Information schema views for group privileges, some corrections on column

privileges.

diff --git a/doc/src/sgml/information_schema.sgml b/doc/src/sgml/information_schema.sgml
index 3936cdec490e18a6195f9997050e80aeef28e2e2..fb04ea8825f3b2ed3d2b56d0d110aac01148fa1b 100644 (file)
--- a/doc/src/sgml/information_schema.sgml
+++ b/doc/src/sgml/information_schema.sgml
@@ -1,4 +1,4 @@
-<!-- $Header: /cvsroot/pgsql/doc/src/sgml/information_schema.sgml,v 1.5 2003/06/28 20:50:07 petere Exp $ -->
+<!-- $Header: /cvsroot/pgsql/doc/src/sgml/information_schema.sgml,v 1.6 2003/06/29 15:14:41 petere Exp $ -->
 
 <chapter id="information-schema">
  <title>The Information Schema</title>
@@ -142,6 +142,52 @@
   </table>
  </sect1>
 
+ <sect1 id="infoschema-applicable-roles">
+  <title><literal>applicable_roles</literal></title>
+
+  <para>
+   The view <literal>applicable_roles</literal> identifies all groups
+   that the current user is a member of.  (A role is the same thing as
+   a group.)  Generally, it is better to use the view
+   <literal>enabled_roles</literal> instead of this one; see also
+   there.
+  </para>
+
+  <table>
+   <title><literal>applicable_roles</literal> Columns</title>
+
+   <tgroup cols="3">
+    <thead>
+     <row>
+      <entry>Name</entry>
+      <entry>Data Type</entry>
+      <entry>Description</entry>
+     </row>
+    </thead>
+
+    <tbody>
+     <row>
+      <entry><literal>grantee</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Always the name of the current user</entry>
+     </row>
+
+     <row>
+      <entry><literal>role_name</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of a group</entry>
+     </row>
+
+     <row>
+      <entry><literal>is_grantable</literal></entry>
+      <entry><type>character_data</type></entry>
+      <entry>Applies to a feature not available in PostgreSQL</entry>
+     </row>
+    </tbody>
+   </tgroup>
+  </table>
+ </sect1>
+
  <sect1 id="infoschema-check-constraints">
   <title><literal>check_constraints</literal></title>
 
@@ -268,7 +314,8 @@
    The view <literal>column_privileges</literal> identifies all
    privileges granted on columns to the current user or by the current
    user.  There is one row for each combination of column, grantor,
-   and grantee.
+   and grantee.  Privileges granted to groups are identified in the
+   view <literal>role_column_grants</literal>.
   </para>
 
   <para>
@@ -276,9 +323,13 @@
    individual columns.  Therefore, this view contains the same
    information as <literal>table_privileges</literal>, just
    represented through one row for each column in each appropriate
-   table.  But if you want to make your applications fit for possible
-   future developements, it is generally the right choice to use this
-   view instead of <literal>table_privileges</literal>.
+   table, but it only convers privilege types where column granularity
+   is possible: <literal>SELECT</literal>, <literal>INSERT</literal>,
+   <literal>UPDATE</literal>, <literal>REFERENCES</literal>.  If you
+   want to make your applications fit for possible future
+   developements, it is generally the right choice to use this view
+   instead of <literal>table_privileges</literal> if one of those
+   privilege types is concerned.
   </para>
 
   <table>
@@ -303,7 +354,7 @@
      <row>
       <entry><literal>grantee</literal</entry>
       <entry><type>sql_identifier</type></entry>
-      <entry>Name of the user that the privilege was granted to</entry>
+      <entry>Name of the user or group that the privilege was granted to</entry>
      </row>
 
      <row>
@@ -335,9 +386,8 @@
       <entry><type>character_data</type></entry>
       <entry>
        Type of the privilege: <literal>SELECT</literal>,
-       <literal>DELETE</literal>, <literal>INSERT</literal>,
-       <literal>UPDATE</literal>, <literal>REFERENCES</literal>, or
-       <literal>TRIGGER</literal>
+       <literal>INSERT</literal>, <literal>UPDATE</literal>, or
+       <literal>REFERENCES</literal>
       </entry>
      </row>
 
@@ -349,6 +399,14 @@
     </tbody>
    </tgroup>
   </table>
+
+  <para>
+   Note that the column <literal>grantee</literal> makes no
+   distinction between users and groups.  If you have users and groups
+   with the same name, there is unfortunately no way to distinguish
+   them.  A future version of PostgreSQL will possibly prohibit having
+   users and groups with the same name.
+  </para>
  </sect1>
 
