[LucaCappelletti94]

sql-traits filed every GRANT ... ON FUNCTION among the table and column grants, and a REVOKE on a function left no trace because there was no recorded grant to subtract it from. A schema that revokes EXECUTE from PUBLIC on a SECURITY DEFINER function looked exactly like one that never did, and nothing could say who may call a function.

PostgreSQL starts every function with EXECUTE held by PUBLIC and by its owner, so a function's privileges have to begin at that default for a revoke to have something to take away. Each function now carries its own privileges, changed by the grants and revokes that reach it by signature, by a name only one function carries, or through ALL FUNCTIONS IN SCHEMA, and FunctionLike answers is_executable_by_public, can_execute and can_grant_execute from them. A grant on a function the schema never declares is refused under the closed world and reported by unresolved_access_references under the open world, the same way a grant on an absent table is.

This builds on apache/datafusion-sqlparser-rs#2727, which keeps the signature PostgreSQL writes in GRANT ... ON FUNCTION, so the lockfile moves sqlparser to that commit. ALTER DEFAULT PRIVILEGES still fails to parse until apache/datafusion-sqlparser-rs#2417 lands.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!