Skip to content

Commit f45c0b8

Browse files
bghalbghal
committed
sql: introduce INSPECT privilege
The planned `INSPECT` command demands an associated privilege. This change adds the privilege at the table and database level. Fixes: #148925 Epic: CRDB-30356 Release note: None.
1 parent e3c4b09 commit f45c0b8

11 files changed

+54
-14
lines changed

‎pkg/sql/catalog/catpb/privilege_test.go‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ func TestPrivilege(t *testing.T) {
8787
{Kind: privilege.CREATE},
8888
{Kind: privilege.DELETE},
8989
{Kind: privilege.DROP},
90+
{Kind: privilege.INSPECT},
9091
{Kind: privilege.REPLICATIONDEST},
9192
{Kind: privilege.REPLICATIONSOURCE},
9293
{Kind: privilege.TRIGGER},
@@ -127,23 +128,21 @@ func TestPrivilege(t *testing.T) {
127128
},
128129
privilege.Type,
129130
},
130-
// Ensure revoking BACKUP, CHANGEFEED, CREATE, DROP, SELECT, INSERT, DELETE, UPDATE, ZONECONFIG
131-
// from a user with ALL privilege on a table leaves the user with no privileges.
131+
// Ensure revoking table privileges from a user with ALL
132+
// privilege on a table leaves the user with no privileges.
132133
{testUser,
133134
privilege.List{privilege.ALL},
134-
privilege.List{privilege.BACKUP, privilege.CHANGEFEED, privilege.CREATE, privilege.DROP, privilege.SELECT, privilege.INSERT,
135-
privilege.DELETE, privilege.REPLICATIONDEST, privilege.REPLICATIONSOURCE, privilege.TRIGGER, privilege.UPDATE, privilege.ZONECONFIG},
135+
privilege.TablePrivileges,
136136
[]catpb.UserPrivilege{
137137
{User: username.AdminRoleName(), Privileges: []privilege.Privilege{{Kind: privilege.ALL, GrantOption: true}}},
138138
},
139139
privilege.Table,
140140
},
141-
// Ensure revoking BACKUP, CONNECT, CREATE, DROP, SELECT, INSERT, DELETE, UPDATE, ZONECONFIG, RESTORE, CHANGEFEED
142-
// from a user with ALL privilege on a database leaves the user with no privileges.
141+
// Ensure revoking database privileges from a user with ALL privilege on
142+
// a database leaves the user with no privileges.
143143
{testUser,
144144
privilege.List{privilege.ALL},
145-
privilege.List{privilege.BACKUP, privilege.CONNECT, privilege.CREATE, privilege.DROP, privilege.SELECT,
146-
privilege.INSERT, privilege.DELETE, privilege.UPDATE, privilege.ZONECONFIG, privilege.RESTORE, privilege.CHANGEFEED},
145+
privilege.DBPrivileges,
147146
[]catpb.UserPrivilege{
148147
{User: username.AdminRoleName(), Privileges: []privilege.Privilege{{Kind: privilege.ALL, GrantOption: true}}},
149148
},
@@ -617,7 +616,7 @@ func TestRevokeWithGrantOption(t *testing.T) {
617616
true,
618617
privilege.List{privilege.CREATE},
619618
privilege.List{privilege.ALL},
620-
privilege.List{privilege.BACKUP, privilege.CHANGEFEED, privilege.DROP, privilege.SELECT, privilege.INSERT, privilege.DELETE, privilege.REPLICATIONDEST, privilege.REPLICATIONSOURCE, privilege.TRIGGER, privilege.UPDATE, privilege.ZONECONFIG},
619+
privilege.List{privilege.BACKUP, privilege.CHANGEFEED, privilege.DELETE, privilege.DROP, privilege.INSERT, privilege.INSPECT, privilege.REPLICATIONDEST, privilege.REPLICATIONSOURCE, privilege.SELECT, privilege.TRIGGER, privilege.UPDATE, privilege.ZONECONFIG},
621620
false},
622621
{catpb.NewPrivilegeDescriptor(testUser, privilege.List{privilege.ALL}, privilege.List{privilege.ALL}, username.AdminRoleName()),
623622
testUser, privilege.Table,
@@ -651,8 +650,8 @@ func TestRevokeWithGrantOption(t *testing.T) {
651650
testUser, privilege.Table,
652651
false,
653652
privilege.List{privilege.CREATE},
654-
privilege.List{privilege.BACKUP, privilege.CHANGEFEED, privilege.DROP, privilege.SELECT, privilege.INSERT, privilege.DELETE, privilege.REPLICATIONDEST, privilege.REPLICATIONSOURCE, privilege.TRIGGER, privilege.UPDATE, privilege.ZONECONFIG},
655-
privilege.List{privilege.BACKUP, privilege.CHANGEFEED, privilege.DROP, privilege.SELECT, privilege.INSERT, privilege.DELETE, privilege.REPLICATIONDEST, privilege.REPLICATIONSOURCE, privilege.TRIGGER, privilege.UPDATE, privilege.ZONECONFIG},
653+
privilege.List{privilege.BACKUP, privilege.CHANGEFEED, privilege.DELETE, privilege.DROP, privilege.INSERT, privilege.INSPECT, privilege.REPLICATIONDEST, privilege.REPLICATIONSOURCE, privilege.SELECT, privilege.TRIGGER, privilege.UPDATE, privilege.ZONECONFIG},
654+
privilege.List{privilege.BACKUP, privilege.CHANGEFEED, privilege.DELETE, privilege.DROP, privilege.INSERT, privilege.INSPECT, privilege.REPLICATIONDEST, privilege.REPLICATIONSOURCE, privilege.SELECT, privilege.TRIGGER, privilege.UPDATE, privilege.ZONECONFIG},
656655
false},
657656
{catpb.NewPrivilegeDescriptor(testUser, privilege.List{privilege.SELECT, privilege.INSERT}, privilege.List{privilege.INSERT}, username.AdminRoleName()),
658657
testUser, privilege.Table,

