Method getPrivilegeDefsForTables

database/postgres/database.go:1844–1890

(tableNames []string)

}

func (d *PostgresDatabase) getPrivilegeDefsForTables(tableNames []string) (map[string][]string, error) {
	// If no roles are specified to include, don't query privileges at all
	if len(d.generatorConfig.ManagedRoles) == 0 {
		return map[string][]string{}, nil
	}

	const query = `
		SELECT
			table_schema || '.' || table_name AS qualified_table_name,
			grantee,
			string_agg(privilege_type, ', ' ORDER BY privilege_type) as privileges
		FROM information_schema.table_privileges
		WHERE table_schema || '.' || table_name = ANY($1::text[])
		AND grantee = ANY($2::text[])
		AND grantee != (
			SELECT tableowner FROM pg_tables
			WHERE schemaname = table_schema AND tablename = table_name
		)
		GROUP BY table_schema, table_name, grantee
		ORDER BY table_schema, table_name, grantee
	`

	rows, err := d.db.Query(query, pq.Array(tableNames), pq.Array(d.generatorConfig.ManagedRoles))
	if err != nil {
		return nil, fmt.Errorf("failed to query privileges: %w", err)
	}
	defer rows.Close()

	result := make(map[string][]string, len(tableNames))
	for rows.Next() {
		var tableName, grantee, privileges string
		if err := rows.Scan(&tableName, &grantee, &privileges); err != nil {
			return nil, fmt.Errorf("failed to scan privilege row: %w", err)
		}

		escapedGrantee := grantee
		if grantee != "PUBLIC" {
			// PUBLIC is a special keyword and should not be quoted
			escapedGrantee = d.quoteIdentifierIfNeeded(grantee)
		}

		grant := fmt.Sprintf("GRANT %s ON TABLE %s TO %s", privileges, tableName, escapedGrantee)
		result[tableName] = append(result[tableName], grant)
	}

	return result, nil
}