update doc

Author: hanjianqiao

CN/modules/ROOT/pages/master/ecosystem_components/ecosystem_overview.adoc

@@ -40,7 +40,7 @@ IvorySQL 作为一款兼容 Oracle 且基于 PostgreSQL 的高级开源数据库
 | 27 | xref:master/ecosystem_components/pg_readonly.adoc[pg_readonly] | 1.0.5 | 可将 PostgreSQL 数据库集群设置为只读 | 系统调试、灾难恢复
 | 28 | xref:master/ecosystem_components/zhparser.adoc[zhparser] | master branch | 用于中文全文搜索的PostgreSQL插件，基于SCWS（即：简易中文分词系统）实现了一个中文解析器 | 搜索引擎、关键字提取
 | 29 | xref:master/ecosystem_components/pgbackrest.adoc[pgBackRest] | 2.58.0 | 可靠的 PostgreSQL 备份和恢复解决方案 | 容灾备份、大库备份、异地/多层容灾
-| 30 | xref:master/ecosystem_components/set_user.adoc[set_user] | REL4_2_0 | PostgreSQL 扩展，用于解决运维安全矛盾，确保特权操作无法逃避审计 | 数据库运维安全、权限管理、审计日志
+| 30 | xref:master/ecosystem_components/set_user.adoc[set_user] | REL4_2_0 | PostgreSQL 安全审计扩展，可控角色切换，支持白名单、强制审计、拦截高危操作 | 可控角色切换、权限管理、审计日志
 |====
 
 这些插件均经过 IvorySQL 团队的测试和适配，确保在 IvorySQL 环境下稳定运行。用户可以根据业务需求选择合适的插件，进一步提升数据库系统的能力和灵活性。

CN/modules/ROOT/pages/master/ecosystem_components/set_user.adoc

@@ -5,7 +5,7 @@
 = set_user
 
 == 概述
-set_user 是由 Crunchy Data 开发、隶属 pgaudit 项目的 PostgreSQL 扩展，用于解决一个经典的运维安全矛盾：DBA 需要超级用户权限执行维护任务，但直接发放可登录的 superuser 账号意味着权限过大且行为无从审计——原生的 SET ROLE 既不留日志，还能随手关掉日志设置、无痕切回。
+set_user 是 PostgreSQL 安全审计扩展，由 pgaudit 项目维护，优化原生角色切换能力。支持普通用户间互切，也可受控切换至超级用户；可配置白名单限定允许切换的账号，所有切换操作留存审计日志，切换到超级用户时强制完整记录 SQL，拦截修改数据库配置、调用系统命令等高风险操作，规范临时提权，满足等保合规，部署需预加载插件并重启数据库，再建扩展使用。
 
 项目地址：<https://github.com/pgaudit/set_user>
 
@@ -190,6 +190,22 @@ COPY (select 42) TO PROGRAM 'cat';
 SET log_statement = 'none';
 --- ERROR:  "SET log_statement" blocked by set_user config
 
+--- 恢复初始用户
+SELECT reset_user();
+SELECT SESSION_USER, CURRENT_USER;
+---  session_user | current_user 
+--- --------------+--------------
+---  dba          | dba
+--- (1 row)
+
+--- 切换到普通用户bob
+SELECT set_user('bob');
+SELECT SESSION_USER, CURRENT_USER;
+---  session_user | current_user 
+--- --------------+--------------
+---  dba          | bob
+--- (1 row)
+
 --- 恢复初始用户
 SELECT reset_user();
 SELECT SESSION_USER, CURRENT_USER;
@@ -199,17 +215,28 @@ SELECT SESSION_USER, CURRENT_USER;
 --- (1 row)
 ----
 
-查看 `logfile` 能看到提权后的所有操作都被记录了下来，并且日志前缀带有 `AUDIT` 标签。
+查看 `logfile` 能看到提权后的所有操作都被记录了下来，并且日志前缀带有 `AUDIT` 标签。每个用户切换都有一条： `LOG:  XXX transitioning to YYY` 对应。
 
