function permissions question

["Greg Steffensen" <greg.steffensen@xxxxxxxxx>]

Hey, I'm slightly confused about how the permission checking is done
when executing functions.  Basically, users that I've never granted
execution permissions to are able to execute functions.  Basically,
why does this script (which I've tested on a fresh db, executing via
psql as a superuser) succeed:

--------------
CREATE SCHEMA testschema;

CREATE FUNCTION testschema.testfunc()
  RETURNS character varying AS
$BODY$SELECT 'foobar'::varchar;$BODY$
  LANGUAGE 'sql' VOLATILE;

CREATE USER testuser;

GRANT USAGE ON SCHEMA testschema TO testuser;

SET SESSION AUTHORIZATION testuser;

SELECT testschema.testfunc();
------------------

But permission checking works the way I thought it was supposed to
when dealing with tables, like when I execute this instead, and get a
permissions failure:

-----------------
CREATE SCHEMA testschema;

CREATE TABLE testschema.testtable (testcolumn VARCHAR);

CREATE USER testuser;

GRANT USAGE ON SCHEMA testschema TO testuser;

SET SESSION AUTHORIZATION testuser;

SELECT * FROM testschema.testtable;
----------------

Any help is greatly appreciated.  Thanks,

Greg

---------------------------(end of broadcast)---------------------------
TIP 9: In versions below 8.0, the planner will ignore your desire to
       choose an index scan if your joining column's datatypes do not
       match