remove all_priv; sort in testserver; use one user in tests

denik · denik · commit eb219976552e · 2025-11-05T18:00:59.000+01:00
diff --git a/acceptance/bundle/resources/grants/schemas/update/databricks.yml.tmpl b/acceptance/bundle/resources/grants/schemas/update/databricks.yml.tmpl
@@ -11,5 +11,3 @@ resources:
           privileges:
             - CREATE_TABLE
             - USE_SCHEMA
-        - principal: pieter.noordhuis@databricks.com
-          privileges: ["USE_SCHEMA"]
diff --git a/acceptance/bundle/resources/grants/schemas/update/out.deploy1.requests.direct.json b/acceptance/bundle/resources/grants/schemas/update/out.deploy1.requests.direct.json
@@ -10,37 +10,7 @@
         ],
         "principal": "denis.bilenko@databricks.com",
         "remove": [
-          "ALL_PRIVILEGES",
-          "APPLY_TAG",
-          "CREATE_FUNCTION",
-          "CREATE_VOLUME",
-          "EXECUTE",
-          "MANAGE",
-          "MODIFY",
-          "READ_VOLUME",
-          "REFRESH",
-          "SELECT",
-          "WRITE_VOLUME"
-        ]
-      },
-      {
-        "add": [
-          "USE_SCHEMA"
-        ],
-        "principal": "pieter.noordhuis@databricks.com",
-        "remove": [
-          "ALL_PRIVILEGES",
-          "APPLY_TAG",
-          "CREATE_FUNCTION",
-          "CREATE_TABLE",
-          "CREATE_VOLUME",
-          "EXECUTE",
-          "MANAGE",
-          "MODIFY",
-          "READ_VOLUME",
-          "REFRESH",
-          "SELECT",
-          "WRITE_VOLUME"
+          "ALL_PRIVILEGES"
         ]
       }
     ]
diff --git a/acceptance/bundle/resources/grants/schemas/update/out.deploy1.requests.terraform.json b/acceptance/bundle/resources/grants/schemas/update/out.deploy1.requests.terraform.json
@@ -9,12 +9,6 @@
           "USE_SCHEMA"
         ],
         "principal": "denis.bilenko@databricks.com"
-      },
-      {
-        "add": [
-          "USE_SCHEMA"
-        ],
-        "principal": "pieter.noordhuis@databricks.com"
       }
     ]
   }
diff --git a/acceptance/bundle/resources/grants/schemas/update/out.deploy2.requests.direct.json b/acceptance/bundle/resources/grants/schemas/update/out.deploy2.requests.direct.json
@@ -10,37 +10,7 @@
         ],
         "principal": "denis.bilenko@databricks.com",
         "remove": [
-          "ALL_PRIVILEGES",
-          "CREATE_FUNCTION",
-          "CREATE_VOLUME",
-          "EXECUTE",
-          "MANAGE",
-          "MODIFY",
-          "READ_VOLUME",
-          "REFRESH",
-          "SELECT",
-          "USE_SCHEMA",
-          "WRITE_VOLUME"
-        ]
-      },
-      {
-        "add": [
-          "CREATE_VOLUME",
-          "MANAGE"
-        ],
-        "principal": "pieter.noordhuis@databricks.com",
-        "remove": [
-          "ALL_PRIVILEGES",
-          "APPLY_TAG",
-          "CREATE_FUNCTION",
-          "CREATE_TABLE",
-          "EXECUTE",
-          "MODIFY",
-          "READ_VOLUME",
-          "REFRESH",
-          "SELECT",
-          "USE_SCHEMA",
-          "WRITE_VOLUME"
+          "ALL_PRIVILEGES"
         ]
       }
     ]
diff --git a/acceptance/bundle/resources/grants/schemas/update/out.deploy2.requests.terraform.json b/acceptance/bundle/resources/grants/schemas/update/out.deploy2.requests.terraform.json
@@ -11,16 +11,6 @@
         "remove": [
           "USE_SCHEMA"
         ]
-      },
-      {
-        "add": [
-          "CREATE_VOLUME",
-          "MANAGE"
-        ],
-        "principal": "pieter.noordhuis@databricks.com",
-        "remove": [
-          "USE_SCHEMA"
-        ]
       }
     ]
   }
diff --git a/acceptance/bundle/resources/grants/schemas/update/out.destroy.requests.terraform.json b/acceptance/bundle/resources/grants/schemas/update/out.destroy.requests.terraform.json
@@ -9,13 +9,6 @@
           "CREATE_TABLE",
           "APPLY_TAG"
         ]
-      },
-      {
-        "principal": "pieter.noordhuis@databricks.com",
-        "remove": [
-          "CREATE_VOLUME",
-          "MANAGE"
-        ]
       }
     ]
   }
diff --git a/acceptance/bundle/resources/grants/schemas/update/out.plan1.direct.json b/acceptance/bundle/resources/grants/schemas/update/out.plan1.direct.json
@@ -28,12 +28,6 @@
                 "CREATE_TABLE",
                 "USE_SCHEMA"
               ]
-            },
-            {
-              "principal": "pieter.noordhuis@databricks.com",
-              "privileges": [
-                "USE_SCHEMA"
-              ]
             }
           ]
         },
diff --git a/acceptance/bundle/resources/grants/schemas/update/out.plan2.direct.json b/acceptance/bundle/resources/grants/schemas/update/out.plan2.direct.json
@@ -32,13 +32,6 @@
                 "CREATE_TABLE",
                 "APPLY_TAG"
               ]
-            },
-            {
-              "principal": "pieter.noordhuis@databricks.com",
-              "privileges": [
-                "CREATE_VOLUME",
-                "MANAGE"
-              ]
             }
           ]
         }
@@ -53,22 +46,13 @@
               "CREATE_TABLE",
               "USE_SCHEMA"
             ]
-          },
-          {
-            "principal": "pieter.noordhuis@databricks.com",
-            "privileges": [
-              "USE_SCHEMA"
-            ]
           }
         ]
       },
       "changes": {
         "local": {
           "grants[0].privileges[1]": {
             "action": "update"
-          },
-          "grants[1].privileges": {
-            "action": "update"
           }
         }
       }
diff --git a/acceptance/bundle/resources/grants/schemas/update/output.txt b/acceptance/bundle/resources/grants/schemas/update/output.txt
@@ -11,6 +11,19 @@ Deployment complete!
 
