From 0112843f1b89a5931ef40d4296e03a2446617f87 Mon Sep 17 00:00:00 2001
From: Ian Barwick <ian@2ndquadrant.com>
Date: Fri, 25 Oct 2019 11:50:06 +0900
Subject: [PATCH] doc: note permission requirements for "repmgr standby
 (promote|switchover)

Per issues noted in GitHub #595.
---
 doc/repmgr-standby-promote.xml    | 21 +++++++++++++++++++++
 doc/repmgr-standby-switchover.xml | 31 +++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)

diff --git a/doc/repmgr-standby-promote.xml b/doc/repmgr-standby-promote.xml
index 50c19511..72be9595 100644
--- a/doc/repmgr-standby-promote.xml
+++ b/doc/repmgr-standby-promote.xml
@@ -86,6 +86,7 @@
   </refsect1>
 
 
+
   <refsect1>
     <title>Example</title>
     <para>
@@ -101,6 +102,26 @@
   </refsect1>
 
 
+  <refsect1>
+    <title>User permission requirements</title>
+    <para><emphasis>pg_promote() (PostgreSQL 12)</emphasis></para>
+    <para>
+      From PostgreSQL 12, &repmgr; uses the <command>pg_promote()</command> function to promote a standby
+      to primary.
+    </para>
+    <para>
+      By default, execution of <command>pg_promote()</command> is restricted to superusers.
+      If the <literal>repmgr</literal> use is not a superuser, execution permission for this
+      function must be granted with e.g.:
+      <programlisting>
+    GRANT EXECUTE ON FUNCTION pg_catalog.pg_promote TO repmgr</programlisting>
+    </para>
+    <para>
+      A future &repmgr; release will relax this restriction by falling back to
+      <command>pg_ctl promote</command>, as used for pre-PostgreSQL 12 versions.
+    </para>
+  </refsect1>
+
   <refsect1>
     <title>Options</title>
     <variablelist>
diff --git a/doc/repmgr-standby-switchover.xml b/doc/repmgr-standby-switchover.xml
index 8cf4aba5..ef56e25e 100644
--- a/doc/repmgr-standby-switchover.xml
+++ b/doc/repmgr-standby-switchover.xml
@@ -63,6 +63,37 @@
   </refsect1>
 
   <refsect1>
+    <title>User permission requirements</title>
+    <para><emphasis>CHECKPOINT</emphasis></para>
+    <para>
+      &repmgr; executes <command>CHECKPOINT</command> on the demotion candidate as part of the shutdown
+      process.
+    </para>
+    <para>
+      Note that <command>CHECKPOINT</command> requires database superuser permissions to execute.
+      If the <literal>repmgr</literal> user is not a superuser, the checkpoint operation will
+      fail, though this is not a fatal error &repmgr; will continue the switchover process.
+    </para>
+    <para><emphasis>pg_promote() (PostgreSQL 12)</emphasis></para>
+    <para>
+      From PostgreSQL 12, &repmgr; uses the <command>pg_promote()</command> function to promote a standby
+      to primary.
+    </para>
+    <para>
+      By default, execution of <command>pg_promote()</command> is restricted to superusers.
+      If the <literal>repmgr</literal> use is not a superuser, execution permission for this
+      function must be granted with e.g.:
+      <programlisting>
+    GRANT EXECUTE ON FUNCTION pg_catalog.pg_promote TO repmgr</programlisting>
+    </para>
+    <para>
+      A future &repmgr; release will relax this restriction by falling back to
+      <command>pg_ctl promote</command>, as used for pre-PostgreSQL 12 versions.
+    </para>
+  </refsect1>
+
+  <refsect1>
+
     <title>Options</title>
     <variablelist>