  <sect1 id="infoschema-column-udt-usage">
@@ -1627,6 +1685,42 @@ ORDER BY c.ordinal_position;
   </table>
  </sect1>
 
+ <sect1 id="infoschema-enabled-roles">
+  <title><literal>enabled_roles</literal></title>
+
+  <para>
+   The view <literal>enabled_roles</literal> identifies all groups
+   that the current user is a member of.  (A role is the same thing as
+   a group.)  The difference between this view and
+   <literal>applicable_roles</literal> is that in the future there may
+   be a mechanism to enable and disable groups during a session.  In
+   that case this view identifies those groups that are currently
+   enabled.
+  </para>
+
+  <table>
+   <title><literal>enabled_roles</literal> Columns</title>
+
+   <tgroup cols="3">
+    <thead>
+     <row>
+      <entry>Name</entry>
+      <entry>Data Type</entry>
+      <entry>Description</entry>
+     </row>
+    </thead>
+
+    <tbody>
+     <row>
+      <entry><literal>role_name</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of a group</entry>
+     </row>
+    </tbody>
+   </tgroup>
+  </table>
+ </sect1>
+
  <sect1 id="infoschema-key-column-usage">
   <title><literal>key_column_usage</literal></title>
 
@@ -2066,6 +2160,334 @@ ORDER BY c.ordinal_position;
   </table>
  </sect1>
 
+ <sect1 id="infoschema-role-column-grants">
+  <title><literal>role_columns_grants</literal></title>
+
+  <para>
+   The view <literal>role_column_grants</literal> identifies all
+   privileges granted on columns to a group that the current user is a
+   member of.  Further information can be found under
+   <literal>column_privileges</literal>.
+  </para>
+
+  <table>
+   <title><literal>role_column_grants</literal> Columns</title>
+
+   <tgroup cols="3">
+    <thead>
+     <row>
+      <entry>Name</entry>
+      <entry>Data Type</entry>
+      <entry>Description</entry>
+     </row>
+    </thead>
+
+    <tbody>
+     <row>
+      <entry><literal>grantor</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the user that granted the privilege</entry>
+     </row>
+
+     <row>
+      <entry><literal>grantee</literal</entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the group that the privilege was granted to</entry>
+     </row>
+
+     <row>
+      <entry><literal>table_catalog</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the database that contains the table that contains the column (always the current database)</entry>
+     </row>
+
+     <row>
+      <entry><literal>table_schema</literal</entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the schema that contains the table that contains the column</entry>
+     </row>
+
+     <row>
+      <entry><literal>table_name</literal</entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the table that contains the column</entry>
+     </row>
+
+     <row>
+      <entry><literal>column_name</literal</entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the column</entry>
+     </row>
+
+     <row>
+      <entry><literal>privilege_type</literal</entry>
+      <entry><type>character_data</type></entry>
+      <entry>
+       Type of the privilege: <literal>SELECT</literal>,
+       <literal>INSERT</literal>, <literal>UPDATE</literal>, or
+       <literal>REFERENCES</literal>
+      </entry>
+     </row>
+
+     <row>
+      <entry><literal>is_grantable</literal></entry>
+      <entry><type>character_data</type></entry>
+      <entry><literal>YES</literal> if the privilege is grantable, <literal>NO</literal> if not</entry>
+     </row>
+    </tbody>
+   </tgroup>
+  </table>
+ </sect1>
+
+ <sect1 id="infoschema-role-routine-grants">
+  <title><literal>role_routine_grants</literal></title>
+
+  <para>
+   The view <literal>role_routine_grants</literal> identifies all
+   privileges granted on functions to a group that the current user is
+   a member of.  Further information can be found under
+   <literal>routine_privileges</literal>.
+  </para>
+
+  <table>
+   <title><literal>role_routine_grants</literal> Columns</title>
+
+   <tgroup cols="3">
+    <thead>
+     <row>
+      <entry>Name</entry>
+      <entry>Data Type</entry>
+      <entry>Description</entry>
+     </row>
+    </thead>
+
+    <tbody>
+     <row>
+      <entry><literal>grantor</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the user that granted the privilege</entry>
+     </row>
+
+     <row>
+      <entry><literal>grantee</literal</entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the group that the privilege was granted to</entry>
+     </row>
+
+     <row>
+      <entry><literal>specific_catalog</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the database containing the function (always the current database)</entry>
+     </row>
+
+     <row>
+      <entry><literal>specific_schema</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the schema containing the function</entry>
+     </row>
+
+     <row>
+      <entry><literal>specific_name</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>
+       The <quote>specific name</quote> of the function.  See <xref
+       linkend="infoschema-routines"> for more information.
+      </entry>
+     </row>
+
+     <row>
+      <entry><literal>routine_catalog</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the database containing the function (always the current database)</entry>
+     </row>
+
+     <row>
+      <entry><literal>routine_schema</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the schema containing the function</entry>
+     </row>
+
+     <row>