 >>> print_requests.py /permissions
 
+>>> [CLI] grants get schema main.schema_grants_[UNIQUE_NAME]
+{
+  "privilege_assignments": [
+    {
+      "principal": "denis.bilenko@databricks.com",
+      "privileges": [
+        "CREATE_TABLE",
+        "USE_SCHEMA"
+      ]
+    }
+  ]
+}
+
 >>> [CLI] bundle debug plan
 
 >>> print_requests.py /permissions
@@ -23,6 +36,19 @@ Deployment complete!
 
 >>> print_requests.py /permissions
 
+>>> [CLI] grants get schema main.schema_grants_[UNIQUE_NAME]
+{
+  "privilege_assignments": [
+    {
+      "principal": "denis.bilenko@databricks.com",
+      "privileges": [
+        "APPLY_TAG",
+        "CREATE_TABLE"
+      ]
+    }
+  ]
+}
+
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
   delete schema grants_schema
diff --git a/acceptance/bundle/resources/grants/schemas/update/script b/acceptance/bundle/resources/grants/schemas/update/script
@@ -5,7 +5,10 @@ trace print_requests.py /permissions > out.plan1.requests.$DATABRICKS_BUNDLE_ENG
 trace $CLI bundle deploy
 trace print_requests.py /permissions > out.deploy1.requests.$DATABRICKS_BUNDLE_ENGINE.json
 
-update_file.py databricks.yml '["USE_SCHEMA"]' '["CREATE_VOLUME", "MANAGE"]'
+# Since we're sending different requests between terraform and direct, assert that the end result is the same:
+trace $CLI grants get schema main.schema_grants_$UNIQUE_NAME | jq --sort-keys
+
+#update_file.py databricks.yml '["USE_SCHEMA"]' '["CREATE_VOLUME", "MANAGE"]'
 update_file.py databricks.yml USE_SCHEMA APPLY_TAG
 
 # different on cloud vs local due to remote state
@@ -15,5 +18,7 @@ trace print_requests.py /permissions > out.plan2.requests.$DATABRICKS_BUNDLE_ENG
 trace $CLI bundle deploy
 trace print_requests.py /permissions > out.deploy2.requests.$DATABRICKS_BUNDLE_ENGINE.json
 
+trace $CLI grants get schema main.schema_grants_$UNIQUE_NAME | jq --sort-keys
+
 trace $CLI bundle destroy --auto-approve
 trace print_requests.py /permissions > out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json
diff --git a/bundle/direct/dresources/grants.go b/bundle/direct/dresources/grants.go
@@ -274,19 +274,23 @@ func (r *ResourceGrants) createIdempotentGrantChanges(state *GrantsState) []cata
 		// ADD: all privileges specified in config for this principal
 		add = append(add, desiredPrivs...)
 
