Re: Proposal: Role Sandboxing for Secure Impersonation - Mailing list pgsql-hackers

On 4 Dec 2024, at 17:13, Eric Hanson <eric@aquameta.com> wrote:

On Mon, Dec 2, 2024 at 10:31 AM Wolfgang Walther <walther@technowledgy.de> wrote:

Eric Hanson:
> a) Transaction ("local") Sandbox:
> - SET LOCAL ROLE alice NO RESET;

> - SET LOCAL ROLE alice WITHOUT RESET;

> c) "Guarded" Transaction/Session
> - SET [LOCAL] ROLE alice GUARDED BY reset_token;
> - RESET ROLE WITH TOKEN reset_token;

> 
> Guarded sandboxes are nice because the session can also exit the sandbox 
> if it has the token.
d) SET [LOCAL] ROLE alice WITH <password>;