+      <entry><literal>routine_name</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the function (may be duplicated in case of overloading)</entry>
+     </row>
+
+     <row>
+      <entry><literal>privilege_type</literal</entry>
+      <entry><type>character_data</type></entry>
+      <entry>Always <literal>EXECUTE</literal> (the only privilege type for functions)</entry>
+     </row>
+
+     <row>
+      <entry><literal>is_grantable</literal></entry>
+      <entry><type>character_data</type></entry>
+      <entry><literal>YES</literal> if the privilege is grantable, <literal>NO</literal> if not</entry>
+     </row>
+    </tbody>
+   </tgroup>
+  </table>
+ </sect1>
+
+ <sect1 id="infoschema-role-table-grants">
+  <title><literal>role_table_grants</literal></title>
+
+  <para>
+   The view <literal>role_table_grants</literal> identifies all
+   privileges granted on tables or views to a group that the current
+   user is a member of.  Further information can be found under
+   <literal>table_privileges</literal>.
+  </para>
+
+  <table>
+   <title><literal>role_table_grants</literal> Columns</title>
+
+   <tgroup cols="3">
+    <thead>
+     <row>
+      <entry>Name</entry>
+      <entry>Data Type</entry>
+      <entry>Description</entry>
+     </row>
+    </thead>
+
+    <tbody>
+     <row>
+      <entry><literal>grantor</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the user that granted the privilege</entry>
+     </row>
+
+     <row>
+      <entry><literal>grantee</literal</entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the group that the privilege was granted to</entry>
+     </row>
+
+     <row>
+      <entry><literal>table_catalog</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the database that contains the table (always the current database)</entry>
+     </row>
+
+     <row>
+      <entry><literal>table_schema</literal</entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the schema that contains the table</entry>
+     </row>
+
+     <row>
+      <entry><literal>table_name</literal</entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the table</entry>
+     </row>
+
+     <row>
+      <entry><literal>privilege_type</literal</entry>
+      <entry><type>character_data</type></entry>
+      <entry>
+       Type of the privilege: <literal>SELECT</literal>,
+       <literal>DELETE</literal>, <literal>INSERT</literal>,
+       <literal>UPDATE</literal>, <literal>REFERENCES</literal>,
+       <literal>RULE</literal>, or <literal>TRIGGER</literal>
+      </entry>
+     </row>
+
+     <row>
+      <entry><literal>is_grantable</literal></entry>
+      <entry><type>character_data</type></entry>
+      <entry><literal>YES</literal> if the privilege is grantable, <literal>NO</literal> if not</entry>
+     </row>
+
+     <row>
+      <entry><literal>with_hierarchy</literal></entry>
+      <entry><type>character_data</type></entry>
+      <entry>Applies to a feature not available in PostgreSQL</entry>
+     </row>
+    </tbody>
+   </tgroup>
+  </table>
+ </sect1>
+
+ <sect1 id="infoschema-role-usage-grants">
+  <title><literal>role_usage_grants</literal></title>
+
+  <para>
+   The view <literal>role_usage_grants</literal> is meant to identify
+   <literal>USAGE</literal> privileges granted on various kinds of
+   objects to a group that the current user is a member of.  In
+   PostgreSQL, this currently only applies to domains, and since
+   domains do not have real privileges in PostgreSQL, this view is
+   empty.  Futher information can be found under
+   <literal>usage_privileges</literal>.  In the future, this view may
+   contain more useful information.
+  </para>
+
+  <table>
+   <title><literal>role_usage_grants</literal> Columns</title>
+
+   <tgroup cols="3">
+    <thead>
+     <row>
+      <entry>Name</entry>
+      <entry>Data Type</entry>
+      <entry>Description</entry>
+     </row>
+    </thead>
+
+    <tbody>
+     <row>
+      <entry><literal>grantor</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>In the future, the name of the user that granted the privilege</entry>
+     </row>
+
+     <row>
+      <entry><literal>grantee</literal</entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>In the future, the name of the group that the privilege was granted to</entry>
+     </row>
+
+     <row>
+      <entry><literal>object_catalog</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the database containing the object (always the current database)</entry>
+     </row>
+
+     <row>
+      <entry><literal>object_schema</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the schema containing the object</entry>
+     </row>
+
+     <row>
+      <entry><literal>object_name</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the object</entry>
+     </row>
+
+     <row>
+      <entry><literal>object_type</literal></entry>
+      <entry><type>character_data</type></entry>
+      <entry>In the future, the type of the object</entry>
+     </row>
+
+     <row>
+      <entry><literal>privilege_type</literal</entry>
+      <entry><type>character_data</type></entry>
+      <entry>Always <literal>USAGE</literal></entry>
+     </row>
+
+     <row>
+      <entry><literal>is_grantable</literal></entry>
+      <entry><type>character_data</type></entry>
+      <entry><literal>YES</literal> if the privilege is grantable, <literal>NO</literal> if not</entry>
+     </row>
+    </tbody>
+   </tgroup>
+  </table>
+ </sect1>
+
  <sect1 id="infoschema-routine-privileges">
   <title><literal>routine_privileges</literal></title>
 
