Re: doc: REPACK is missing from the MAINTAIN privilege documentation

On Wed, Jul 15, 2026 at 3:59 PM Ewan Young <kdbase(dot)hack(at)gmail(dot)com> wrote:
>
> On Wed, Jul 15, 2026 at 12:02 PM Shinya Kato <shinya11(dot)kato(at)gmail(dot)com> wrote:
> >
> > Hi hackers,
> >
> > REPACK requires the MAINTAIN privilege, as its documentation states,
> > but REPACK is missing from the two places that enumerate the commands
> > MAINTAIN covers: the MAINTAIN privilege description in ddl.sgml and
> > the pg_maintain predefined role description in user-manag.sgml. This
> > looks like an oversight in commit ac58465e061, which introduced
> > REPACK.
> >
> > The attached patch adds REPACK next to CLUSTER in both places.
>
> Confirmed, and the patch looks correct to me. REPACK does require
> MAINTAIN (per repack.sgml), and ac58465e061 missed adding it to these
> lists.
>
> I went through the other places that mention MAINTAIN, and these two are
> indeed the only spots that enumerate the covered commands: grant.sgml
> just points at ddl-priv, the privilege-abbreviations table only gives
> the name/letter, and the GRANT/REVOKE synopses list MAINTAIN as a
> keyword rather than expanding it. The per-command reference pages only
> state that they require MAINTAIN. So the patch is complete. The
> sql-repack link target exists too, and putting REPACK right after
> CLUSTER reads well.
>
> +1 from me.

+1

It's also better to update the following source comment in aclchk.c.

/*
* Check if ACL_MAINTAIN is being checked and, if so, and not already set
* as part of the result, then check if the user is a member of the
* pg_maintain role, which allows VACUUM, ANALYZE, CLUSTER, REFRESH
* MATERIALIZED VIEW, REINDEX, and LOCK TABLE on all relations.
*/
if (mask & ACL_MAINTAIN &&
!(result & ACL_MAINTAIN) &&
has_privs_of_role(roleid, ROLE_PG_MAINTAIN))
result |= ACL_MAINTAIN;

Regards,

--
Fujii Masao