From 2357f3932c9ef1af6ac4bd21c3a796735630dd53 Mon Sep 17 00:00:00 2001
From: Michele Cereda <cereda.michele@gmail.com>
Date: Sat, 5 Apr 2025 13:07:55 +0200
Subject: [PATCH] chore(postgresql): lock, unlock, assume roles

---
 knowledge base/postgresql.md |  2 ++
 snippets/postgres/primer.sql | 21 ++++++++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/knowledge base/postgresql.md b/knowledge base/postgresql.md
index 8bf8fb3..fdf2c93 100644
--- a/knowledge base/postgresql.md	
+++ b/knowledge base/postgresql.md	
@@ -253,6 +253,7 @@ See also [yugabyte/yugabyte-db].
 - [PostgreSQL - disabling constraints]
 - [Hashing a String to a Numeric Value in PostgreSQL]
 - [I replaced my entire tech stack with Postgres...]
+- [What does GRANT USAGE ON SCHEMA do exactly?]
 
 <!--
   Reference
@@ -293,3 +294,4 @@ See also [yugabyte/yugabyte-db].
 [postgresql: show all the privileges for a concrete user]: https://stackoverflow.com/questions/40759177/postgresql-show-all-the-privileges-for-a-concrete-user
 [what is the pg_dump command for backing up a postgresql database?]: https://www.linkedin.com/advice/3/what-pgdump-command-backing-up-postgresql-ke2ef
 [yugabyte/yugabyte-db]: https://github.com/yugabyte/yugabyte-db
+[what does grant usage on schema do exactly?]: https://stackoverflow.com/questions/17338621/what-does-grant-usage-on-schema-do-exactly
diff --git a/snippets/postgres/primer.sql b/snippets/postgres/primer.sql
index 7f55fbc..e6d1638 100644
--- a/snippets/postgres/primer.sql
+++ b/snippets/postgres/primer.sql
@@ -73,8 +73,9 @@ DROP SCHEMA IF EXISTS mundane CASCADE;
 
 -- List tables
 \d
-\dt
-\dt+
+\dt *.*
+\dt+ public.*
+SELECT * FROM information_schema.tables WHERE table_schema = 'schema_name';
 
 -- Create tables
 CREATE TABLE people (
@@ -153,6 +154,17 @@ WHERE rolname IN (
   WHERE rolvaliduntil IS NOT NULL
 );
 
+-- Lock roles
+ALTER USER adriana WITH NOLOGIN;
+REVOKE CONNECT ON DATABASE sales FROM 'bob';
+
+-- Check roles are locked
+SELECT rolcanlogin FROM pg_roles WHERE rolname='adriana';
+
+-- Unlock locked roles
+ALTER USER adriana WITH LOGIN;
+GRANT CONNECT ON DATABASE sales TO 'bob';
+
 -- Rename roles
 ALTER ROLE manager RENAME TO boss;
 
@@ -160,7 +172,10 @@ ALTER ROLE manager RENAME TO boss;
 GRANT rds_superuser TO mike;
 
 -- Assume roles for the current session
-SET ROLE admin;
+SET ROLE 'admin';
+SELECT SESSION_USER, CURRENT_USER; SET ROLE 'lucas'; SELECT SESSION_USER, CURRENT_USER; RESET ROLE;
+SET SESSION AUTHORIZATION 'sandra';
+SELECT SESSION_USER, CURRENT_USER; SET SESSION AUTHORIZATION 'thomas'; SELECT SESSION_USER, CURRENT_USER; RESET SESSION AUTHORIZATION;
 
 -- Remove role memberships from users
 REVOKE engineers FROM mike;