docs: permission denied to reassign objects in Postgres

Author: tianzhou

content/reference/postgres/error/42501-must-be-owner-of-table-postgres.md

@@ -1,3 +1,7 @@
+---
+title: 'ERROR 42501: Must be owner of table in Postgres'
+---
+
 ## Description
 
 This error occurs when a user attempts to perform an operation that requires ownership privileges on a table, such as altering the table structure, dropping the table, or changing ownership.

content/reference/postgres/error/42501-only-roles-with-privileges-of-role-may-reassign-objects.md

@@ -0,0 +1,75 @@
+---
+title: 'ERROR 42501: Permission denied to reassign objects in Postgres'
+---
+
+## Error Message
+
+```sql
+ERROR: permission denied to reassign objects
+DETAIL: Only roles with privileges of role "source_role" may reassign objects owned by it.
+```
+
+## Description
+
+This error occurs when attempting to use `REASSIGN OWNED BY` to transfer ownership of database objects from one role to another without having the necessary privileges. The operation requires membership in both the source role (current owner) and target role (new owner).
+
+## Causes
+
+- Current user lacks membership in the source role whose objects are being reassigned
+- Current user lacks membership in the target role receiving ownership
+- Attempting to reassign objects from a superuser role without being a superuser
+- Missing inherited privileges from parent roles
+- Attempting cleanup before dropping a role without proper permissions
+
+## Solutions
+
+1. **Grant role membership for both roles**:
+
+   ```sql
+   -- As a superuser, grant both role memberships
+   GRANT source_role TO your_current_role;
+   GRANT target_role TO your_current_role;
+
+   -- Now reassign ownership
+   REASSIGN OWNED BY source_role TO target_role;
+   ```
+
+2. **Execute as superuser**:
+
+   ```sql
+   -- Connect as postgres or another superuser
+   \c database_name postgres
+
+   REASSIGN OWNED BY old_role TO new_role;
+   DROP OWNED BY old_role;  -- Drop remaining privileges
+   DROP ROLE old_role;      -- Now safe to drop role
+   ```
+
+3. **Check current role memberships**:
+
+   ```sql
+   -- View your role memberships
+   SELECT r.rolname AS role_name,
+          r1.rolname AS member_of
+   FROM pg_roles r
+   JOIN pg_auth_members m ON r.oid = m.member
+   JOIN pg_roles r1 ON m.roleid = r1.oid
+   WHERE r.rolname = current_user;
+   ```
+
+4. **Use SET ROLE if you have indirect membership**:
+
+   ```sql
+   -- If you have the role through inheritance
+   SET ROLE source_role;
+   REASSIGN OWNED BY source_role TO target_role;
+   RESET ROLE;
+   ```
+
+<HintBlock type="info">
+
+Cloud database providers typically don't allow superuser privileges. Check with your provider about their specific permission model.
+
+For more details on Postgres permission management, see [How to Manage Postgres Users and Roles](/blog/how-to-manage-postgres-users-and-roles).
+
+</HintBlock>

content/reference/postgres/error/42501-permission-denied-for-table-postgres.md

@@ -53,9 +53,10 @@ This error occurs when a user attempts to perform an operation on a table withou
    GRANT role_name TO user_name;
    ```
 
-## Prevention
+<HintBlock type="info">
 
-- Plan permission structure before creating objects
-- Use role-based access control instead of individual user permissions
-- Document permission requirements in your database schema
-- Test permissions in development environments
+Cloud database providers typically don't allow superuser privileges. Check with your provider about their specific permission model.
+
+For more details on Postgres permission management, see [How to Manage Postgres Users and Roles](/blog/how-to-manage-postgres-users-and-roles).
+
+</HintBlock>

content/reference/postgres/error/_layout.md

@@ -41,6 +41,8 @@
 
 ### [ERROR 42501: must be owner of table](/reference/postgres/error/42501-must-be-owner-of-table-postgres)
 
+### [ERROR 42501: permission denied to reassign objects](/reference/postgres/error/42501-only-roles-with-privileges-of-role-may-reassign-objects)
+
 ## Concurrency & Locking
 
 ### [ERROR 40P01: deadlock detected](/reference/postgres/error/40p01-deadlock-detected)

content/reference/postgres/error/overview.md

@@ -127,6 +127,13 @@ These errors relate to user permissions, ownership, and access control issues.
   ERROR: must be owner of table users
   ```
 
+- [**ERROR 42501**](/reference/postgres/error/42501-only-roles-with-privileges-of-role-may-reassign-objects): Permission denied to reassign objects
+
+  ```sql
+  ERROR: permission denied to reassign objects
+  DETAIL: Only roles with privileges of role "[source_role]" may reassign objects owned by it.
+  ```
+
 ## Concurrency & Locking Errors
 
 These errors occur in multi-user environments due to transaction conflicts, deadlocks, and locking issues.