‎pkg/sql/logictest/testdata/logic_test/alter_default_privileges_for_table‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,7 @@ d public t8 testuser CREATE false
266266
d public t8 testuser DELETE false
267267
d public t8 testuser DROP false
268268
d public t8 testuser INSERT false
269+
d public t8 testuser INSPECT false
269270
d public t8 testuser REPLICATIONDEST false
270271
d public t8 testuser REPLICATIONSOURCE false
271272
d public t8 testuser TRIGGER false
@@ -277,6 +278,7 @@ d public t8 testuser2 CREATE false
277278
d public t8 testuser2 DELETE false
278279
d public t8 testuser2 DROP false
279280
d public t8 testuser2 INSERT false
281+
d public t8 testuser2 INSPECT false
280282
d public t8 testuser2 REPLICATIONDEST false
281283
d public t8 testuser2 REPLICATIONSOURCE false
282284
d public t8 testuser2 TRIGGER false

‎pkg/sql/logictest/testdata/logic_test/crdb_internal_default_privileges‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -554,6 +554,7 @@ test NULL root false tables bar ZONE
554554
test NULL root false tables bar TRIGGER false
555555
test NULL root false tables bar REPLICATIONDEST false
556556
test NULL root false tables bar REPLICATIONSOURCE false
557+
test NULL root false tables bar INSPECT false
557558
test NULL root false tables foo BACKUP false
558559
test NULL root false tables foo CHANGEFEED false
559560
test NULL root false tables foo CREATE false
@@ -565,6 +566,7 @@ test NULL root false tables foo ZONE
565566
test NULL root false tables foo TRIGGER false
566567
test NULL root false tables foo REPLICATIONDEST false
567568
test NULL root false tables foo REPLICATIONSOURCE false
569+
test NULL root false tables foo INSPECT false
568570
test NULL root false tables root ALL true
569571
test NULL root false sequences root ALL true
570572
test NULL root false types root ALL true

