AW: Reimplementing permission checks for rules

> What I'm thinking about doing is eliminating the "skipAcl" RTE field
> and instead adding an Oid field named something like "checkAclAs".
> The semantics of this field would be "if zero, check access 
> permissions
> for this table using the current effective userID; but if not zero,
> check access permissions as if you are this userID".  Then the rule
> rewriter would do no access permission checks of its own, but would
> set this field appropriately in RTEs that it adds to queries.  All the
> actual permissions checking would happen in one place in the executor.
> 
> Comments?  Is this a general enough mechanism, and does it fit well
> with the various setUID tricks that people are thinking about?

Sounds good, and a step in the right direction.

Andreas