Re: Why is_admin_of_role() use ROLERECURSE_MEMBERS rather than ROLERECURSE_PRIVS?

Hi,

According to the comment in check_role_grantor():

            /*

             * Otherwise, the grantor must either have ADMIN OPTION on the role or

             * inherit the privileges of a role which does. In the former case,

             * record the grantor as the current user; in the latter, pick one of

             * the roles that is "most directly" inherited by the current role

             * (i.e. fewest "hops").

             *

             * (We shouldn't fail to find a best grantor, because we've already

             * established that the current user has permission to perform the

             * operation.)

             */

            grantorId = select_best_admin(currentUserId, roleid);

            if (!OidIsValid(grantorId))

                  elog(ERROR, "no possible grantors");

But the "no possible grantors" error can happen in my test case.

The main reason is that is_admin_of_role() and select_best_admin() use different role recurse methods.

I think they should keep consistent, maybe both use ROLERECURSE_PRIVS? Thoughts?

--

Regards,

ChangAo Chen