Robert Haas <robertmhaas@gmail.com> writes:
> ... bulk-grant could be based on object type,
> object name (with wildcard or regexp pattern), schema membership, or
> maybe other things, and I think that would be quite useful if we can
> figure out how to make it clean and elegant.
Yeah. In the end you can always write a plpgsql function that filters
on anything at all. The trick is to pick some useful subset of
functionality that can be exposed in a less messy way.
Or maybe we are going at this the wrong way? Would it be better to try
harder to support the write-a-plpgsql-function approach? I don't think
the documentation even mentions that approach, let alone provides any
concrete examples. It might be interesting to document it and see if
there are any simple things we could do to file off rough edges in doing
grants that way, rather than implementing what must ultimately be a
limited solution directly in GRANT.
regards, tom lane