Re: [COMMITTERS] pgsql: Basic documentation for ROLEs.

Log Message:
-----------
Basic documentation for ROLEs. The user-manag chapter still needs to
be rewritten, but at least the reference pages are reasonably sane.

Modified Files:
--------------
pgsql/doc/src/sgml:
reference.sgml (r1.54 -> r1.55)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/reference.sgml.diff?r1=1.54&r2=1.55)
pgsql/doc/src/sgml/ref:
allfiles.sgml (r1.64 -> r1.65)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/allfiles.sgml.diff?r1=1.64&r2=1.65)
alter_group.sgml (r1.15 -> r1.16)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/alter_group.sgml.diff?r1=1.15&r2=1.16)
alter_user.sgml (r1.37 -> r1.38)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/alter_user.sgml.diff?r1=1.37&r2=1.38)
create_group.sgml (r1.15 -> r1.16)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/create_group.sgml.diff?r1=1.15&r2=1.16)
create_user.sgml (r1.36 -> r1.37)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/create_user.sgml.diff?r1=1.36&r2=1.37)
drop_group.sgml (r1.10 -> r1.11)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/drop_group.sgml.diff?r1=1.10&r2=1.11)
drop_user.sgml (r1.20 -> r1.21)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/drop_user.sgml.diff?r1=1.20&r2=1.21)
grant.sgml (r1.47 -> r1.48)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/grant.sgml.diff?r1=1.47&r2=1.48)
revoke.sgml (r1.33 -> r1.34)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/revoke.sgml.diff?r1=1.33&r2=1.34)
set_role.sgml (r1.1 -> r1.2)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/set_role.sgml.diff?r1=1.1&r2=1.2)
set_session_auth.sgml (r1.13 -> r1.14)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/set_session_auth.sgml.diff?r1=1.13&r2=1.14)

Added Files:
-----------
pgsql/doc/src/sgml/ref:
alter_role.sgml (r1.1)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/alter_role.sgml?rev=1.1&content-type=text/x-cvsweb-markup)
create_role.sgml (r1.1)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/create_role.sgml?rev=1.1&content-type=text/x-cvsweb-markup)
drop_role.sgml (r1.1)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/drop_role.sgml?rev=1.1&content-type=text/x-cvsweb-markup)

On Tue, Jul 26, 2005 at 08:24:02PM -0300, Tom Lane wrote:

> Basic documentation for ROLEs. The user-manag chapter still needs to
> be rewritten, but at least the reference pages are reasonably sane.

I just noticed the "createuser" and "dropuser" pages may need
adjustments as well ... are you still working on this?

Also, I don't know if you handled it already, but maybe those programs
should be able to cope with creating roles/users with or without LOGIN.

--
Alvaro Herrera (<alvherre[a]alvh.no-ip.org>)
"Industry suffers from the managerial dogma that for the sake of stability
and continuity, the company should be independent of the competence of
individual employees." (E. Dijkstra)

Alvaro Herrera <alvherre(at)alvh(dot)no-ip(dot)org> writes:
> I just noticed the "createuser" and "dropuser" pages may need
> adjustments as well ... are you still working on this?

The programs themselves need adjustment, too :-(. I have a TODO note
to look at them, but would be grateful if someone else could take a
whack at it. (dropuser probably doesn't really need anything, but
createuser should expose all the interesting options.)

regards, tom lane

On Thu, Jul 28, 2005 at 01:59:10PM -0400, Tom Lane wrote:
> Alvaro Herrera <alvherre(at)alvh(dot)no-ip(dot)org> writes:
> > I just noticed the "createuser" and "dropuser" pages may need
> > adjustments as well ... are you still working on this?
>
> The programs themselves need adjustment, too :-(. I have a TODO note
> to look at them, but would be grateful if someone else could take a
> whack at it.

I'll take a look.

Would you post your whole to-do list for roles?

Also, what do we have in the open items list? The current list at
http://candle.pha.pa.us/cgi-bin/pgopenitems is outdated. I'd correct it
as:

Done:
integrated auto-vacuum (Alvaro)
fix pg_autovacuum O(n^2) behavior
shared dependency (Alvaro)
interval improvements (Michael Glaesemann)

Not going to happen in 8.1 AFAIK:
column-level triggers (Greg)
config file I/O? (Andreas)
table partitioning (Simon)
concurrent vacuum (Hannu)
add better control over partial page writes

Patch awaiting review:
ICU locale patch (Palle)
Win32 signal handling patch (Magnus)
dbsize functions from /contrib? (Andreas)
COPY performance improvements (greenplum)
move /contrib/reindexdb into main tree?
misc autovacuum enhancements

Unknown (to me) status:
terminate backend fix?
fix pg_dump --clean for roles
WAL improvements (Simon)
backpatch E'' to 8.0.X, 7.X?

