postgresql/no-grant-all

Why this matters

`GRANT ALL` silently expands as new privileges are added to PostgreSQL — and to the object class — over time. List the privileges your callers actually need so the access surface is auditable. `REVOKE ALL` is the safe direction and is not flagged.

Examples

GRANT ALL ON t TO u;

GRANT ALL PRIVILEGES ON t TO PUBLIC;

GRANT SELECT ON t TO u;

GRANT SELECT, INSERT, UPDATE ON t TO u;

REVOKE ALL ON t FROM u; -- REVOKE ALL is the safe direction

Configure it

// eslint.config.js
import postgresql from "eslint-plugin-postgresql";

export default [
  {
    files: ["**/*.sql"],
    languageOptions: {
      parser: postgresql.configs.recommended.languageOptions.parser,
    },
    plugins: { postgresql },
    rules: {
      "postgresql/no-grant-all": "warn",
    },
  },
];

Options

This rule has no options.