-		// REMOVE: all other possible privileges not in config
-		for _, priv := range allPrivileges {
-			found := false
-			for _, desired := range desiredPrivs {
-				if priv == desired {
-					found = true
-					break
+		remove = append(remove, catalog.PrivilegeAllPrivileges)
+		/*
+
+			// REMOVE: all other possible privileges not in config
+			for _, priv := range allPrivileges {
+				found := false
+				for _, desired := range desiredPrivs {
+					if priv == desired {
+						found = true
+						break
+					}
+				}
+				if !found {
+					remove = append(remove, priv)
 				}
 			}
-			if !found {
-				remove = append(remove, priv)
-			}
-		}
+		*/
 
 		// No need to sort since privileges maintain order from input
 
diff --git a/libs/testserver/grants.go b/libs/testserver/grants.go

Original file line number	Diff line number	Diff line change
`@@ -9,12 +9,6 @@`
`9`	`9`	`"USE_SCHEMA"`
`10`	`10`	`],`
`11`	`11`	`"principal": "denis.bilenko@databricks.com"`
`12`		`- },`
`13`		`- {`
`14`		`- "add": [`
`15`		`- "USE_SCHEMA"`
`16`		`- ],`
`17`		`- "principal": "pieter.noordhuis@databricks.com"`
`18`	`12`	`}`
`19`	`13`	`]`
`20`	`14`	`}`
Original file line number	Diff line number	Diff line change
`@@ -11,16 +11,6 @@`
`11`	`11`	`"remove": [`
`12`	`12`	`"USE_SCHEMA"`
`13`	`13`	`]`
`14`		`- },`
`15`		`- {`
`16`		`- "add": [`
`17`		`- "CREATE_VOLUME",`
`18`		`- "MANAGE"`
`19`		`- ],`
`20`		`- "principal": "pieter.noordhuis@databricks.com",`
`21`		`- "remove": [`
`22`		`- "USE_SCHEMA"`
`23`		`- ]`
`24`	`14`	`}`
`25`	`15`	`]`
`26`	`16`	`}`
Original file line number	Diff line number	Diff line change
`@@ -9,13 +9,6 @@`
`9`	`9`	`"CREATE_TABLE",`
`10`	`10`	`"APPLY_TAG"`
`11`	`11`	`]`
`12`		`- },`
`13`		`- {`
`14`		`- "principal": "pieter.noordhuis@databricks.com",`
`15`		`- "remove": [`
`16`		`- "CREATE_VOLUME",`
`17`		`- "MANAGE"`
`18`		`- ]`
`19`	`12`	`}`
`20`	`13`	`]`
`21`	`14`	`}`
Original file line number	Diff line number	Diff line change
`@@ -28,12 +28,6 @@`
`28`	`28`	`"CREATE_TABLE",`
`29`	`29`	`"USE_SCHEMA"`
`30`	`30`	`]`
`31`		`- },`
`32`		`- {`
`33`		`- "principal": "pieter.noordhuis@databricks.com",`
`34`		`- "privileges": [`
`35`		`- "USE_SCHEMA"`
`36`		`- ]`
`37`	`31`	`}`
`38`	`32`	`]`
`39`	`33`	`},`
Original file line number	Diff line number	Diff line change
`@@ -32,13 +32,6 @@`
`32`	`32`	`"CREATE_TABLE",`
`33`	`33`	`"APPLY_TAG"`
`34`	`34`	`]`
`35`		`- },`
`36`		`- {`
`37`		`- "principal": "pieter.noordhuis@databricks.com",`
`38`		`- "privileges": [`
`39`		`- "CREATE_VOLUME",`
`40`		`- "MANAGE"`
`41`		`- ]`
`42`	`35`	`}`
`43`	`36`	`]`
`44`	`37`	`}`
`@@ -53,22 +46,13 @@`
`53`	`46`	`"CREATE_TABLE",`
`54`	`47`	`"USE_SCHEMA"`
`55`	`48`	`]`
`56`		`- },`
`57`		`- {`
`58`		`- "principal": "pieter.noordhuis@databricks.com",`
`59`		`- "privileges": [`
`60`		`- "USE_SCHEMA"`
`61`		`- ]`
`62`	`49`	`}`
`63`	`50`	`]`
`64`	`51`	`},`
`65`	`52`	`"changes": {`
`66`	`53`	`"local": {`
`67`	`54`	`"grants[0].privileges[1]": {`
`68`	`55`	`"action": "update"`
`69`		`- },`
`70`		`- "grants[1].privileges": {`
`71`		`- "action": "update"`
`72`	`56`	`}`
`73`	`57`	`}`
`74`	`58`	`}`