Issue 337: say that only what is gone is reported revoked, and that a grant the reader passed on is taken back with CASCADE

2026-10-08 22:11:16 +02:00
parent b17839a7db
commit 7f78016f07
1 changed files with 4 additions and 1 deletions
@@ -88,7 +88,10 @@ mesh-catalog pull request 143, in the `postgres` module:
 4. **Reconciled every minute, on every database.** Each grant the reader holds that is not declared is
   revoked as the role that granted it, because a superuser's revoke acts as the table's owner and
   leaves a grant made by another role holding grant option. The grants are then read back, and anything
-   the reader still holds that is not declared is reported as a failure, never as revoked. Declared
+   the reader still holds that is not declared is reported as a failure with its reason, and only what
+   the read-back shows gone is reported as revoked. If the reader was given a privilege with grant
+   option and passed it on, a plain revoke fails, and the pass revokes with `CASCADE`, which reaches only
+   the grants that came from the reader. Declared
   columns that are missing are granted. The reader's role is altered only when an attribute, a setting
   or its password has drifted, so its password is not sent every minute. `postgres_reader_grants`
   answers the last pass, by name only.