On Tue, 2024-03-12 at 01:02 +0200, Heikki Linnakangas wrote:
> test=# \c test
> > You are now connected to database "test" as user "postgres".
> > test=# REFRESH MATERIALIZED VIEW CONCURRENTLY test_mv;
> > ERROR: permission denied to create temporary tables in database "test"
> > --what??? N2
>
> That's interesting. REFRESH MATERIALIZED VIEW CONCURRENTLY uses
> temporary tables internally, which fails if the user doesn't have
> permissions to create temporary tables.
>
> I guess we need to allow creating such internal temporary tables,
> despite the missing permission. That'll need some careful analysis to
> make sure we don't accidentally allow creating other temporary tables...
Wouldn't it be sufficient to document that fact, perhaps add an
error hint and require the MV owner to have TEMP on the database?
That's not an outrageous requirement, and it couldn't open any
security back doors.
Yours,
Laurenz Albe