Skip to content

Commit 89ccfbb

Browse files
TCeasonTCeason
committed
fix test
1 parent d66040b commit 89ccfbb

File tree

16 files changed

+61
-87
lines changed

16 files changed

+61
-87
lines changed

‎src/meta/app/src/principal/user_privilege.rs‎

Lines changed: 0 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -97,36 +97,6 @@ pub enum UserPrivilegeType {
9797
CreateDataMask = 1 << 16,
9898
}
9999

100-
const ALL_PRIVILEGES: BitFlags<UserPrivilegeType> = make_bitflags!(
101-
UserPrivilegeType::{
102-
Create
103-
| Select
104-
| Insert
105-
| Update
106-
| Delete
107-
| Drop
108-
| Alter
109-
| Super
110-
| CreateUser
111-
| DropUser
112-
| CreateRole
113-
| DropRole
114-
| Grant
115-
| CreateStage
116-
| Set
117-
| CreateDataMask
118-
| CreateMaskingPolicy
119-
| ApplyMaskingPolicy
120-
| Ownership
121-
| Read
122-
| Write
123-
| CreateDatabase
124-
| CreateWarehouse
125-
| CreateConnection
126-
| AccessConnection
127-
}
128-
);
129-
130100
impl Display for UserPrivilegeType {
131101
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
132102
write!(f, "{}", match self {
@@ -345,26 +315,13 @@ impl UserPrivilegeSet {
345315
}
346316
}
347317

348-
// TODO: remove this, as ALL has different meanings on different objects
349-
pub fn all_privileges() -> Self {
350-
ALL_PRIVILEGES.into()
351-
}
352-
353318
pub fn set_privilege(&mut self, privilege: UserPrivilegeType) {
354319
self.privileges |= privilege;
355320
}
356321

357322
pub fn has_privilege(&self, privilege: UserPrivilegeType) -> bool {
358323
self.privileges.contains(privilege)
359324
}
360-
361-
pub fn set_all_privileges(&mut self) {
362-
self.privileges |= ALL_PRIVILEGES;
363-
}
364-
365-
pub fn is_all_privileges(&self) -> bool {
366-
self.privileges == ALL_PRIVILEGES
367-
}
368325
}
369326

370327
impl Display for UserPrivilegeSet {

‎src/meta/app/tests/it/user_privilege.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ fn test_user_privilege() -> Result<()> {
2626
let r = privileges.has_privilege(UserPrivilegeType::Insert);
2727
assert!(r);
2828

29-
privileges.set_all_privileges();
29+
privileges |= UserPrivilegeSet::available_privileges_on_global();
3030
let r = privileges.has_privilege(UserPrivilegeType::Create);
3131
assert!(r);
3232

‎src/query/service/src/interpreters/access/privilege_access.rs‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1514,7 +1514,6 @@ impl AccessChecker for PrivilegeAccess {
15141514
}
15151515
}
15161516
Plan::CreateView(plan) => {
1517-
self.validate_db_access(&plan.catalog, &plan.database, UserPrivilegeType::Create, false).await?;
15181517
let mut planner = Planner::new(self.ctx.clone());
15191518
let (plan, _) = planner.plan_sql(&plan.subquery).await?;
15201519
self.check(ctx, &plan).await?

‎src/query/users/tests/it/role_mgr.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ async fn test_role_manager() -> Result<()> {
102102
&tenant,
103103
&role_name,
104104
GrantObject::Global,
105-
UserPrivilegeSet::all_privileges(),
105+
UserPrivilegeSet::available_privileges_on_global(),
106106
)
107107
.await?;
108108
let role = role_mgr.get_role(&tenant, role_name.clone()).await?;
@@ -118,7 +118,7 @@ async fn test_role_manager() -> Result<()> {
118118
&tenant,
119119
&role_name,
120120
GrantObject::Global,
121-
UserPrivilegeSet::all_privileges(),
121+
UserPrivilegeSet::available_privileges_on_global(),
122122
)
123123
.await?;
124124

‎src/query/users/tests/it/user_mgr.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ async fn test_user_manager() -> Result<()> {
162162
&tenant,
163163
user_info.identity(),
164164
GrantObject::Global,
165-
UserPrivilegeSet::all_privileges(),
165+
UserPrivilegeSet::available_privileges_on_global(),
166166
)
167167
.await?;
168168
let user_info = user_mgr.get_user(&tenant, user_info.identity()).await?;
@@ -173,7 +173,7 @@ async fn test_user_manager() -> Result<()> {
173173
&tenant,
174174
user_info.identity(),
175175
GrantObject::Global,
176-
UserPrivilegeSet::all_privileges(),
176+
UserPrivilegeSet::available_privileges_on_global(),
177177
)
178178
.await?;
179179
let user_info = user_mgr.get_user(&tenant, user_info.identity()).await?;

‎tests/sqllogictests/suites/base/06_show/06_0007_show_roles.test‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -61,9 +61,6 @@ grant role b to role a;
6161
statement ok
6262
grant role a to a;
6363

