When an object's owner changes between the FROM and TO databases, PGC omits GRANT statements for the former owner, even if the former owner has an explicit ACL entry in the TO database.
This affects all object types that support ownership and ACL.
Example:
FROM database:
DO $$ BEGIN
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'old_owner') THEN
CREATE ROLE old_owner WITH LOGIN PASSWORD 'old_owner';
END IF;
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'new_owner') THEN
CREATE ROLE new_owner WITH LOGIN PASSWORD 'new_owner';
END IF;
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'app_user') THEN
CREATE ROLE app_user WITH LOGIN PASSWORD 'app_user';
END IF;
END $$;
CREATE SCHEMA billing AUTHORIZATION old_owner;
CREATE TABLE billing.invoice (
id integer PRIMARY KEY
);
ALTER TABLE billing.invoice OWNER TO old_owner;
TO database:
DO $$ BEGIN
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'old_owner') THEN
CREATE ROLE old_owner WITH LOGIN PASSWORD 'old_owner';
END IF;
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'new_owner') THEN
CREATE ROLE new_owner WITH LOGIN PASSWORD 'new_owner';
END IF;
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'app_user') THEN
CREATE ROLE app_user WITH LOGIN PASSWORD 'app_user';
END IF;
END $$;
CREATE SCHEMA billing;
ALTER SCHEMA billing OWNER TO new_owner;
GRANT USAGE, CREATE ON SCHEMA billing TO old_owner;
GRANT USAGE ON SCHEMA billing TO app_user;
CREATE TABLE billing.invoice (
id integer PRIMARY KEY
);
ALTER TABLE billing.invoice OWNER TO new_owner;
GRANT SELECT, INSERT ON TABLE billing.invoice TO old_owner;
GRANT SELECT ON TABLE billing.invoice TO app_user;
Generated script:
ALTER SCHEMA billing OWNER TO new_owner;
GRANT USAGE ON SCHEMA billing TO app_user;
ALTER TABLE billing.invoice OWNER TO new_owner;
GRANT SELECT ON TABLE billing.invoice TO app_user;
-- GRANT for old_owner on schema is missing
-- GRANT for old_owner on table is missing
When an object's owner changes between the FROM and TO databases, PGC omits GRANT statements for the former owner, even if the former owner has an explicit ACL entry in the TO database.
This affects all object types that support ownership and ACL.
Example:
FROM database:
TO database:
Generated script:
-- GRANT for old_owner on schema is missing
-- GRANT for old_owner on table is missing