* Document/trigger/rule so changes to pg_shadow recreate pg_pwd

I did it with a trigger and it seems to work like a charm. The function
that already updates the file for create and alter user has been made a
built-in "SQL" function and a trigger is created at initdb time.

Comments around the pg_pwd updating function seem to be worried about
this
routine being called concurrently, but I really don't see a reason to
worry about this. Verify for yourself. I guess we never had a system
trigger before, so treat this with care, and feel free to adjust the
nomenclature as well.

--
Peter Eisentraut                  Sernanders väg 10:115

(whoever thought world-writable files were a good default????).  Modify
the pg_pwd code so that pg_pwd is created with 600 permissions.  Modify
initdb so that permissions on a pre-existing PGDATA directory are not
blindly accepted: if the dir is already there, it does chmod go-rwx
to be sure that the permissions are OK and the dir actually is owned
by postgres.

First step in cleaning up backend initialization code.
Fix for FATAL: now FATAL is ERROR + exit.

from initdb again.

Added two new commands, createlang and destroylang to bin. These
hopefully end this damned mklang.sql discussion.

Jan

Jan

check if a rewrite rule on SELECT exists/not exists instead
of asking pg_get_viewdef() function.

Jan

    for against a just updated CVS tree. It contains

        Partial new rewrite system that handles subselects,  view
        aggregate  columns, insert into select from view, updates
        with set col = view-value and select rules restriction to
        view definition.

        Updates  for  rule/view  backparsing utility functions to
        handle subselects correct.


        New system views pg_tables and pg_indexes (where you  can
        see the complete index definition in the latter one).

        Enabling array references on query parameters.

        Bugfix for functional index.

        Little changes to system views pg_rules and pg_views.


    The rule system isn't a release-stopper any longer.

    But  another  stopper  is  that  I  don't  know if the latest
    changes to PL/pgSQL (not already in CVS) made it  compile  on
    AIX. Still wait for some response from Dave.

Jan

Here's a patch for initdb that does two things.

1) Encloses the created rulenames in quotes to preserve case
   in the creation step. (stores _RETpg... instead of _retpg...)
   I believe _RET is standard for views.

2) Renames pg_view to pg_views and pg_rule to pg_rules.
   I believe Jan and myself agreed this would be a "good idea"

Keith Parks

    patch is applied:

	Rewrite rules on relation level work fine now.

	Event qualifications on insert/update/delete  rules  work
	fine now.

	I  added  the  new  keyword  OLD to reference the CURRENT
	tuple. CURRENT will be removed in 6.5.

	Update rules can  reference  NEW  and  OLD  in  the  rule
	qualification and the actions.

	Insert/update/delete rules on views can be established to
	let them behave like real tables.

	For  insert/update/delete  rules  multiple  actions   are
	supported  now.   The  actions  can also be surrounded by
	parantheses to make psql  happy.   Multiple  actions  are
	required if update to a view requires updates to multiple
	tables.

	Regular users  are  permitted  to  create/drop  rules  on
	tables     they     have     RULE     permissions     for
	(DefineQueryRewrite() is  now  able  to  get  around  the
	access  restrictions  on  pg_rewrite).  This enables view
	creation for regular users too. This  required  an  extra
	boolean  parameter  to  pg_parse_and_plan() that tells to
	set skipAcl on all rangetable entries  of  the  resulting
	queries.       There      is      a      new     function
	pg_exec_query_acl_override()  that  could  be   used   by
	backend utilities to use this facility.

	All rule actions (not only views) inherit the permissions
	of the event relations  owner.  Sample:  User  A  creates
	tables    T1    and    T2,   creates   rules   that   log
	INSERT/UPDATE/DELETE on T1 in T2 (like in the  regression
	tests  for rules I created) and grants ALL but RULE on T1
	to user B.  User B  can  now  fully  access  T1  and  the
	logging  happens  in  T2.  But user B cannot access T2 at
	all, only the rule actions can. And due to  missing  RULE
	permissions on T1, user B cannot disable logging.

	Rules  on  the  attribute  level are disabled (they don't
	work properly and since regular users are  now  permitted
	to create rules I decided to disable them).

