On Mon, Aug 29, 2022 at 10:17 AM Robert Haas <robertmh...@gmail.com> wrote: > Good catch. Thanks for the review. Committed with that correction.
Argh, I found a bug, and one that I should have caught during testing, too. I modelled the new function select_best_grantor() on is_admin_of_role(), but it differs in that it calls roles_is_member_of() with ROLERECURSE_PRIVS rather than ROLECURSE_MEMBERS. Sadly, roles_is_member_of() handles ROLERECURSE_PRIVS by completely ignoring non-inherited grants, which is wrong, because then calls to select_best_grantor() treat a member of a role with INHERIT FALSE, ADMIN TRUE is if they were not an admin at all, which is incorrect. Here is a patch to rearrange the logic slightly and also add a test case memorializing the intended behavior. Without this change, the regression test included in the patch fails like this: ERROR: no possible grantors ...which is never supposed to happen. -- Robert Haas EDB: http://www.enterprisedb.com
v1-0001-Fix-a-bug-in-roles_is_member_of.patch
Description: Binary data
