parser: add parsing of PROVISIONSRC role option

Release note: None

Author: souravcrl

docs/generated/sql/bnf/stmt_block.bnf

@@ -1392,6 +1392,7 @@ unreserved_keyword ::=
 	| 'PRIVILEGES'
 	| 'PROCEDURE'
 	| 'PROCEDURES'
+	| 'PROVISIONSRC'
 	| 'PUBLIC'
 	| 'PUBLICATION'
 	| 'QUERIES'
@@ -3284,6 +3285,7 @@ role_option ::=
 	| password_clause
 	| valid_until_clause
 	| subject_clause
+	| provisionsrc_clause
 	| 'REPLICATION'
 	| 'NOREPLICATION'
 	| 'BYPASSRLS'
@@ -3786,6 +3788,10 @@ subject_clause ::=
 	'SUBJECT' string_or_placeholder
 	| 'SUBJECT' 'NULL'
 
+provisionsrc_clause ::=
+	'PROVISIONSRC' string_or_placeholder
+	| 'PROVISIONSRC' 'NULL'
+
 func_name_no_crdb_extra ::=
 	type_function_name_no_crdb_extra
 	| prefixed_column_path
@@ -4311,6 +4317,7 @@ bare_label_keywords ::=
 	| 'PRIVILEGES'
 	| 'PROCEDURE'
 	| 'PROCEDURES'
+	| 'PROVISIONSRC'
 	| 'PUBLIC'
 	| 'PUBLICATION'
 	| 'QUERIES'

pkg/server/user_test.go

@@ -46,10 +46,10 @@ func TestValidRoles(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, false, hasRole)
 
-		// Skip PASSWORD and SUBJECT options. Since PASSWORD still resides in
-		// system.users and SUBJECT is an enterprise feature that is tested
-		// separately.
-		if name == "PASSWORD" || name == "SUBJECT" {
+		// Skip PASSWORD and SUBJECT/PROVISIONSRC options. Since PASSWORD
+		// still resides in system.users and SUBJECT, PROVISIONSRC are an
+		// enterprise features that is tested separately.
+		if name == "PASSWORD" || name == "SUBJECT" || name == "PROVISIONSRC" {
 			continue
 		}
 		// Add the role and check if the role was added (or in the cases of roles starting

pkg/sql/parser/sql.y

@@ -1045,7 +1045,7 @@ func (u *sqlSymUnion) doBlockOption() tree.DoBlockOption {
 %token <str> PARALLEL PARENT PARTIAL PARTITION PARTITIONS PASSWORD PAUSE PAUSED PER PERMISSIVE PHYSICAL PLACEMENT PLACING
 %token <str> PLAN PLANS POINT POINTM POINTZ POINTZM POLICIES POLICY POLYGON POLYGONM POLYGONZ POLYGONZM
 %token <str> POSITION PRECEDING PRECISION PREPARE PREPARED PRESERVE PRIMARY PRIOR PRIORITY PRIVILEGES
-%token <str> PROCEDURAL PROCEDURE PROCEDURES PUBLIC PUBLICATION
+%token <str> PROCEDURAL PROCEDURE PROCEDURES PROVISIONSRC PUBLIC PUBLICATION
 
 %token <str> QUERIES QUERY QUOTE
 
@@ -1496,7 +1496,7 @@ func (u *sqlSymUnion) doBlockOption() tree.DoBlockOption {
 
 %type <str> name opt_name opt_name_parens
 %type <str> privilege savepoint_name
-%type <tree.KVOption> role_option password_clause valid_until_clause subject_clause
+%type <tree.KVOption> role_option password_clause valid_until_clause subject_clause provisionsrc_clause
 %type <tree.Operator> subquery_op
 %type <*tree.UnresolvedName> func_name func_name_no_crdb_extra
 %type <tree.ResolvableFunctionReference> func_application_name
@@ -12069,6 +12069,7 @@ role_option:
 | password_clause
 | valid_until_clause
 | subject_clause
+| provisionsrc_clause
 | REPLICATION
   {
     $$.val = tree.KVOption{Key: tree.Name($1), Value: nil}
@@ -12126,6 +12127,16 @@ subject_clause:
     $$.val = tree.KVOption{Key: tree.Name("subject"), Value: tree.DNull}
   }
 