64-
statement ok
65-
grant create database on *.* to a;
66-
6764
statement ok
6865
set enable_expand_roles=1;
6966

@@ -87,7 +84,7 @@ select grants from show_grants('user', 'a') order by object_id;
8784
GRANT SELECT ON 'default'.'default'.'t' TO 'a'@'%'
8885
GRANT OWNERSHIP ON 'default'.'default'.'t' TO 'a'@'%'
8986
GRANT OWNERSHIP ON 'default'.'default'.'t1' TO 'a'@'%'
90-
GRANT SELECT,INSERT,CREATE DATABASE ON *.* TO 'a'@'%'
87+
GRANT SELECT,INSERT ON *.* TO 'a'@'%'
9188

9289
statement ok
9390
set enable_expand_roles=0;
@@ -114,7 +111,6 @@ select grants from show_grants('user', 'a') order by object_id;
114111
GRANT ROLE a to 'a'@'%'
115112
GRANT ROLE b to 'a'@'%'
116113
GRANT ROLE public to 'a'@'%'
117-
GRANT CREATE DATABASE ON *.* TO 'a'@'%'
118114

119115
statement ok
120116
unset enable_expand_roles;

‎tests/suites/0_stateless/18_rbac/18_0002_ownership_cover.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ echo "create role drop_role;" | $BENDSQL_CLIENT_CONNECT
135135
echo "create role drop_role1;" | $BENDSQL_CLIENT_CONNECT
136136
echo "create user u1 identified by '123' with DEFAULT_ROLE='drop_role'" | $BENDSQL_CLIENT_CONNECT
137137
echo "grant role drop_role to u1;" | $BENDSQL_CLIENT_CONNECT
138-
echo "grant create database on *.* to u1;" | $BENDSQL_CLIENT_CONNECT
138+
echo "grant create database on *.* to role drop_role;" | $BENDSQL_CLIENT_CONNECT
139139
export USER_U1_CONNECT="bendsql --user=u1 --password=123 --host=${QUERY_MYSQL_HANDLER_HOST} --port ${QUERY_HTTP_HANDLER_PORT}"
140140

141141
echo "create database a" | $USER_U1_CONNECT

‎tests/suites/0_stateless/18_rbac/18_0004_view_privilege.result‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,14 @@
1616
1
1717
>>>> revoke create on default.* from role role1
1818
need failed: with 1063
19-
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'t' for user 'owner'@'%' with roles [public,role1]
19+
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'t' for user 'owner'@'%' with roles [public,role1,role2]
2020
need failed: with 1063
21-
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'t' for user 'owner'@'%' with roles [public,role1]
21+
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'t' for user 'owner'@'%' with roles [public,role1,role2]
2222
>>>> grant ownership on default.v_t_owner to role role1
2323
>>>> create view v_t as select * from t
2424
>>>> create view v_t_union as select * from t union all select * from t_owner
2525
'select * from v_t order by id' failed.
26-
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'v_t' for user 'owner'@'%' with roles [public,role1]
26+
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'v_t' for user 'owner'@'%' with roles [public,role1,role2]
2727
>>>> grant select on default.v_t to owner
2828
>>>> grant select on default.v_t_union to owner
2929
1
@@ -43,7 +43,7 @@ Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is req
4343
=== create view as select view ===
4444
>>>> revoke select on default.v_t from owner
4545
>>>> grant select on default.t to owner
46-
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'v_t' for user 'owner'@'%' with roles [public,role1]
46+
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'v_t' for user 'owner'@'%' with roles [public,role1,role2]
4747
>>>> grant select on default.v_t to owner
4848
>>>> grant select on default.t to owner
4949
>>>> grant select on default.v_t1 to owner

‎tests/suites/0_stateless/18_rbac/18_0004_view_privilege.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,15 @@ echo 'create table t_owner(c1 int)' | $TEST_USER_CONNECT
2626
echo 'insert into t_owner values(2)' | $TEST_USER_CONNECT
2727
stmt 'revoke create on default.* from role role1'
2828

29+
echo 'drop role if exists role2' | $BENDSQL_CLIENT_CONNECT
30+
echo 'create role role2' | $BENDSQL_CLIENT_CONNECT
31+
echo 'grant create on default.* to role role2' | $BENDSQL_CLIENT_CONNECT
32+
echo 'grant role role2 to owner' | $BENDSQL_CLIENT_CONNECT
33+
echo 'alter user owner with default_role=role2' | $BENDSQL_CLIENT_CONNECT
34+
2935
echo 'need failed: with 1063'
3036
echo 'create view v_t as select * from t' | $TEST_USER_CONNECT
37+
3138
echo 'need failed: with 1063'
3239
echo 'create view v_t_union as select * from t union all select * from t_owner' | $TEST_USER_CONNECT
3340
echo 'create view v_t_owner as select * from t_owner' | $TEST_USER_CONNECT
@@ -67,3 +74,4 @@ stmt 'drop view if exists v_t_union'
6774
stmt 'drop view if exists v_t1'
6875
stmt 'drop user if exists owner'
6976
stmt 'drop role if exists role1'
77+
echo 'drop role if exists role2' | $BENDSQL_CLIENT_CONNECT

