Move privilege check for SET SESSION AUTHORIZATION.
authorNathan Bossart <[email protected]>
Fri, 14 Jul 2023 04:10:36 +0000 (21:10 -0700)
committerNathan Bossart <[email protected]>
Fri, 14 Jul 2023 04:10:36 +0000 (21:10 -0700)
commit9987a7bf34061ed5cffc4e5113da056358976e94
tree07fc348fd3ef1c4ddf2e99fdf0319c9b49fd6ba8
parentedca3424342da323499a1998d18a888283e52ac7
Move privilege check for SET SESSION AUTHORIZATION.

Presently, the privilege check for SET SESSION AUTHORIZATION is
performed in session_authorization's assign_hook.  A relevant
comment states, "It's OK because the check does not require catalog
access and can't fail during an end-of-transaction GUC
reversion..."  However, we plan to add a catalog lookup to this
privilege check in a follow-up commit.

This commit moves this privilege check to the check_hook for
session_authorization.  Like check_role(), we do not throw a hard
error for insufficient privileges when the source is PGC_S_TEST.

Author: Joseph Koshakow
Discussion: https://postgr.es/m/CAAvxfHc-HHzONQ2oXdvhFF9ayRnidPwK%2BfVBhRzaBWYYLVQL-g%40mail.gmail.com
src/backend/commands/variable.c
src/backend/utils/init/miscinit.c
src/include/miscadmin.h