You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Allow the ability to write functions which take objects (e.g. tables, schemas, functions) as parameters, with the code generated being sql or plpgsql, not stuck in an obscuring execute format(...) block where all syntax checks are lost.
Many applications of this in assemble permissions. One example:
every permissions insert has to execute a block of code similar to:
for v_level_name inselect level_name
fromassemble.table_permission_levelswhere hierarchy_position <= (
selectspl.hierarchy_positionfromassemble.table_permission_levels spl
wherespl.level_name=NEW.permission_level)
loop
if v_level_name !='none' then
execute format($q$
selectassemble.tables_grant_%s(t, %s)
fromassemble.tables t
wheret.id= %s
$q$,
v_level_name, quote_literal(NEW.role_id), quote_literal(NEW.table_id)
);
end if;
end loop;
This block needs to be in every permissions insert function for databases, schemas, tables, columns, views, forms, and groups, with the only thing changing being the name of the table. It would be safer and cleaner to have this encapsulated in a function that takes the table (or table name or regclass) as a parameter and can generate all of the blocks of code needed in a safe and syntax-checked way.
The text was updated successfully, but these errors were encountered:
Allow the ability to write functions which take objects (e.g. tables, schemas, functions) as parameters, with the code generated being sql or plpgsql, not stuck in an obscuring
execute format(...)
block where all syntax checks are lost.Many applications of this in assemble permissions. One example:
every permissions insert has to execute a block of code similar to:
This block needs to be in every permissions insert function for databases, schemas, tables, columns, views, forms, and groups, with the only thing changing being the name of the table. It would be safer and cleaner to have this encapsulated in a function that takes the table (or table name or regclass) as a parameter and can generate all of the blocks of code needed in a safe and syntax-checked way.
The text was updated successfully, but these errors were encountered: