3 ms·
I've seen funny things happen when developers think their GRANT is doing what ALTER DEFAULT PRIVILEGES does, and a day later break production because their user
by vasco 3y ago
I've seen funny things happen when developers think their GRANT is doing what ALTER DEFAULT PRIVILEGES does, and a day later break production because their user doesn't have access to the new tables.
- _jhqp 3y agoWhat do you mean exactly? If roles have INHERIT, then doing the following works, no? * Role A creates table * GRANT A TO B; * ROLE B can read from table just like A can. Also if Role A creates new table, Role B can read that too no?
- vasco 3y agoRemove any "if" from your comment and it seems like you understood what would fail! There's more ways to make misunderstanding grant vs default privileges will create issues as well.
- _jhqp 3y agoThen I would argue for trying to centrally ensure that all roles have INHERIT in your DBs. :thinking: Doing ALTER DEFAULT PRIVILEGES could be another future footgun of it's own.
- csnweb 3y agoI think you probably don’t want the application user to inherit from the superuser you may use for migrations since some migrations require a superuser.