‎tests/suites/0_stateless/18_rbac/18_0007_privilege_access.result‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -113,28 +113,28 @@ Error: APIError: QueryFailed: [1063]Permission denied: No privilege on database
113113
Error: APIError: QueryFailed: [1063]Permission denied: No privilege on table root_table for user b.
114114
Error: APIError: QueryFailed: [1063]Permission denied: No privilege on table root_table for user b.
115115
1 1
116-
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'t1' for user 'b'@'%' with roles [public]
117-
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Read] is required on STAGE s3 for user 'b'@'%' with roles [public]. Note: Please ensure that your current role have the appropriate permissions to create a new Object
118-
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'t' for user 'b'@'%' with roles [public]
119-
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Read] is required on STAGE s3 for user 'b'@'%' with roles [public]. Note: Please ensure that your current role have the appropriate permissions to create a new Object
120-
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Read] is required on STAGE s3 for user 'b'@'%' with roles [public]. Note: Please ensure that your current role have the appropriate permissions to create a new Object
121-
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'t1' for user 'b'@'%' with roles [public]
116+
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'t1' for user 'b'@'%' with roles [public,role_test_b]
117+
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Read] is required on STAGE s3 for user 'b'@'%' with roles [public,role_test_b]. Note: Please ensure that your current role have the appropriate permissions to create a new Object
118+
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'t' for user 'b'@'%' with roles [public,role_test_b]
119+
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Read] is required on STAGE s3 for user 'b'@'%' with roles [public,role_test_b]. Note: Please ensure that your current role have the appropriate permissions to create a new Object
120+
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Read] is required on STAGE s3 for user 'b'@'%' with roles [public,role_test_b]. Note: Please ensure that your current role have the appropriate permissions to create a new Object
121+
Error: APIError: QueryFailed: [1063]Permission denied: privilege [Select] is required on 'default'.'default'.'t1' for user 'b'@'%' with roles [public,role_test_b]
122122
0
123123
1
124124
a b/data_UUID_0000_00000000.parquet 1 0 NULL NULL
125125
=== check db/table_id ===
126126
Read s3 USER b GRANT Read ON STAGE s3 TO 'b'@'%'
127-
CREATE default USER b GRANT CREATE ON 'default'.'default'.* TO 'b'@'%'
128127
SELECT system USER b GRANT SELECT ON 'default'.'system'.* TO 'b'@'%'
128+
CREATE default USER b GRANT CREATE ON 'default'.'default'.* TO 'b'@'%'
129129
SELECT,INSERT,DELETE default.default.t USER b GRANT SELECT,INSERT,DELETE ON 'default'.'default'.'t' TO 'b'@'%'
130130
SELECT default.default.t1 USER b GRANT SELECT ON 'default'.'default'.'t1' TO 'b'@'%'
131131
SELECT,INSERT default.c.t USER b GRANT SELECT,INSERT ON 'default'.'c'.'t' TO 'b'@'%'
132132
OWNERSHIP default.default.t2 USER b GRANT OWNERSHIP ON 'default'.'default'.'t2' TO 'b'@'%'
133133
1
134134
1
135135
Read s3 USER b GRANT Read ON STAGE s3 TO 'b'@'%'
136-
CREATE default USER b GRANT CREATE ON 'default'.'default'.* TO 'b'@'%'
137136
SELECT system USER b GRANT SELECT ON 'default'.'system'.* TO 'b'@'%'
137+
CREATE default USER b GRANT CREATE ON 'default'.'default'.* TO 'b'@'%'
138138
SELECT,INSERT,DELETE default.default.t USER b GRANT SELECT,INSERT,DELETE ON 'default'.'default'.'t' TO 'b'@'%'
139139
SELECT default.default.t1 USER b GRANT SELECT ON 'default'.'default'.'t1' TO 'b'@'%'
140140
SELECT,INSERT default.c.t1 USER b GRANT SELECT,INSERT ON 'default'.'c'.'t1' TO 'b'@'%'
@@ -143,8 +143,8 @@ OWNERSHIP default.default.t2 USER b GRANT OWNERSHIP ON 'default'.'default'.'t2'
143143
1
144144
2
145145
Read s3 USER b GRANT Read ON STAGE s3 TO 'b'@'%'
146-
CREATE default USER b GRANT CREATE ON 'default'.'default'.* TO 'b'@'%'
147146
SELECT system USER b GRANT SELECT ON 'default'.'system'.* TO 'b'@'%'
147+
CREATE default USER b GRANT CREATE ON 'default'.'default'.* TO 'b'@'%'
148148
SELECT,INSERT,DELETE default.default.t USER b GRANT SELECT,INSERT,DELETE ON 'default'.'default'.'t' TO 'b'@'%'
149149
SELECT default.default.t1 USER b GRANT SELECT ON 'default'.'default'.'t1' TO 'b'@'%'
150150
SELECT,INSERT default.d.t1 USER b GRANT SELECT,INSERT ON 'default'.'d'.'t1' TO 'b'@'%'

0 commit comments

Comments
 (0)