@@ -2073,7 +2495,8 @@ ORDER BY c.ordinal_position;
    The view <literal>routine_privileges</literal> identifies all
    privileges granted on functions to the current user or by the
    current user.  There is one row for each combination of function,
-   grantor, and grantee.
+   grantor, and grantee.  Privileges granted to groups are identified
+   in the view <literal>role_routine_grants</literal>.
   </para>
 
   <table>
@@ -2098,7 +2521,7 @@ ORDER BY c.ordinal_position;
      <row>
       <entry><literal>grantee</literal</entry>
       <entry><type>sql_identifier</type></entry>
-      <entry>Name of the user that the privilege was granted to</entry>
+      <entry>Name of the user or group that the privilege was granted to</entry>
      </row>
 
      <row>
@@ -2154,6 +2577,14 @@ ORDER BY c.ordinal_position;
     </tbody>
    </tgroup>
   </table>
+
+  <para>
+   Note that the column <literal>grantee</literal> makes no
+   distinction between users and groups.  If you have users and groups
+   with the same name, there is unfortunately no way to distinguish
+   them.  A future version of PostgreSQL will possibly prohibit having
+   users and groups with the same name.
+  </para>
  </sect1>
 
  <sect1 id="infoschema-routines">
@@ -3147,9 +3578,10 @@ ORDER BY c.ordinal_position;
 
   <para>
    The view <literal>table_privileges</literal> identifies all
-   privileges granted on tables to the current user or by the current
-   user.  There is one row for each combination of table, grantor, and
-   grantee.
+   privileges granted on tables or views to the current user or by the
+   current user.  There is one row for each combination of table,
+   grantor, and grantee.  Privileges granted to groups are identified
+   in the view <literal>role_table_grants</literal>.
   </para>
 
   <table>
@@ -3174,7 +3606,7 @@ ORDER BY c.ordinal_position;
      <row>
       <entry><literal>grantee</literal</entry>
       <entry><type>sql_identifier</type></entry>
-      <entry>Name of the user that the privilege was granted to</entry>
+      <entry>Name of the user or group that the privilege was granted to</entry>
      </row>
 
      <row>
@@ -3201,8 +3633,8 @@ ORDER BY c.ordinal_position;
       <entry>
        Type of the privilege: <literal>SELECT</literal>,
        <literal>DELETE</literal>, <literal>INSERT</literal>,
-       <literal>UPDATE</literal>, <literal>REFERENCES</literal>, or
-       <literal>TRIGGER</literal>
+       <literal>UPDATE</literal>, <literal>REFERENCES</literal>,
+       <literal>RULE</literal>, or <literal>TRIGGER</literal>
       </entry>
      </row>
 
@@ -3220,6 +3652,14 @@ ORDER BY c.ordinal_position;
     </tbody>
    </tgroup>
   </table>
+
+  <para>
+   Note that the column <literal>grantee</literal> makes no
+   distinction between users and groups.  If you have users and groups
+   with the same name, there is unfortunately no way to distinguish
+   them.  A future version of PostgreSQL will possibly prohibit having
+   users and groups with the same name.
+  </para>
  </sect1>
 
  <sect1 id="infoschema-tables">
@@ -3459,6 +3899,85 @@ ORDER BY c.ordinal_position;
   </para>
  </sect1>
 
+ <sect1 id="infoschema-usage-privileges">
+  <title><literal>usage_privileges</literal></title>
+
+  <para>
+   The view <literal>usage_privileges</literal> is meant to identify
+   <literal>USAGE</literal> privileges granted on various kinds of
+   objects to the current user or by the current user.  In PostgreSQL,
+   this currently only applies to domains, and since domains do not
+   have real privileges in PostgreSQL, this view shows implicit
+   <literal>USAGE</literal> privileges granted to
+   <literal>PUBLIC</literal> for all domains.  In the future, this
+   view may contain more useful information.
+  </para>
+
+  <table>
+   <title><literal>usage_privileges</literal> Columns</title>
+
+   <tgroup cols="3">
+    <thead>
+     <row>
+      <entry>Name</entry>
+      <entry>Data Type</entry>
+      <entry>Description</entry>
+     </row>
+    </thead>
+
+    <tbody>
+     <row>
+      <entry><literal>grantor</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Currently set to the name of the owner of the object</entry>
+     </row>
+
+     <row>
+      <entry><literal>grantee</literal</entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Currently always <literal>PUBLIC</literal></entry>
+     </row>
+
+     <row>
+      <entry><literal>object_catalog</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the database containing the object (always the current database)</entry>
+     </row>
+
+     <row>
+      <entry><literal>object_schema</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the schema containing the object</entry>
+     </row>
+
+     <row>
+      <entry><literal>object_name</literal></entry>
+      <entry><type>sql_identifier</type></entry>
+      <entry>Name of the object</entry>
+     </row>
+
+     <row>
+      <entry><literal>object_type</literal></entry>
+      <entry><type>character_data</type></entry>
+      <entry>Currently always <literal>DOMAIN</literal></entry>
+     </row>
+
+     <row>
+      <entry><literal>privilege_type</literal</entry>
+      <entry><type>character_data</type></entry>
+      <entry>Always <literal>USAGE</literal></entry>
+     </row>
+
+     <row>
+      <entry><literal>is_grantable</literal></entry>
+      <entry><type>character_data</type></entry>
+      <entry>Currently always <literal>NO</literal></entry>
+     </row>
+    </tbody>
+   </tgroup>
+  </table>
+ </sect1>
+
  <sect1 id="infoschema-view-column-usage">
   <title><literal>view_column_usage</literal></title>
 

diff --git a/src/backend/catalog/information_schema.sql b/src/backend/catalog/information_schema.sql
index cc73d5da01442e29ebe1c57e8ba452304184adc0..19acb61757d9d3b1d915f0ea55dad86598de91de 100644 (file)
--- a/src/backend/catalog/information_schema.sql
+++ b/src/backend/catalog/information_schema.sql
@@ -4,7 +4,7 @@
  *
  * Copyright 2003, PostgreSQL Global Development Group
  *
- * $Id: information_schema.sql,v 1.11 2003/06/29 10:18:26 petere Exp $
+ * $Id: information_schema.sql,v 1.12 2003/06/29 15:14:41 petere Exp $
  */
 
 /*
@@ -75,6 +75,24 @@ CREATE DOMAIN time_stamp AS timestamp(2)
     DEFAULT current_timestamp(2);
 
 
+/*
+ * 20.9
+ * APPLICABLE_ROLES view
+ */
+
+CREATE VIEW applicable_roles AS
+    SELECT CAST(current_user AS sql_identifier) AS grantee,
+           CAST(g.groname AS sql_identifier) AS role_name,
+           CAST('NO' AS character_data) AS is_grantable
+
+    FROM pg_group g, pg_user u
+
+    WHERE u.usesysid = ANY (g.grolist)
+          AND u.usename = current_user;
+
+GRANT SELECT ON applicable_roles TO PUBLIC;
+
+
 /*
  * 20.13
  * CHECK_CONSTRAINTS view
@@ -137,7 +155,7 @@ GRANT SELECT ON column_domain_usage TO PUBLIC;
 
 CREATE VIEW column_privileges AS
     SELECT CAST(u_grantor.usename AS sql_identifier) AS grantor,
-           CAST(u_grantee.usename AS sql_identifier) AS grantee,
+           CAST(grantee.name AS sql_identifier) AS grantee,
            CAST(current_database() AS sql_identifier) AS table_catalog,
            CAST(nc.nspname AS sql_identifier) AS table_schema,
            CAST(c.relname AS sql_identifier) AS table_name,
@@ -145,16 +163,21 @@ CREATE VIEW column_privileges AS
            CAST(pr.type AS character_data) AS privilege_type,
            CAST(
              CASE WHEN aclcontains(c.relacl,
-                                   makeaclitem(u_grantee.usesysid, 0, u_grantor.usesysid, pr.type, true))
+                                   makeaclitem(grantee.usesysid, grantee.grosysid, u_grantor.usesysid, pr.type, true))
                   THEN 'YES' ELSE 'NO' END AS character_data) AS is_grantable
 
     FROM pg_attribute a,
          pg_class c,
          pg_namespace nc,
          pg_user u_grantor,
-         (SELECT usesysid, usename FROM pg_user UNION SELECT 0, 'PUBLIC') AS u_grantee,
-         (SELECT 'SELECT' UNION SELECT 'DELETE' UNION SELECT 'INSERT' UNION SELECT 'UPDATE'
-          UNION SELECT 'REFERENCES' UNION SELECT 'TRIGGER') AS pr (type)
+         (
+           SELECT usesysid, 0, usename FROM pg_user
+           UNION
+           SELECT 0, grosysid, groname FROM pg_group
+           UNION
+           SELECT 0, 0, 'PUBLIC'
+         ) AS grantee (usesysid, grosysid, name),
+         (SELECT 'SELECT' UNION SELECT 'INSERT' UNION SELECT 'UPDATE' UNION SELECT 'REFERENCES') AS pr (type)
 
     WHERE a.attrelid = c.oid
           AND c.relnamespace = nc.oid
@@ -162,10 +185,10 @@ CREATE VIEW column_privileges AS
           AND NOT a.attisdropped
           AND c.relkind IN ('r', 'v')
           AND aclcontains(c.relacl,
-                          makeaclitem(u_grantee.usesysid, 0, u_grantor.usesysid, pr.type, false))
+                          makeaclitem(grantee.usesysid, grantee.grosysid, u_grantor.usesysid, pr.type, false))
           AND (u_grantor.usename = current_user
-               OR u_grantee.usename = current_user
-               OR u_grantee.usename = 'PUBLIC');
+               OR grantee.name = current_user
+               OR grantee.name = 'PUBLIC');
 
 GRANT SELECT ON column_privileges TO PUBLIC;
 
@@ -355,10 +378,7 @@ CREATE VIEW columns AS
                OR has_table_privilege(c.oid, 'SELECT')
                OR has_table_privilege(c.oid, 'INSERT')
                OR has_table_privilege(c.oid, 'UPDATE')
-               OR has_table_privilege(c.oid, 'DELETE')
-               OR has_table_privilege(c.oid, 'RULE')
-               OR has_table_privilege(c.oid, 'RERERENCES')
-               OR has_table_privilege(c.oid, 'TRIGGER') );
+               OR has_table_privilege(c.oid, 'RERERENCES') );
 
 GRANT SELECT ON columns TO PUBLIC;
 
@@ -609,6 +629,20 @@ GRANT SELECT ON domains TO PUBLIC;
 -- 20.27 ELEMENT_TYPES view appears later.
 
 
+/*
+ * 20.28
+ * ENABLED_ROLES view
+ */
+
+CREATE VIEW enabled_roles AS
+    SELECT CAST(g.groname AS sql_identifier) AS role_name
+    FROM pg_group g, pg_user u
+    WHERE u.usesysid = ANY (g.grolist)
+          AND u.usename = current_user;
+
+GRANT SELECT ON enabled_roles TO PUBLIC;
+
+
 /*
  * 20.30
  * KEY_COLUMN_USAGE view
@@ -761,6 +795,132 @@ CREATE VIEW referential_constraints AS
 GRANT SELECT ON referential_constraints TO PUBLIC;
 