+provisionsrc_clause:
+  PROVISIONSRC string_or_placeholder
+  {
+    $$.val = tree.KVOption{Key: tree.Name("provisionsrc"), Value: $2.expr()}
+  }
+| PROVISIONSRC NULL
+  {
+    $$.val = tree.KVOption{Key: tree.Name("provisionsrc"), Value: tree.DNull}
+  }
+
 opt_view_recursive:
   /* EMPTY */ { /* no error */ }
 | RECURSIVE { return unimplemented(sqllex, "create recursive view") }
@@ -18403,6 +18414,7 @@ unreserved_keyword:
 | PRIVILEGES
 | PROCEDURE
 | PROCEDURES
+| PROVISIONSRC
 | PUBLIC
 | PUBLICATION
 | QUERIES
@@ -18982,6 +18994,7 @@ bare_label_keywords:
 | PRIVILEGES
 | PROCEDURE
 | PROCEDURES
+| PROVISIONSRC
 | PUBLIC
 | PUBLICATION
 | QUERIES

pkg/sql/parser/testdata/alter_user

@@ -117,6 +117,14 @@ ALTER ROLE foo WITH SUBJECT ('bar') -- fully parenthesized
 ALTER ROLE foo WITH SUBJECT '_' -- literals removed
 ALTER ROLE _ WITH SUBJECT 'bar' -- identifiers removed
 
+parse
+ALTER ROLE foo PROVISIONSRC 'src'
+----
+ALTER ROLE foo WITH PROVISIONSRC 'src' -- normalized!
+ALTER ROLE foo WITH PROVISIONSRC ('src') -- fully parenthesized
+ALTER ROLE foo WITH PROVISIONSRC '_' -- literals removed
+ALTER ROLE _ WITH PROVISIONSRC 'src' -- identifiers removed
+
 parse
 ALTER USER foo SET search_path = 'abc'
 ----

pkg/sql/parser/testdata/create_user

@@ -207,3 +207,11 @@ CREATE ROLE foo WITH SUBJECT 'bar'
 CREATE ROLE foo WITH SUBJECT ('bar') -- fully parenthesized
 CREATE ROLE foo WITH SUBJECT '_' -- literals removed
 CREATE ROLE _ WITH SUBJECT 'bar' -- identifiers removed
+
+parse
+CREATE ROLE foo WITH PROVISIONSRC 'src'
+----
+CREATE ROLE foo WITH PROVISIONSRC 'src'
+CREATE ROLE foo WITH PROVISIONSRC ('src') -- fully parenthesized
+CREATE ROLE foo WITH PROVISIONSRC '_' -- literals removed
+CREATE ROLE _ WITH PROVISIONSRC 'src' -- identifiers removed

pkg/sql/roleoption/option_string.go

@@ -76,6 +76,7 @@ const (
 	SUBJECT
 	BYPASSRLS
 	NOBYPASSRLS
+	PROVISIONSRC
 )
 
 // ControlChangefeedDeprecationNoticeMsg is a user friendly notice which should be shown when CONTROLCHANGEFEED is used
@@ -118,6 +119,7 @@ var toSQLStmts = map[Option]string{
 	SUBJECT:                `UPSERT INTO system.role_options (username, option, value, user_id) VALUES ($1, 'SUBJECT', $2::string, $3)`,
 	BYPASSRLS:              `INSERT INTO system.role_options (username, option, user_id) VALUES ($1, 'BYPASSRLS', $2) ON CONFLICT DO NOTHING`,
 	NOBYPASSRLS:            `DELETE FROM system.role_options WHERE username = $1 AND user_id = $2 AND option = 'BYPASSRLS'`,
+	PROVISIONSRC:           `UPSERT INTO system.role_options (username, option, value, user_id) VALUES ($1, 'PROVISIONSRC', $2::string, $3)`,
 }
 
 // Mask returns the bitmask for a given role option.
@@ -158,6 +160,7 @@ var ByName = map[string]Option{
 	"SUBJECT":                SUBJECT,
 	"BYPASSRLS":              BYPASSRLS,
 	"NOBYPASSRLS":            NOBYPASSRLS,
+	"PROVISIONSRC":           PROVISIONSRC,
 }
 
 // ToOption takes a string and returns the corresponding Option.