如何在postgresql中鎖定用戶未編輯的某些列

Question

如何鎖定某些列不被編輯，即使用戶有權訪問postgresql中的表的編輯權限。

Answer 1

您可以添加barfs如果禁止列被改爲觸發：

CREATE OR REPLACE FUNCTION cerberus() RETURNS trigger 
    LANGUAGE plpgsql AS 
$$BEGIN 
    IF NEW.forbiddencol IS DISTINCT FROM OLD.forbiddencol 
     AND current_user = 'luser' 
    THEN 
     RAISE EXCEPTION '"luser" must not update "forbiddencol"'; 
    END IF; 
    RETURN NEW; 
END;$$; 

CREATE TRIGGER cerberus BEFORE UPDATE OF mytable 
    FOR EACH ROW EXECUTE PROCEDURE cerberus(); 

Answer 2

PostgreSQL支持列安全性（以及行安全）

讓我們把我們有限的作用authors

create table staff (
    name text primary key, 
    salary decimal(19,4) 
); 

create role authors; 

grant select, insert, delete, update(name) on table staff to authors; 

set role authors; 

insert into staff values ('frank', 100); -- works! 

select * from staff; -- works! 

update staff set name='jim'; -- works! 

update staff set salary=999; -- permission denied