, , . GRANT . :
(= , ), "admin" .
CREATE TABLE x (...);
ALTER TABLE x OWNER to admin;
CREATE TABLE y (...);
ALTER TABLE y OWNER to admin;
"admin" . , (, "app_user" ) x , , y, GRANT :
GRANT SELECT ON x TO app_user;
GRANT SELECT, INSERT, UPDATE, DELETE ON y TO app_user;
y, x; , . , "admin" ( , "admin" CREATE TRIGGER y), SECURITY DEFINER. , "app_user" INSERT INTO y ..., , , x, "admin" :
CREATE FUNCTION my_trigger_func RETURNS trigger AS $$
BEGIN
RETURN NEW;
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;
ALTER FUNCTION my_trigger_func OWNER TO admin;
REVOKE ALL ON FUNCTION my_trigger_func FROM public;
CREATE TRIGGER my_trigger
BEFORE INSERT, UPDATE, DELETE ON y
FOR EACH ROW EXECUTE PROCEDURE my_trigger_func();
, GRANT EXECUTE : "app_user" y, , , "app_user" .
, , "app_user" x, - y. "admin" x, , , , x.