Skip to content

Commit 5f29c7f

Browse files
BohuTANGBohuTANG
authored
Merge pull request #10600 from TCeason/modify_priv
feat(query): add other privilige check
2 parents cbc8b99 + 7cc8abc commit 5f29c7f

File tree

14 files changed

+309
-231
lines changed

14 files changed

+309
-231
lines changed

‎src/meta/app/src/principal/user_grant.rs‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -90,13 +90,21 @@ impl GrantEntry {
9090
&self.privileges
9191
}
9292

93-
pub fn verify_privilege(&self, object: &GrantObject, privilege: UserPrivilegeType) -> bool {
93+
pub fn verify_privilege(
94+
&self,
95+
object: &GrantObject,
96+
privileges: Vec<UserPrivilegeType>,
97+
) -> bool {
9498
// the verified object should be smaller than the object inside my grant entry.
9599
if !self.object.contains(object) {
96100
return false;
97101
}
98102

99-
self.privileges.contains(privilege)
103+
let mut priv_set = UserPrivilegeSet::empty();
104+
for privilege in privileges {
105+
priv_set.set_privilege(privilege)
106+
}
107+
self.privileges.contains(BitFlags::from(priv_set))
100108
}
101109

102110
pub fn matches_entry(&self, object: &GrantObject) -> bool {
@@ -156,10 +164,14 @@ impl UserGrantSet {
156164
self.roles.remove(role);
157165
}
158166

159-
pub fn verify_privilege(&self, object: &GrantObject, privilege: UserPrivilegeType) -> bool {
167+
pub fn verify_privilege(
168+
&self,
169+
object: &GrantObject,
170+
privilege: Vec<UserPrivilegeType>,
171+
) -> bool {
160172
self.entries
161173
.iter()
162-
.any(|e| e.verify_privilege(object, privilege))
174+
.any(|e| e.verify_privilege(object, privilege.clone()))
163175
}
164176

165177
pub fn grant_privileges(&mut self, object: &GrantObject, privileges: UserPrivilegeSet) {

‎src/meta/app/src/principal/user_privilege.rs‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,10 @@ pub enum UserPrivilegeType {
5858
Grant = 1 << 12,
5959
// Privilege to Create Stage.
6060
CreateStage = 1 << 13,
61+
// Privilege to Drop role.
62+
DropRole = 1 << 14,
63+
// Privilege to Drop user.
64+
DropUser = 1 << 15,
6165
// TODO: remove this later
6266
Set = 1 << 4,
6367
}
@@ -73,7 +77,9 @@ const ALL_PRIVILEGES: BitFlags<UserPrivilegeType> = make_bitflags!(
7377
| Alter
7478
| Super
7579
| CreateUser
80+
| DropUser
7681
| CreateRole
82+
| DropRole
7783
| Grant
7884
| CreateStage
7985
| Set
@@ -93,7 +99,9 @@ impl std::fmt::Display for UserPrivilegeType {
9399
UserPrivilegeType::Alter => "ALTER",
94100
UserPrivilegeType::Super => "SUPER",
95101
UserPrivilegeType::CreateUser => "CREATE USER",
102+
UserPrivilegeType::DropUser => "DROP USER",
96103
UserPrivilegeType::CreateRole => "CREATE ROLE",
104+
UserPrivilegeType::DropRole => "DROP ROLE",
97105
UserPrivilegeType::CreateStage => "CREATE STAGE",
98106
UserPrivilegeType::Grant => "GRANT",
99107
UserPrivilegeType::Set => "SET",
@@ -121,8 +129,7 @@ impl UserPrivilegeSet {
121129
/// on databases and tables, and has some Global only privileges.
122130
pub fn available_privileges_on_global() -> Self {
123131
let database_privs = Self::available_privileges_on_database();
124-
let privs =
125-
make_bitflags!(UserPrivilegeType::{ Usage | Super | CreateUser | CreateRole | Grant });
132+
let privs = make_bitflags!(UserPrivilegeType::{ Usage | Super | CreateUser | DropUser | CreateRole | DropRole | Grant });
126133
(database_privs.privileges | privs).into()
127134
}
128135

‎src/meta/app/tests/it/user_grant.rs‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -99,15 +99,15 @@ fn test_user_grant_entry() -> Result<()> {
9999
);
100100
assert!(grant.verify_privilege(
101101
&GrantObject::Database("default".into(), "db1".into()),
102-
UserPrivilegeType::Create
102+
vec![UserPrivilegeType::Create]
103103
));
104104
assert!(!grant.verify_privilege(
105105
&GrantObject::Database("default".into(), "db1".into()),
106-
UserPrivilegeType::Insert
106+
vec![UserPrivilegeType::Insert]
107107
));
108108
assert!(grant.verify_privilege(
109109
&GrantObject::Database("default".into(), "db2".into()),
110-
UserPrivilegeType::Create
110+
vec![UserPrivilegeType::Create]
111111
));
112112

113113
let grant = GrantEntry::new(
@@ -116,15 +116,15 @@ fn test_user_grant_entry() -> Result<()> {
116116
);
117117
assert!(grant.verify_privilege(
118118
&GrantObject::Table("default".into(), "db1".into(), "table1".into()),
119-
UserPrivilegeType::Create
119+
vec![UserPrivilegeType::Create]
120120
));
121121
assert!(!grant.verify_privilege(
122122
&GrantObject::Table("default".into(), "db2".into(), "table1".into()),
123-
UserPrivilegeType::Create
123+
vec![UserPrivilegeType::Create]
124124
));
125125
assert!(grant.verify_privilege(
126126
&GrantObject::Database("default".into(), "db1".into()),
127-
UserPrivilegeType::Create
127+
vec![UserPrivilegeType::Create]
128128
));
129129