--
Alvaro Herrera (<alvherre[a]alvh.no-ip.org>)
"Porque francamente, si para saber manejarse a uno mismo hubiera que
rendir examen... ¿Quién es el machito que tendría carnet?" (Mafalda)

Alvaro Herrera <alvherre(at)alvh(dot)no-ip(dot)org> writes:
> Would you post your whole to-do list for roles?

This is more or less verbatim (now you know what kind of notes I keep):

Do we want ROLE to be GUC_REPORT?

Should RESET ALL reset ROLE??

Got some problems with rolling back SET SESSION AUTH (won't restore prior SET
ROLE if any) and with rolling back an xact in which both were set (order
dependence, though I think net effect is same as above).

createuser script needs enhancement? dropuser?

do we need a bigger is_member cache?

shouldn't this work:
regression=# create role r;
CREATE ROLE
regression=# grant r to public;
ERROR: role "public" does not exist
Not clear how this squares with rules against circular grants though;
don't we want to act as though public is granted to every role?

Should has_role(foo, PUBLIC) always succeed? If so could probably eliminate a
couple of special cases in information_schema.

information_schema still needs a look, particularly role_column_grants

pg_dumpall support
Need ON DELETE pg_shadow rule for existing dump files??
There's a DELETE FROM pg_group too :-(

what is the grantor col in pg_auth_members really for? Either we
don't need it or we're failing to follow semantics. Shouldn't
revoking admin option result in tracing and revoking all grants
from that grantor?

DOCS ...
note samerole addition to pg_hba.conf
tutorial/syscat.source

regression tests?

Add new \d displays in psql?

> Also, what do we have in the open items list? The current list at
> http://candle.pha.pa.us/cgi-bin/pgopenitems is outdated.

That is Bruce's bailiwick. He told me yesterday that he was intending
to update it for 8.1 before leaving for OSCON.

regards, tom lane

Alvaro Herrera wrote:
> On Thu, Jul 28, 2005 at 01:59:10PM -0400, Tom Lane wrote:
> > Alvaro Herrera <alvherre(at)alvh(dot)no-ip(dot)org> writes:
> > > I just noticed the "createuser" and "dropuser" pages may need
> > > adjustments as well ... are you still working on this?
> >
> > The programs themselves need adjustment, too :-(. I have a TODO note
> > to look at them, but would be grateful if someone else could take a
> > whack at it.
>
> I'll take a look.
>
> Would you post your whole to-do list for roles?
>
> Also, what do we have in the open items list? The current list at
> http://candle.pha.pa.us/cgi-bin/pgopenitems is outdated. I'd correct it
> as:

I have just loaded the patches list with all outstanding patches that
need consideration, and updated the open items list:

http://momjian.postgresql.org/cgi-bin/pgpatches
http://momjian.postgresql.org/cgi-bin/pgopenitems

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

I have just loaded the patches list with all outstanding patches that
need consideration, and updated the open items list:

http://momjian.postgresql.org/cgi-bin/pgpatches
http://momjian.postgresql.org/cgi-bin/pgopenitems

We will need to make some decisions on that goes into 8.1.

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

On Sat, Jul 30, 2005 at 12:19:41AM -0400, Bruce Momjian wrote:

> I have just loaded the patches list with all outstanding patches that
> need consideration, and updated the open items list:
>
> http://momjian.postgresql.org/cgi-bin/pgpatches
> http://momjian.postgresql.org/cgi-bin/pgopenitems

The main "shared dependency" patch is applied. I still owe a patch to
implement "DROP OWNED" and "REASSIGN OWNED", to drop or give away
objects owned by a list of roles.

--
Alvaro Herrera (<alvherre[a]alvh.no-ip.org>)
"Crear es tan difícil como ser libre" (Elsa Triolet)

Bruce,

some of the items on your patches list don't seem to contain patches ...

In particular,

. the thread "multibyte regression tests" - If you like you can put a
TODO on the list and put my name against it, but I won't be getting to
it any time soon, and nobody else has done any work on it AFAIK.
. the thread "windows regression failure - prepared xacts" - in another
thread here:
http://archives.postgresql.org/pgsql-hackers/2005-07/msg00621.php Tom
proposed a possible cause for the problem seen (race conditions in
is_visible() and friends) and several possible solutions, but I am not
sure we ever resolved the issue, did we?

cheers

andrew

Bruce Momjian wrote:

>I have just loaded the patches list with all outstanding patches that
>need consideration, and updated the open items list:
>
> http://momjian.postgresql.org/cgi-bin/pgpatches
> http://momjian.postgresql.org/cgi-bin/pgopenitems
>
>We will need to make some decisions on that goes into 8.1.
>
>
>

Andrew Dunstan wrote:
>
>
> Bruce,
>
> some of the items on your patches list don't seem to contain patches ...

Right, some are open items, but the patches list is a central place to
put everything.

> In particular,
>
> . the thread "multibyte regression tests" - If you like you can put a
> TODO on the list and put my name against it, but I won't be getting to
> it any time soon, and nobody else has done any work on it AFAIK.