	Rules  on  select  must have exactly one action that is a
	select (so select rules must be a view definition).

	UPDATE NEW/OLD rules  are  disabled  (still  broken,  but
	triggers can do it).

	There are two new system views (pg_rule and pg_view) that
	show the definition of the rules or views so the db admin
	can  see  what  the  users do. They use two new functions
	pg_get_ruledef() and pg_get_viewdef() that are  builtins.

	The functions pg_get_ruledef() and pg_get_viewdef() could
	be used to implement rule and view support in pg_dump.

	PostgreSQL is now the only database system I  know,  that
	has rewrite rules on the query level. All others (where I
	found a  rule  statement  at  all)  use  stored  database
	procedures  or  the  like  (triggers as we call them) for
	active rules (as some call them).

    Future of the rule system:

	The now disabled parts  of  the  rule  system  (attribute
	level,  multiple  actions on select and update new stuff)
	require a complete new rewrite handler from scratch.  The
	old one is too badly wired up.

	After  6.4  I'll  start to work on a new rewrite handler,
	that fully supports the attribute level  rules,  multiple
	actions on select and update new.  This will be available
	for 6.5 so we get full rewrite rule capabilities.

Jan

if MULTIBYTE is not enabled. So be sure to run initdb.

o these patches are made against the latest source tree (after
Bruce's massive patch, I think) BTW, I noticed that after running
regression, the oid field of pg_type seems disappeared.

	regression=> select oid from pg_type; ERROR:  attribute
	'oid' not found

this happens after the constraints test. This occures with/without
my patches. strange...

o pg_database_mb.h, pg_class_mb.h, pg_attribute_mb.h are no longer
used, and shoud be removed.

o GetDatabaseInfo() in utils/misc/database.c removed (actually in
#ifdef 0). seems nobody uses.

t-ishii@sra.co.jp

 trouble, and the name of the shared library has been changed recently.
 Had to rerun ldconfig on my machine to get it working again.
Give an error message with a helpful hint if so...

From: t-ishii@sra.co.jp

As Bruce mentioned, this is due to the conflict among changes we made.
Included patches should fix the problem(I changed all MB to
MULTIBYTE). Please let me know if you have further problem.

P.S. I did not include pathces to configure and gram.c to save the
file size(configure.in and gram.y modified).

I missed addding initdb.sh ...

Attached you'll find a (big) patch that fixes make dep and make
depend in all Makefiles where I found it to be appropriate.

It also removes the dependency in Makefile.global for NAMEDATALEN
and OIDNAMELEN by making backend/catalog/genbki.sh and bin/initdb/initdb.sh
a little smarter.

This no longer requires initdb.sh that is turned into initdb with
a sed script when installing Postgres, hence initdb.sh should be
renamed to initdb (after the patch has been applied :-) )

This patch is against the 6.3 sources, as it took a while to
complete.

Please review and apply,

Cheers,

Jeroen van Vianen

variable that can be set in one place to affect everything...

From: Andreas Klemm <andreas@klemm.gtn.com>

    seems  that  my last post didn't make it through. That's good
    since  the  diff  itself  didn't  covered  the  renaming   of
    pg_user.h to pg_shadow.h and it's new content.

    Here  it's  again.  The  complete regression test passwd with
    only some  float  diffs.  createuser  and  destroyuser  work.
    pg_shadow cannot be read by ordinary user.

Modify psql so that it uses db_user instead of pg_user
GRANT SELECT on pg_class

Improved fix to pg_user/passwd problem...using rewrite rules

  o  A new patch that contains the following changes:
        -- The pg_pwd file is now cached in the postmaster's memory.
        -- pg_pwd is reloaded when the postmaster detects a flag file creat()'ed
           by a backend.
        -- qsort() is used to sort loaded password entries, and bsearch() is
           is used to find entries in the pg_pwd cache.
        -- backends now copy the pg_user relation to pg_pwd.pid, and then
           rename the temp file to be pg_pwd.
        -- The delimiter for pg_pwd has been changed to a tab character.

An extension to the code to allow for a pg_password authentication database
that is *seperate* from the system password file

Add pg_description table for info on tables, columns, operators, types, and aggregates.  Modify psql with new \dd operator to access description