Re: Making a schema "read-only" (was Unexpected message in grant/revoke script)

Thanks to Eric and Tom, I think I have got it.  Here is the function
for adding a new student, who can select anything in public and can do
anything at all in their own schema.

revoke all on schema public from public;   -- done only once
create or replace function new_student (text) returns void as $$
        declare
                t_name text;
        begin
        -- personal schema
        execute 'create role ' || $1 || ' LOGIN';
        execute 'create schema authorization ' || $1 ;

        -- public schema
        execute 'revoke all on schema public from ' || $1;
        execute 'grant usage on schema public to ' || $1;
        for t_name in select table_name from information_schema.tables
where table_schema = 'public' order by table_name loop
            raise notice 'granting select to %s on %s', $1, t_name;
            execute 'grant select on ' || t_name || ' to ' || $1;
        end loop;
    end;
$$ language plpgsql ;
select new_student ('fobar'); --etc