Tom Lane napsal(a):
Petr Jelinek <pjmo...@pjmodos.net> writes:
That's how it works now actually, the problem is that when you grant
something in the chain you can't revoke it anywhere else in the chain
when you are merging privileges as you proposed.
To allow that, you have to have some notion of a priority order among
the available defaults, so that you can sensibly say that A should
override B. Which is easy as long as they've got hierarchical scopes,
but that doesn't seem like a restriction that will hold good for future
extensions.
I am aware, I knew all that has been said so far at the time I sent in
the patch actually. That's why I am very skeptical about having those
future non-hierarchical filters, I just don't see a way to make it happen.
Also when you go to some insane complexity of default privileges that
don't respect your database structure then you either want to handle it
programatically as Josh said or you want to create new subroles what
have create something privilege and different default privileges instead
of hoping that the database will somehow magically do the right thing
about default acls conflicts.
--
Regards
Petr Jelinek (PJMODOS)
