Re: fixing CREATEROLE - Mailing list pgsql-hackers

From Robert Haas
Subject Re: fixing CREATEROLE
Date
Msg-id CA+TgmoaKAZpimXTAPq8_vQzE2kcrq1yZ6Tm-aQ5uZWcCgWy_Fg@mail.gmail.com
Whole thread Raw
In response to Re: fixing CREATEROLE  (Robert Haas <robertmhaas@gmail.com>)
Responses Re: fixing CREATEROLE
List pgsql-hackers
On Thu, May 1, 2025 at 2:22 PM Robert Haas <robertmhaas@gmail.com> wrote:
> > The other approach would be to do what we do for the role options and just specify everything explicitly in the
dump. The GUC is only a default specifier so let's not leave room for defaults in the dump file. 
>
> +1 for considering that option, although I am not sure which way is better.

Actually, on further reflection, this doesn't work, right? I mean,
role properties are things where you mention them when creating or
altering the role, like SUPERUSER or NOSUPERUSER. So you can always
specify all of them and thereby avoid relying on defaults. But that
doesn't work here, because in this case we're talking about whether or
not a completely separate object, namely a GRANT, gets created or not.
createrole_self_grant causes that to happen, and there's nothing you
can say as part of the CREATE ROLE command itself to make it not
happen. So it seems like the only real fix is to do as Tom proposes:

# But don't we need to add
# createrole_self_grant to the set of GUCs that pg_dump[all]
# resets in the emitted SQL?

--
Robert Haas
EDB: http://www.enterprisedb.com



pgsql-hackers by date:

Previous
From: Amit Kapila
Date:
Subject: Re: Questions about logicalrep_worker_launch()
Next
From: Devrim Gündüz
Date:
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER