[PATCH] Report column-level error when lacking privilege

On Sun, Mar 29, 2026 at 6:07 PM Steve Chavez <steve@supabase.io> wrote:

When a role `xx` has `grant select (name) on items to xx;`, a generic
table-level error is given:

select * from items;
ERROR: permission denied for table items

With this patch, we now give:

select * from items;
ERROR: permission denied for column "id" of relation "items"

Not too fond of picking one column as a representative for the error
message. Better to say something like:

ERROR: permission denied for column subset of table items

Haven't looked but it should be doable to run a query for a given relation
and role and report for each column whether a grant is available or not;
which would be the one-stop shop for figuring out which columns at least
don't have permissions granted. The user would still have to know which
ones their query is actually using.

David J.

Hi Steve,

On Mon, Mar 30, 2026 at 6:37 AM Steve Chavez <steve@supabase.io> wrote:

Hello hackers,

When a role `xx` has `grant select (name) on items to xx;`, a generic table-level error is given:

select * from items;
ERROR: permission denied for table items

With this patch, we now give:

select * from items;
ERROR: permission denied for column "id" of relation "items"

This only when the user has column-level privileges, if it doesn't have any the same regular table-level error is given. This makes the most sense and also keeps current tests mostly the same.

* It also works for UPDATE and INSERT.
* Clears the TODO mentioned on lines
https://github.com/postgres/postgres/blob/45cdaf3665bedfbabb908bb84284f3db26781ad3/src/backend/executor/execMain.c#L691-L693
* This patch is on top of the patch mentioned on /messages/by-id/CAGRrpzYP+3zEk__KZu-a5uWySfwgRFk6eoPXKrA5AdtBTXR=ng@mail.gmail.com, which refactors the code to make it simpler to review.

I had started on this some time ago [1]/messages/by-id/CAExHW5swFANiB9JmqRoGg_Rkr+M=qh+ci_zfOtQXFT+A=+jB-A@mail.gmail.com, but couldn't finish it for
the want of time. There are some suggestions from Nathan and Tom which
may be applicable to you approach as well. I am fine if you would like
to use my patches if those help.

[1]: /messages/by-id/CAExHW5swFANiB9JmqRoGg_Rkr+M=qh+ci_zfOtQXFT+A=+jB-A@mail.gmail.com

--
Best Wishes,
Ashutosh Bapat