From fbe475281f1111a791d2bacab06eb4490f7c93fd Mon Sep 17 00:00:00 2001 From: Ashutosh Bapat Date: Wed, 1 Jul 2026 21:34:48 +0530 Subject: [PATCH v20260703 10/14] Using GRANT ... TABLE command on a property graph Property graph can only have SELECT privilege. The privileges can be granted using GRANT ... PROPERTY GRAPH command or GRANT ... TABLE command. When privileges are granted using GRANT ... TABLE command, similar to the case of sequences, ignore the privileges other than SELECT privilege with a warning. While at it also handle missing RELKIND_PROPGRAPH in pg_class_aclmask_ext() and ExecGrant_Relation() functions. Author: Ashutosh Bapat --- src/backend/catalog/aclchk.c | 30 ++++++++++++++++++- .../expected/create_property_graph.out | 2 ++ .../regress/sql/create_property_graph.sql | 1 + 3 files changed, 32 insertions(+), 1 deletion(-) diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c index 140cd1302f5..bb102205d5c 100644 --- a/src/backend/catalog/aclchk.c +++ b/src/backend/catalog/aclchk.c @@ -1784,7 +1784,8 @@ ExecGrant_Attribute(InternalGrant *istmt, Oid relOid, const char *relname, } /* - * This processes both sequences and non-sequences. + * This processes sequences, property graphs and other relations types in + * pg_class catalog. */ static void ExecGrant_Relation(InternalGrant *istmt) @@ -1891,6 +1892,27 @@ ExecGrant_Relation(InternalGrant *istmt) this_privileges &= (AclMode) ACL_ALL_RIGHTS_SEQUENCE; } } + else if (pg_class_tuple->relkind == RELKIND_PROPGRAPH) + { + /* + * For backward compatibility, just throw a warning for + * invalid property graph permissions when using the non + * property graph GRANT syntax. + */ + if (this_privileges & ~((AclMode) ACL_ALL_RIGHTS_PROPGRAPH)) + { + /* + * Mention the object name because the user needs to know + * which operations succeeded. This is required because + * WARNING allows the command to continue. + */ + ereport(WARNING, + (errcode(ERRCODE_INVALID_GRANT_OPERATION), + errmsg("property graph \"%s\" only supports SELECT privileges", + NameStr(pg_class_tuple->relname)))); + this_privileges &= (AclMode) ACL_ALL_RIGHTS_PROPGRAPH; + } + } else { if (this_privileges & ~((AclMode) ACL_ALL_RIGHTS_RELATION)) @@ -1996,6 +2018,9 @@ ExecGrant_Relation(InternalGrant *istmt) case RELKIND_SEQUENCE: objtype = OBJECT_SEQUENCE; break; + case RELKIND_PROPGRAPH: + objtype = OBJECT_PROPGRAPH; + break; default: objtype = OBJECT_TABLE; break; @@ -3389,6 +3414,9 @@ pg_class_aclmask_ext(Oid table_oid, Oid roleid, AclMode mask, case RELKIND_SEQUENCE: acl = acldefault(OBJECT_SEQUENCE, ownerId); break; + case RELKIND_PROPGRAPH: + acl = acldefault(OBJECT_PROPGRAPH, ownerId); + break; default: acl = acldefault(OBJECT_TABLE, ownerId); break; diff --git a/src/test/regress/expected/create_property_graph.out b/src/test/regress/expected/create_property_graph.out index e9f91f77ee9..713966e8a9e 100644 --- a/src/test/regress/expected/create_property_graph.out +++ b/src/test/regress/expected/create_property_graph.out @@ -251,6 +251,8 @@ SET ROLE regress_graph_user1; GRANT SELECT ON PROPERTY GRAPH g1 TO regress_graph_user2; GRANT UPDATE ON PROPERTY GRAPH g1 TO regress_graph_user2; -- fail ERROR: invalid privilege type UPDATE for property graph +GRANT UPDATE ON TABLE g1 TO regress_graph_user2; -- warning +WARNING: property graph "g1" only supports SELECT privileges RESET ROLE; -- collation CREATE TABLE tc1 (a int, b text); diff --git a/src/test/regress/sql/create_property_graph.sql b/src/test/regress/sql/create_property_graph.sql index 08341e13a50..5325d22206e 100644 --- a/src/test/regress/sql/create_property_graph.sql +++ b/src/test/regress/sql/create_property_graph.sql @@ -197,6 +197,7 @@ ALTER PROPERTY GRAPH g1 OWNER TO regress_graph_user1; SET ROLE regress_graph_user1; GRANT SELECT ON PROPERTY GRAPH g1 TO regress_graph_user2; GRANT UPDATE ON PROPERTY GRAPH g1 TO regress_graph_user2; -- fail +GRANT UPDATE ON TABLE g1 TO regress_graph_user2; -- warning RESET ROLE; -- collation -- 2.34.1