can't revoke a custom privilege

I follow an example from https://ldap2pg.readthedocs.io/en/latest/privileges/#defining-custom-privilege to define a custom privilege:

inspect query for datacl must return a rowset with two columns, the first is unused, the second is the name of grantee.

privileges:
  my_grant_all_on_database_privilege:
    type: datacl
    grant: GRANT ALL ON DATABASE {database} TO {role};
    revoke:  REVOKE ALL ON DATABASE {database} FROM {role};
    inspect: SELECT 1, 'admin'; 

sync_map:
- grant:
    database: mydb
    schema: public
    privilege: my_grant_all_on_database_privilege
    role: admin

The privilege does get granted, but it can’t be revoked. My question is what would be a proper “inspect” definition in this case?

[bersace]

@ankravch oh, yes, you’re right. schema is not actually ignore. I must fix that ! Thanks for pointing it.

and now I am able to revoke my_grant_all_on_database_privilege.

Good ! 😃 I’m listing here what should be done to help other users in you’re situation. Please let me know if something is missing or wrong :

Tasks

• Fix schema not ignored in datacl privileges inspect.
• Update Cookbook about revocation of privileges.
• Detect grants on users not yet in managed roles (in dry run).

[bersace]

Ok, let’s close. @ankravch don’t hesitate to comment #251 if you find the doc is not clear enough. Thanks !