‎pkg/sql/logictest/testdata/logic_test/grant_database‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,13 +61,15 @@ a readwrite BACKUP true
6161
a readwrite CHANGEFEED true
6262
a readwrite CREATE true
6363
a readwrite DROP true
64+
a readwrite INSPECT true
6465
a readwrite RESTORE true
6566
a readwrite ZONECONFIG true
6667
a root ALL true
6768
a test-user BACKUP true
6869
a test-user CHANGEFEED true
6970
a test-user CREATE true
7071
a test-user DROP true
72+
a test-user INSPECT true
7173
a test-user RESTORE true
7274
a test-user ZONECONFIG true
7375

@@ -79,12 +81,14 @@ a readwrite BACKUP true
7981
a readwrite CHANGEFEED true
8082
a readwrite CREATE true
8183
a readwrite DROP true
84+
a readwrite INSPECT true
8285
a readwrite RESTORE true
8386
a readwrite ZONECONFIG true
8487
a test-user BACKUP true
8588
a test-user CHANGEFEED true
8689
a test-user CREATE true
8790
a test-user DROP true
91+
a test-user INSPECT true
8892
a test-user RESTORE true
8993
a test-user ZONECONFIG true
9094

@@ -100,12 +104,14 @@ a readwrite BACKUP true
100104
a readwrite CHANGEFEED true
101105
a readwrite CREATE true
102106
a readwrite DROP true
107+
a readwrite INSPECT true
103108
a readwrite RESTORE true
104109
a readwrite ZONECONFIG true
105110
a root ALL true
106111
a test-user BACKUP true
107112
a test-user CHANGEFEED true
108113
a test-user DROP true
114+
a test-user INSPECT true
109115
a test-user RESTORE true
110116
a test-user ZONECONFIG true
111117

@@ -120,6 +126,7 @@ a readwrite BACKUP true
120126
a readwrite CHANGEFEED true
121127
a readwrite CREATE true
122128
a readwrite DROP true
129+
a readwrite INSPECT true
123130
a readwrite RESTORE true
124131
a readwrite ZONECONFIG true
125132

‎pkg/sql/logictest/testdata/logic_test/grant_on_all_tables_in_schema‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ test s t table testuser CREATE
7474
test s t table testuser DELETE false
7575
test s t table testuser DROP false
7676
test s t table testuser INSERT false
77+
test s t table testuser INSPECT false
7778
test s t table testuser REPLICATIONDEST false
7879
test s t table testuser REPLICATIONSOURCE false
7980
test s t table testuser TRIGGER false
@@ -85,6 +86,7 @@ test s t table testuser2 CREATE
8586
test s t table testuser2 DELETE false
8687
test s t table testuser2 DROP false
8788
test s t table testuser2 INSERT false
89+
test s t table testuser2 INSPECT false
8890
test s t table testuser2 REPLICATIONDEST false
8991
test s t table testuser2 REPLICATIONSOURCE false
9092
test s t table testuser2 TRIGGER false
@@ -96,6 +98,7 @@ test s2 t table testuser CREATE
9698
test s2 t table testuser DELETE false
9799
test s2 t table testuser DROP false
98100
test s2 t table testuser INSERT false
101+
test s2 t table testuser INSPECT false
99102
test s2 t table testuser REPLICATIONDEST false
100103
test s2 t table testuser REPLICATIONSOURCE false
101104
test s2 t table testuser TRIGGER false
@@ -107,6 +110,7 @@ test s2 t table testuser2 CREATE
107110
test s2 t table testuser2 DELETE false
108111
test s2 t table testuser2 DROP false
109112
test s2 t table testuser2 INSERT false
113+
test s2 t table testuser2 INSPECT false
110114
test s2 t table testuser2 REPLICATIONDEST false
111115
test s2 t table testuser2 REPLICATIONSOURCE false
112116
test s2 t table testuser2 TRIGGER false

