让我们创建一个包含一些数据的用户和表:
CREATE ROLE admin;
CREATE TABLE employee (empno int, ename text, address text, salary int, account_number text);
INSERT INTO employee VALUES
(1, 'john' , '2 down str' , 20000, 'HDFC-22001')
, (2, 'clark' , '132 south avn', 80000, 'HDFC-23029')
, (3, 'soojie', 'Down st 17th' , 60000, 'ICICI-19022')
;
现在,让我们创建列级权限:
postgres=> \c postgres edb
You are now connected to database "postgres" as user "edb".
postgres=# grant select (empno, ename, address) on employee to admin;
GRANT
postgres=# \c postgres admin
You are now connected to database "postgres" as user "admin".
postgres=> select empno, ename, address, salary from employee;
ERROR: permission denied for table employee
postgres=> select empno, ename, address from employee;
empno | ename | address
-------+--------+---------------
1 | john | 2 down str
2 | clark | 132 south avn
3 | soojie | Down st 17th
到目前为止一切进展顺利。
但是,在 PostgreSQL 中是否可以创建一个更复杂的规则——而不是完全限制admin
用户查看salary
列,例如,返回NULL
所有行的值,而只在薪水列中显示实际值,例如ename = 'clark'
?
换句话说,不是像下面的例子一样返回错误:
postgres=> select empno, ename, address, salary from employee;
ERROR: permission denied for table employee
返回以下结果:
empno | ename | address | salary
-------+--------+---------------+--------
1 | john | 2 down str | NULL
2 | clark | 132 south avn | 80000
3 | soojie | Down st 17th | NULL
最有可能的是,这可以通过视图来完成,但我特别感兴趣的是使用如上所示的简单规则来实现这个结果。
如果可能的话,我希望能够举个例子。