 
+/*
+ * 20.36
+ * ROLE_COLUMN_GRANTS view
+ */
+
+CREATE VIEW role_column_grants AS
+    SELECT CAST(u_grantor.usename AS sql_identifier) AS grantor,
+           CAST(g_grantee.groname AS sql_identifier) AS grantee,
+           CAST(current_database() AS sql_identifier) AS table_catalog,
+           CAST(nc.nspname AS sql_identifier) AS table_schema,
+           CAST(c.relname AS sql_identifier) AS table_name,
+           CAST(a.attname AS sql_identifier) AS column_name,
+           CAST(pr.type AS character_data) AS privilege_type,
+           CAST(
+             CASE WHEN aclcontains(c.relacl,
+                                   makeaclitem(0, g_grantee.grosysid, u_grantor.usesysid, pr.type, true))
+                  THEN 'YES' ELSE 'NO' END AS character_data) AS is_grantable
+
+    FROM pg_attribute a,
+         pg_class c,
+         pg_namespace nc,
+         pg_user u_grantor,
+         pg_group g_grantee,
+         (SELECT 'SELECT' UNION SELECT 'INSERT' UNION SELECT 'UPDATE' UNION SELECT 'REFERENCES') AS pr (type)
+
+    WHERE a.attrelid = c.oid
+          AND c.relnamespace = nc.oid
+          AND a.attnum > 0
+          AND NOT a.attisdropped
+          AND c.relkind IN ('r', 'v')
+          AND aclcontains(c.relacl,
+                          makeaclitem(0, g_grantee.grosysid, u_grantor.usesysid, pr.type, false))
+          AND g_grantee.groname IN (SELECT role_name FROM enabled_roles);
+
+GRANT SELECT ON role_column_grants TO PUBLIC;
+
+
+/*
+ * 20.37
+ * ROLE_ROUTINE_GRANTS view
+ */
+
+CREATE VIEW role_routine_grants AS
+    SELECT CAST(u_grantor.usename AS sql_identifier) AS grantor,
+           CAST(g_grantee.groname AS sql_identifier) AS grantee,
+           CAST(current_database() AS sql_identifier) AS specific_catalog,
+           CAST(n.nspname AS sql_identifier) AS specific_schema,
+           CAST(p.proname || '_' || CAST(p.oid AS text) AS sql_identifier) AS specific_name,
+           CAST(current_database() AS sql_identifier) AS routine_catalog,
+           CAST(n.nspname AS sql_identifier) AS routine_schema,
+           CAST(p.proname AS sql_identifier) AS routine_name,
+           CAST('EXECUTE' AS character_data) AS privilege_type,
+           CAST(
+             CASE WHEN aclcontains(p.proacl,
+                                   makeaclitem(0, g_grantee.grosysid, u_grantor.usesysid, 'EXECUTE', true))
+                  THEN 'YES' ELSE 'NO' END AS character_data) AS is_grantable
+
+    FROM pg_proc p,
+         pg_namespace n,
+         pg_user u_grantor,
+         pg_group g_grantee
+
+    WHERE p.pronamespace = n.oid
+          AND aclcontains(p.proacl,
+                          makeaclitem(0, g_grantee.grosysid, u_grantor.usesysid, 'EXECUTE', false))
+          AND g_grantee.groname IN (SELECT role_name FROM enabled_roles);
+
+GRANT SELECT ON role_routine_grants TO PUBLIC;
+
+
+/*
+ * 20.38
+ * ROLE_TABLE_GRANTS view
+ */
+
+CREATE VIEW role_table_grants AS
+    SELECT CAST(u_grantor.usename AS sql_identifier) AS grantor,
+           CAST(g_grantee.groname AS sql_identifier) AS grantee,
+           CAST(current_database() AS sql_identifier) AS table_catalog,
+           CAST(nc.nspname AS sql_identifier) AS table_schema,
+           CAST(c.relname AS sql_identifier) AS table_name,
+           CAST(pr.type AS character_data) AS privilege_type,
+           CAST(
+             CASE WHEN aclcontains(c.relacl,
+                                   makeaclitem(0, g_grantee.grosysid, u_grantor.usesysid, pr.type, true))
+                  THEN 'YES' ELSE 'NO' END AS character_data) AS is_grantable,
+           CAST('NO' AS character_data) AS with_hierarchy
+
+    FROM pg_class c,
+         pg_namespace nc,
+         pg_user u_grantor,
+         pg_group g_grantee,
+         (SELECT 'SELECT' UNION SELECT 'DELETE' UNION SELECT 'INSERT' UNION SELECT 'UPDATE'
+          UNION SELECT 'REFERENCES' UNION SELECT 'RULE' UNION SELECT 'TRIGGER') AS pr (type)
+
+    WHERE c.relnamespace = nc.oid
+          AND c.relkind IN ('r', 'v')
+          AND aclcontains(c.relacl,
+                          makeaclitem(0, g_grantee.grosysid, u_grantor.usesysid, pr.type, false))
+          AND g_grantee.groname IN (SELECT role_name FROM enabled_roles);
+
+GRANT SELECT ON role_table_grants TO PUBLIC;
+
+
+/*
+ * 20.40
+ * ROLE_USAGE_GRANTS view
+ */
+
+-- See USAGE_PRIVILEGES.
+
+CREATE VIEW role_usage_grants AS
+    SELECT CAST(null AS sql_identifier) AS grantor,
+           CAST(null AS sql_identifier) AS grantee,
+           CAST(current_database() AS sql_identifier) AS object_catalog,
+           CAST(null AS sql_identifier) AS object_schema,
+           CAST(null AS sql_identifier) AS object_name,
+           CAST(null AS character_data) AS object_type,
+           CAST('USAGE' AS character_data) AS privilege_type,
+           CAST(null AS character_data) AS is_grantable
+
+    WHERE false;
+
+GRANT SELECT ON role_usage_grants TO PUBLIC;
+
+
 /*
  * 20.43
  * ROUTINE_PRIVILEGES view
@@ -768,7 +928,7 @@ GRANT SELECT ON referential_constraints TO PUBLIC;
 