‎pkg/sql/logictest/testdata/logic_test/grant_revoke_with_grant_option‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,7 @@ test public t table testuser CHANGEFEED
307307
test public t table testuser CREATE true
308308
test public t table testuser DROP true
309309
test public t table testuser INSERT true
310+
test public t table testuser INSPECT true
310311
test public t table testuser REPLICATIONDEST true
311312
test public t table testuser REPLICATIONSOURCE true
312313
test public t table testuser SELECT true

‎pkg/sql/logictest/testdata/logic_test/grant_table‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1671,6 +1671,7 @@ a public t readwrite BACKUP false
16711671
a public t readwrite CHANGEFEED false
16721672
a public t readwrite CREATE false
16731673
a public t readwrite DROP false
1674+
a public t readwrite INSPECT false
16741675
a public t readwrite REPLICATIONDEST false
16751676
a public t readwrite REPLICATIONSOURCE false
16761677
a public t readwrite SELECT false
@@ -1682,6 +1683,7 @@ a public t test-user BACKUP false
16821683
a public t test-user CHANGEFEED false
16831684
a public t test-user CREATE false
16841685
a public t test-user DROP false
1686+
a public t test-user INSPECT false
16851687
a public t test-user REPLICATIONDEST false
16861688
a public t test-user REPLICATIONSOURCE false
16871689
a public t test-user SELECT false
@@ -1696,6 +1698,7 @@ a public t readwrite BACKUP false
16961698
a public t readwrite CHANGEFEED false
16971699
a public t readwrite CREATE false
16981700
a public t readwrite DROP false
1701+
a public t readwrite INSPECT false
16991702
a public t readwrite REPLICATIONDEST false
17001703
a public t readwrite REPLICATIONSOURCE false
17011704
a public t readwrite SELECT false
@@ -1706,6 +1709,7 @@ a public t test-user BACKUP false
17061709
a public t test-user CHANGEFEED false
17071710
a public t test-user CREATE false
17081711
a public t test-user DROP false
1712+
a public t test-user INSPECT false
17091713
a public t test-user REPLICATIONDEST false
17101714
a public t test-user REPLICATIONSOURCE false
17111715
a public t test-user SELECT false
@@ -1724,6 +1728,7 @@ a public t readwrite BACKUP false
17241728
a public t readwrite CHANGEFEED false
17251729
a public t readwrite CREATE false
17261730
a public t readwrite DROP false
1731+
a public t readwrite INSPECT false
17271732
a public t readwrite REPLICATIONDEST false
17281733
a public t readwrite REPLICATIONSOURCE false
17291734
a public t readwrite SELECT false
@@ -1735,6 +1740,7 @@ a public t test-user BACKUP false
17351740
a public t test-user CHANGEFEED false
17361741
a public t test-user CREATE false
17371742
a public t test-user DROP false
1743+
a public t test-user INSPECT false
17381744
a public t test-user REPLICATIONDEST false
17391745
a public t test-user REPLICATIONSOURCE false
17401746
a public t test-user TRIGGER false
@@ -1748,6 +1754,7 @@ a public t readwrite BACKUP false
17481754
a public t readwrite CHANGEFEED false
17491755
a public t readwrite CREATE false
17501756
a public t readwrite DROP false
1757+
a public t readwrite INSPECT false
17511758
a public t readwrite REPLICATIONDEST false
17521759
a public t readwrite REPLICATIONSOURCE false
17531760
a public t readwrite SELECT false
@@ -1758,6 +1765,7 @@ a public t test-user BACKUP false
17581765
a public t test-user CHANGEFEED false
17591766
a public t test-user CREATE false
17601767
a public t test-user DROP false
1768+
a public t test-user INSPECT false
17611769
a public t test-user REPLICATIONDEST false
17621770
a public t test-user REPLICATIONSOURCE false
17631771
a public t test-user TRIGGER false
@@ -1824,6 +1832,7 @@ a public v readwrite BACKUP false
18241832
a public v readwrite CHANGEFEED false
18251833
a public v readwrite CREATE false