OK, I will move that entire thread to the 8.2 queue.

> . the thread "windows regression failure - prepared xacts" - in another
> thread here:
> http://archives.postgresql.org/pgsql-hackers/2005-07/msg00621.php Tom
> proposed a possible cause for the problem seen (race conditions in
> is_visible() and friends) and several possible solutions, but I am not
> sure we ever resolved the issue, did we?

No idea. Once we have more information we can remove it and either fix
it or document it as a TODO.

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

Andrew Dunstan <andrew(at)dunslane(dot)net> writes:
> . the thread "windows regression failure - prepared xacts" - in another
> thread here:
> http://archives.postgresql.org/pgsql-hackers/2005-07/msg00621.php Tom
> proposed a possible cause for the problem seen (race conditions in
> is_visible() and friends) and several possible solutions, but I am not
> sure we ever resolved the issue, did we?

AFAIK the regression test failure has not recurred since I tweaked the
\d query issued by psql, but the question of whether we want to make a
semantic change in is_visible() is still open.

regards, tom lane

Tom Lane wrote:
> Andrew Dunstan <andrew(at)dunslane(dot)net> writes:
> > . the thread "windows regression failure - prepared xacts" - in another
> > thread here:
> > http://archives.postgresql.org/pgsql-hackers/2005-07/msg00621.php Tom
> > proposed a possible cause for the problem seen (race conditions in
> > is_visible() and friends) and several possible solutions, but I am not
> > sure we ever resolved the issue, did we?
>
> AFAIK the regression test failure has not recurred since I tweaked the
> \d query issued by psql, but the question of whether we want to make a
> semantic change in is_visible() is still open.

OK, thread removed. If there is a TODO, let me know.

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

Can I have a TODO item for this?

---------------------------------------------------------------------------

Alvaro Herrera wrote:
> On Sat, Jul 30, 2005 at 12:19:41AM -0400, Bruce Momjian wrote:
>
> > I have just loaded the patches list with all outstanding patches that
> > need consideration, and updated the open items list:
> >
> > http://momjian.postgresql.org/cgi-bin/pgpatches
> > http://momjian.postgresql.org/cgi-bin/pgopenitems
>
> The main "shared dependency" patch is applied. I still owe a patch to
> implement "DROP OWNED" and "REASSIGN OWNED", to drop or give away
> objects owned by a list of roles.
>
> --
> Alvaro Herrera (<alvherre[a]alvh.no-ip.org>)
> "Crear es tan dif?cil como ser libre" (Elsa Triolet)
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Have you searched our list archives?
>
> http://archives.postgresql.org
>

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

On Fri, Aug 12, 2005 at 09:53:59PM -0400, Bruce Momjian wrote:
>
> Can I have a TODO item for this?

Something like "ease dropping roles which have dependencies spilt over
several databases" ... ?

> Alvaro Herrera wrote:
> > On Sat, Jul 30, 2005 at 12:19:41AM -0400, Bruce Momjian wrote:
> >
> > > I have just loaded the patches list with all outstanding patches that
> > > need consideration, and updated the open items list:
> > >
> > > http://momjian.postgresql.org/cgi-bin/pgpatches
> > > http://momjian.postgresql.org/cgi-bin/pgopenitems
> >
> > The main "shared dependency" patch is applied. I still owe a patch to
> > implement "DROP OWNED" and "REASSIGN OWNED", to drop or give away
> > objects owned by a list of roles.

--
Alvaro Herrera (<alvherre[a]alvh.no-ip.org>)
Major Fambrough: You wish to see the frontier?
John Dunbar: Yes sir, before it's gone.

Added to TODO:

* Simplify dropping roles that have objects in several databases

---------------------------------------------------------------------------

Alvaro Herrera wrote:
> On Fri, Aug 12, 2005 at 09:53:59PM -0400, Bruce Momjian wrote:
> >
> > Can I have a TODO item for this?
>
> Something like "ease dropping roles which have dependencies spilt over
> several databases" ... ?
>
> > Alvaro Herrera wrote:
> > > On Sat, Jul 30, 2005 at 12:19:41AM -0400, Bruce Momjian wrote:
> > >
> > > > I have just loaded the patches list with all outstanding patches that
> > > > need consideration, and updated the open items list:
> > > >
> > > > http://momjian.postgresql.org/cgi-bin/pgpatches
> > > > http://momjian.postgresql.org/cgi-bin/pgopenitems
> > >
> > > The main "shared dependency" patch is applied. I still owe a patch to
> > > implement "DROP OWNED" and "REASSIGN OWNED", to drop or give away
> > > objects owned by a list of roles.
>
> --
> Alvaro Herrera (<alvherre[a]alvh.no-ip.org>)
> Major Fambrough: You wish to see the frontier?
> John Dunbar: Yes sir, before it's gone.
>

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073