PostgeSQL: Verify user privileges - database

Question

How can I verify the privileges after granting the following to the read_only_user?
alter default privileges for role read_only_user grant all on tables to foodapp;

Answer 1

You can run this query to get default privileges:
SELECT
defaclrole::regrole,
defaclnamespace::regnamespace,
CASE defaclobjtype
WHEN 'r' THEN 'relation'
WHEN 'S' THEN 'sequence'
WHEN 'f' THEN 'function'
WHEN 'T' THEN 'type'
WHEN 'n' THEN 'schema'
END,
(aclexplode(defaclacl)).*
FROM pg_default_acl;
And then add a WHERE clause for the user if you want to filter it.
Or in psql you can use:
\\ddp

Answer 2

Your question is seems interesting. I'm mentioning some ways below please read carefully and try it in your system. Some of them might help you. :)
You can do that by following:
In One line
postgres=> \l
This command will display the information you're looking for.
like this.
postgres=> \l
List of databases
Name | Owner | Encoding | Collate | Ctype | Access privileges
-----------+----------+----------+-------------+-------------+-----------------------
postgres | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 |
template0 | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 | =c/postgres +
| | | | | postgres=CTc/postgres
template1 | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 | =c/postgres +
| | | | | postgres=CTc/postgres
The docs on Privileges give an explanation of how to interpret the output. For specific privileges on a table of the current database, use \z myTable.
Undercovers psql uses the bellow query when you issue \du command.
SELECT r.rolname, r.rolsuper, r.rolinherit,
r.rolcreaterole, r.rolcreatedb, r.rolcanlogin,
r.rolconnlimit, r.rolvaliduntil,
ARRAY(SELECT b.rolname
FROM pg_catalog.pg_auth_members m
JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
WHERE m.member = r.oid) as memberof
, r.rolreplication
, r.rolbypassrls
FROM pg_catalog.pg_roles r
WHERE r.rolname !~ '^pg_'
ORDER BY 1;
In the case of the table.
SELECT grantee, privilege_type
FROM information_schema.role_table_grants
WHERE table_name='mytable'
This gives you this kind of output:
mail=# select grantee, privilege_type from information_schema.role_table_grants where table_name='aliases';
grantee | privilege_type
--------------+-----------------
mailreader | INSERT
mailreader | SELECT
mailreader | UPDATE
mailreader | DELETE
mailreader | TRUNCATE
mailreader | REFERENCES
mailreader | TRIGGER
(7 rows)
mail=#
Note that (at least under Postgres 9.4) the above will not work for materialized views.
Using psql meta-commands:
https://www.postgresql.org/docs/current/static/app-psql.html
Going over the page with Ctrl+F gives:
\ddp [ pattern ]
Lists default access privilege settings.
\dp [ pattern ] Lists tables, views and sequences with their
associated access privileges.
\l[+] [ pattern ] List the databases in the server and show...
access privileges.
Also mentioned above, but not found with word "privileges" on the manual page:
\du+ for roles with login and \dg+ for roles without - will have a filed "Member of" where you find roles granted to roles.
I deliberately skip function and language privileges here, found in psql manual as barely manipulated (and if you do use those privileges you won't come here for advice). same for user-defined types, domains, and so on - using "+" after the meta-command will show you privileges if applicable.
A little extreme way to check the privileges is dropping the user in the transaction, e.g.:
s=# begin; drop user x;
BEGIN
Time: 0.124 ms
ERROR: role "x" cannot be dropped because some objects depend on it
DETAIL: privileges for type "SO dT"
privileges for sequence so
privileges for schema bin
privileges for table xx
privileges for table "csTest"
privileges for table tmp_x
privileges for table s1
privileges for table test
Time: 0.211 ms
s=# rollback;
ROLLBACK
Time: 0.150 ms
When the list is longer than N, (at least in 9.3), the warning with the list of privileges is collapsed, but you still can find it full in logs...