18261834
a public v readwrite DROP false
1835+
a public v readwrite INSPECT false
18271836
a public v readwrite REPLICATIONDEST false
18281837
a public v readwrite REPLICATIONSOURCE false
18291838
a public v readwrite SELECT false
@@ -1835,6 +1844,7 @@ a public v test-user BACKUP false
18351844
a public v test-user CHANGEFEED false
18361845
a public v test-user CREATE false
18371846
a public v test-user DROP false
1847+
a public v test-user INSPECT false
18381848
a public v test-user REPLICATIONDEST false
18391849
a public v test-user REPLICATIONSOURCE false
18401850
a public v test-user SELECT false
@@ -1849,6 +1859,7 @@ a public v readwrite BACKUP false
18491859
a public v readwrite CHANGEFEED false
18501860
a public v readwrite CREATE false
18511861
a public v readwrite DROP false
1862+
a public v readwrite INSPECT false
18521863
a public v readwrite REPLICATIONDEST false
18531864
a public v readwrite REPLICATIONSOURCE false
18541865
a public v readwrite SELECT false
@@ -1859,6 +1870,7 @@ a public v test-user BACKUP false
18591870
a public v test-user CHANGEFEED false
18601871
a public v test-user CREATE false
18611872
a public v test-user DROP false
1873+
a public v test-user INSPECT false
18621874
a public v test-user REPLICATIONDEST false
18631875
a public v test-user REPLICATIONSOURCE false
18641876
a public v test-user SELECT false
@@ -1877,6 +1889,7 @@ a public v readwrite BACKUP false
18771889
a public v readwrite CHANGEFEED false
18781890
a public v readwrite CREATE false
18791891
a public v readwrite DROP false
1892+
a public v readwrite INSPECT false
18801893
a public v readwrite REPLICATIONDEST false
18811894
a public v readwrite REPLICATIONSOURCE false
18821895
a public v readwrite SELECT false
@@ -1888,6 +1901,7 @@ a public v test-user BACKUP false
18881901
a public v test-user CHANGEFEED false
18891902
a public v test-user CREATE false
18901903
a public v test-user DROP false
1904+
a public v test-user INSPECT false
18911905
a public v test-user REPLICATIONDEST false
18921906
a public v test-user REPLICATIONSOURCE false
18931907
a public v test-user TRIGGER false
@@ -1901,6 +1915,7 @@ a public v readwrite BACKUP false
19011915
a public v readwrite CHANGEFEED false
19021916
a public v readwrite CREATE false
19031917
a public v readwrite DROP false
1918+
a public v readwrite INSPECT false
19041919
a public v readwrite REPLICATIONDEST false
19051920
a public v readwrite REPLICATIONSOURCE false
19061921
a public v readwrite SELECT false
@@ -1911,6 +1926,7 @@ a public v test-user BACKUP false
19111926
a public v test-user CHANGEFEED false
19121927
a public v test-user CREATE false
19131928
a public v test-user DROP false
1929+
a public v test-user INSPECT false
19141930
a public v test-user REPLICATIONDEST false
19151931
a public v test-user REPLICATIONSOURCE false
19161932
a public v test-user TRIGGER false
@@ -1927,6 +1943,7 @@ a public v table readwrite BACKUP false
19271943
a public v table readwrite CHANGEFEED false
19281944
a public v table readwrite CREATE false
19291945
a public v table readwrite DROP false
1946+
a public v table readwrite INSPECT false
19301947
a public v table readwrite REPLICATIONDEST false
19311948
a public v table readwrite REPLICATIONSOURCE false
19321949
a public v table readwrite SELECT false
@@ -1937,6 +1954,7 @@ a public v table test-user BACKUP false
19371954
a public v table test-user CHANGEFEED false
19381955
a public v table test-user CREATE false
19391956
a public v table test-user DROP false
1957+
a public v table test-user INSPECT false
19401958
a public v table test-user REPLICATIONDEST false
19411959
a public v table test-user REPLICATIONSOURCE false
19421960
a public v table test-user TRIGGER false

0 commit comments

Comments
 (0)