 CREATE VIEW routine_privileges AS
     SELECT CAST(u_grantor.usename AS sql_identifier) AS grantor,
-           CAST(u_grantee.usename AS sql_identifier) AS grantee,
+           CAST(grantee.name AS sql_identifier) AS grantee,
            CAST(current_database() AS sql_identifier) AS specific_catalog,
            CAST(n.nspname AS sql_identifier) AS specific_schema,
            CAST(p.proname || '_' || CAST(p.oid AS text) AS sql_identifier) AS specific_name,
@@ -778,20 +938,26 @@ CREATE VIEW routine_privileges AS
            CAST('EXECUTE' AS character_data) AS privilege_type,
            CAST(
              CASE WHEN aclcontains(p.proacl,
-                                   makeaclitem(u_grantee.usesysid, 0, u_grantor.usesysid, 'EXECUTE', true))
+                                   makeaclitem(grantee.usesysid, grantee.grosysid, u_grantor.usesysid, 'EXECUTE', true))
                   THEN 'YES' ELSE 'NO' END AS character_data) AS is_grantable
 
     FROM pg_proc p,
          pg_namespace n,
          pg_user u_grantor,
-         (SELECT usesysid, usename FROM pg_user UNION SELECT 0, 'PUBLIC') AS u_grantee
+         (
+           SELECT usesysid, 0, usename FROM pg_user
+           UNION
+           SELECT 0, grosysid, groname FROM pg_group
+           UNION
+           SELECT 0, 0, 'PUBLIC'
+         ) AS grantee (usesysid, grosysid, name)
 
     WHERE p.pronamespace = n.oid
           AND aclcontains(p.proacl,
-                          makeaclitem(u_grantee.usesysid, 0, u_grantor.usesysid, 'EXECUTE', false))
+                          makeaclitem(grantee.usesysid, grantee.grosysid, u_grantor.usesysid, 'EXECUTE', false))
           AND (u_grantor.usename = current_user
-               OR u_grantee.usename = current_user
-               OR u_grantee.usename = 'PUBLIC');
+               OR grantee.name = current_user
+               OR grantee.name = 'PUBLIC');
 
 GRANT SELECT ON routine_privileges TO PUBLIC;
 
@@ -1110,31 +1276,37 @@ GRANT SELECT ON table_constraints TO PUBLIC;
 
 CREATE VIEW table_privileges AS
     SELECT CAST(u_grantor.usename AS sql_identifier) AS grantor,
-           CAST(u_grantee.usename AS sql_identifier) AS grantee,
+           CAST(grantee.name AS sql_identifier) AS grantee,
            CAST(current_database() AS sql_identifier) AS table_catalog,
            CAST(nc.nspname AS sql_identifier) AS table_schema,
            CAST(c.relname AS sql_identifier) AS table_name,
            CAST(pr.type AS character_data) AS privilege_type,
            CAST(
              CASE WHEN aclcontains(c.relacl,
-                                   makeaclitem(u_grantee.usesysid, 0, u_grantor.usesysid, pr.type, true))
+                                   makeaclitem(grantee.usesysid, grantee.grosysid, u_grantor.usesysid, pr.type, true))
                   THEN 'YES' ELSE 'NO' END AS character_data) AS is_grantable,
            CAST('NO' AS character_data) AS with_hierarchy
 
     FROM pg_class c,
          pg_namespace nc,
          pg_user u_grantor,
-         (SELECT usesysid, usename FROM pg_user UNION SELECT 0, 'PUBLIC') AS u_grantee,
+         (
+           SELECT usesysid, 0, usename FROM pg_user
+           UNION
+           SELECT 0, grosysid, groname FROM pg_group
+           UNION
+           SELECT 0, 0, 'PUBLIC'
+         ) AS grantee (usesysid, grosysid, name),
          (SELECT 'SELECT' UNION SELECT 'DELETE' UNION SELECT 'INSERT' UNION SELECT 'UPDATE'
-          UNION SELECT 'REFERENCES' UNION SELECT 'TRIGGER') AS pr (type)
+          UNION SELECT 'REFERENCES' UNION SELECT 'RULE' UNION SELECT 'TRIGGER') AS pr (type)
 
     WHERE c.relnamespace = nc.oid
           AND c.relkind IN ('r', 'v')
           AND aclcontains(c.relacl,
-                          makeaclitem(u_grantee.usesysid, 0, u_grantor.usesysid, pr.type, false))
+                          makeaclitem(grantee.usesysid, grantee.grosysid, u_grantor.usesysid, pr.type, false))
           AND (u_grantor.usename = current_user
-               OR u_grantee.usename = current_user
-               OR u_grantee.usename = 'PUBLIC');
+               OR grantee.name = current_user
+               OR grantee.name = 'PUBLIC');
 
 GRANT SELECT ON table_privileges TO PUBLIC;