130130
let grant = GrantEntry::new(
@@ -133,19 +133,19 @@ fn test_user_grant_entry() -> Result<()> {
133133
);
134134
assert!(grant.verify_privilege(
135135
&GrantObject::Table("default".into(), "db1".into(), "table1".into()),
136-
UserPrivilegeType::Create
136+
vec![UserPrivilegeType::Create]
137137
));
138138
assert!(!grant.verify_privilege(
139139
&GrantObject::Table("default".into(), "db2".into(), "table1".into()),
140-
UserPrivilegeType::Create
140+
vec![UserPrivilegeType::Create]
141141
));
142142
assert!(!grant.verify_privilege(
143143
&GrantObject::Table("default".into(), "db1".into(), "table1".into()),
144-
UserPrivilegeType::Insert
144+
vec![UserPrivilegeType::Insert]
145145
));
146146
assert!(grant.verify_privilege(
147147
&GrantObject::Table("default".into(), "db1".into(), "table1".into()),
148-
UserPrivilegeType::Create
148+
vec![UserPrivilegeType::Create]
149149
));
150150

151151
Ok(())
@@ -180,23 +180,23 @@ fn test_user_grant_set() -> Result<()> {
180180
assert_eq!(2, grants.entries().len());
181181
assert!(grants.verify_privilege(
182182
&GrantObject::Database("default".into(), "db1".into()),
183-
UserPrivilegeType::Create
183+
vec![UserPrivilegeType::Create]
184184
));
185185
assert!(!grants.verify_privilege(
186186
&GrantObject::Database("default".into(), "db1".into()),
187-
UserPrivilegeType::Select
187+
vec![UserPrivilegeType::Select]
188188
));
189189
assert!(grants.verify_privilege(
190190
&GrantObject::Table("default".into(), "db1".into(), "table1".into()),
191-
UserPrivilegeType::Create
191+
vec![UserPrivilegeType::Create]
192192
));
193193
assert!(!grants.verify_privilege(
194194
&GrantObject::Table("default".into(), "db1".into(), "table1".into()),
195-
UserPrivilegeType::Insert
195+
vec![UserPrivilegeType::Insert]
196196
));
197197
assert!(grants.verify_privilege(
198198
&GrantObject::Table("default".into(), "db1".into(), "table1".into()),
199-
UserPrivilegeType::Select
199+
vec![UserPrivilegeType::Select]
200200
));
201201
Ok(())
202202
}

‎src/query/ast/src/parser/statement.rs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1359,14 +1359,16 @@ pub fn priv_type(i: Input) -> IResult<UserPrivilegeType> {
13591359
value(UserPrivilegeType::Insert, rule! { INSERT }),
13601360
value(UserPrivilegeType::Update, rule! { UPDATE }),
13611361
value(UserPrivilegeType::Delete, rule! { DELETE }),
1362-
value(UserPrivilegeType::Drop, rule! { DROP }),
13631362
value(UserPrivilegeType::Alter, rule! { ALTER }),
13641363
value(UserPrivilegeType::Super, rule! { SUPER }),
13651364
value(UserPrivilegeType::CreateUser, rule! { CREATE ~ USER }),
1365+
value(UserPrivilegeType::DropUser, rule! { DROP ~ USER }),
13661366
value(UserPrivilegeType::CreateRole, rule! { CREATE ~ ROLE }),
1367+
value(UserPrivilegeType::DropRole, rule! { DROP ~ ROLE }),
13671368
value(UserPrivilegeType::Grant, rule! { GRANT }),
13681369
value(UserPrivilegeType::CreateStage, rule! { CREATE ~ STAGE }),
13691370
value(UserPrivilegeType::Set, rule! { SET }),
1371+
value(UserPrivilegeType::Drop, rule! { DROP }),
13701372
value(UserPrivilegeType::Create, rule! { CREATE }),
13711373
))(i)
13721374
}

‎src/query/ast/tests/it/testdata/statement-error.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,7 @@ error:
250250
--> SQL:1:15
251251
|
252252
1 | GRANT SELECT, ALL PRIVILEGES, CREATE ON * TO 'test-grant'@'localhost';
253-
| ----- ------ ^^^ expected `USAGE`, `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `DROP`, or 5 more ...
253+
| ----- ------ ^^^ expected `USAGE`, `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `ALTER`, or 5 more ...
254254
| | |
255255
| | while parsing <privileges> ON <privileges_level>
256256
| while parsing `GRANT { ROLE <role_name> | schemaObjectPrivileges | ALL [ PRIVILEGES ] ON <privileges_level> } TO { [ROLE <role_name>] | [USER] <user> }`
@@ -285,7 +285,7 @@ error:
285285
--> SQL:1:24
286286
|
287287
1 | REVOKE SELECT, CREATE, ALL PRIVILEGES ON * FROM 'test-grant'@'localhost';
288-
| ------ ------ ^^^ expected `USAGE`, `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `DROP`, or 5 more ...
288+
| ------ ------ ^^^ expected `USAGE`, `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `ALTER`, or 5 more ...
289289
| | |
290290
| | while parsing <privileges> ON <privileges_level>
291291
| while parsing `REVOKE { ROLE <role_name> | schemaObjectPrivileges | ALL [ PRIVILEGES ] ON <privileges_level> } FROM { [ROLE <role_name>] | [USER] <user> }`

0 commit comments

Comments
 (0)