 [source,log]
 ----
+2026-07-17 13:55:34.905 CST [2670610] LOG:  Role dba transitioning to Superuser Role postgres
+2026-07-17 13:55:34.905 CST [2670610] STATEMENT:  SELECT set_user_u('postgres');
 2026-07-16 16:01:21.193 CST [2644289] AUDIT: LOG:  statement: SELECT SESSION_USER, CURRENT_USER;
 2026-07-16 16:01:43.825 CST [2644289] AUDIT: LOG:  statement: SELECT set_user('bob');
 2026-07-16 16:01:43.829 CST [2644289] AUDIT: ERROR:  must reset previous user prior to setting again
 2026-07-16 16:01:43.829 CST [2644289] AUDIT: STATEMENT:  SELECT set_user('bob');
 2026-07-16 16:02:20.177 CST [2644289] AUDIT: LOG:  statement: ALTER SYSTEM SET wal_level = minimal;
 2026-07-16 16:02:20.177 CST [2644289] AUDIT: ERROR:  ALTER SYSTEM blocked by set_user config
 2026-07-16 16:02:20.177 CST [2644289] AUDIT: STATEMENT:  ALTER SYSTEM SET wal_level = minimal;
+2026-07-17 13:56:26.924 CST [2670610] STATEMENT:  SELECT set_user_u('postgres');
+2026-07-17 14:01:12.017 CST [2670610] AUDIT: LOG:  statement: select reset_user();
+2026-07-17 14:01:12.017 CST [2670610] AUDIT: LOG:  Superuser Role postgres transitioning to Role dba
+2026-07-17 14:18:42.884 CST [2671784] LOG:  Role dba transitioning to Role bob
+2026-07-17 14:18:42.884 CST [2671784] STATEMENT:  select set_user('bob');
+2026-07-17 14:18:53.301 CST [2671784] LOG:  Role bob transitioning to Role dba
+2026-07-17 14:18:53.301 CST [2671784] STATEMENT:  select reset_user();
+2026-07-17 14:26:16.737 CST [2671784] LOG:  Role dba transitioning to Role bob
+2026-07-17 14:26:16.737 CST [2671784] STATEMENT:  SELECT set_user('bob');
 ----
 
 === 清理测试数据库

EN/modules/ROOT/pages/master/ecosystem_components/ecosystem_overview.adoc

@@ -41,7 +41,7 @@ IvorySQL, as an advanced open-source database compatible with Oracle and based o
 |*27*| xref:master/ecosystem_components/pg_readonly_en.adoc[pg_read_only] | 1.0.5 | Allows to set all PostgreSQL cluster databases read only. | System debugging、disaster recevory
 |*28*| xref:master/ecosystem_components/zhparser_en.adoc[zhparser] | master branch | PostgreSQL extension for full-text search of Chinese language (Mandarin Chinese). It implements a Chinese language parser base on the | Search engine、keyword extraction
 |*29*| xref:master/ecosystem_components/pgbackrest.adoc[pgBackRest] | 2.58.0 | pgBackRest is a reliable backup and restore solution for PostgreSQL that seamlessly scales up to the largest databases and workloads | Disaster recovery backup, large database backup, off-site/multi-tier disaster recovery
-| *30* | xref:master/ecosystem_components/set_user.adoc[set_user] | REL4_2_0 | PostgreSQL extension that addresses operational security dilemmas, ensuring privileged operations cannot escape auditing | Database operational security, privilege management, audit logging
+| *30* | xref:master/ecosystem_components/set_user.adoc[set_user] | REL4_2_0 | PostgreSQL security auditing extension with controlled role switching, supporting allowlists, enforced auditing, and blocking of high-risk operations | Controlled role switching, privilege management, audit logging
 |====
 
 These plugins have all been tested and adapted by the IvorySQL team to ensure stable operation in the IvorySQL environment. Users can select appropriate plugins based on business needs to further enhance the capabilities and flexibility of the database system.