacl)
> -----------------------------
> (1494148,0,EXECUTE,f)
> (1494148,1494148,EXECUTE,f)
> (1494148,1494150,EXECUTE,f)

`aclexplode` is a table-valued function, so you normally use it in the
FROM clause.
Here's how I use it on schemas for example:

```
select nspname as name,
nspowner::regrole::text as owner,
grantor::regrole::text,
grantee::regrole::text,
privilege_type, is_grantable
from pg_namespace
left join lateral aclexplode(nspacl) on true
where ...
order by nspname
```