Skip to content

Commit 5b53d18

Browse files
author
James Cor
committed
implement ignore and if exists
1 parent c40ee75 commit 5b53d18

File tree

4 files changed

+136
-29
lines changed

4 files changed

+136
-29
lines changed

‎enginetest/queries/priv_auth_queries.go‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1230,6 +1230,27 @@ var UserPrivTests = []UserPrivilegeTest{
12301230
Query: "SELECT User, Host, Select_priv FROM mysql.user WHERE User = 'tester';",
12311231
Expected: []sql.Row{{"tester", "localhost", "N"}},
12321232
},
1233+
1234+
{
1235+
// Re-revoking does nothing
1236+
User: "root",
1237+
Host: "localhost",
1238+
Query: "REVOKE SELECT ON *.* FROM tester@localhost;",
1239+
Expected: []sql.Row{{types.NewOkResult(0)}},
1240+
},
1241+
{
1242+
// IF EXISTS option does nothing
1243+
User: "root",
1244+
Host: "localhost",
1245+
Query: "REVOKE IF EXISTS SELECT ON *.* FROM tester@localhost;",
1246+
Expected: []sql.Row{{types.NewOkResult(0)}},
1247+
},
1248+
{
1249+
User: "root",
1250+
Host: "localhost",
1251+
Query: "SELECT User, Host, Select_priv FROM mysql.user WHERE User = 'tester';",
1252+
Expected: []sql.Row{{"tester", "localhost", "N"}},
1253+
},
12331254
},
12341255
},
12351256
{
@@ -1325,6 +1346,39 @@ var UserPrivTests = []UserPrivilegeTest{
13251346
Query: "SELECT User, Host, Select_priv, Insert_priv, Grant_priv FROM mysql.user WHERE User = 'tester2';",
13261347
Expected: []sql.Row{{"tester2", "localhost", "N", "N", "N"}},
13271348
},
1349+
{
1350+
// Re-revoking does nothing
1351+
User: "root",
1352+
Host: "localhost",
1353+
Query: "REVOKE ALL PRIVILEGES, GRANT OPTION FROM tester2@localhost;",
1354+
Expected: []sql.Row{{types.NewOkResult(0)}},
1355+
},
1356+
{
1357+
// IF EXISTS does nothing
1358+
User: "root",
1359+
Host: "localhost",
1360+
Query: "REVOKE IF EXISTS ALL PRIVILEGES, GRANT OPTION FROM tester2@localhost;",
1361+
Expected: []sql.Row{{types.NewOkResult(0)}},
1362+
},
1363+
{
1364+
User: "root",
1365+
Host: "localhost",
1366+
Query: "SELECT User, Host, Select_priv, Insert_priv, Grant_priv FROM mysql.user WHERE User = 'tester2';",
1367+
Expected: []sql.Row{{"tester2", "localhost", "N", "N", "N"}},
1368+
},
1369+
{
1370+
User: "root",
1371+
Host: "localhost",
1372+
Query: "REVOKE IF EXISTS ALL PRIVILEGES, GRANT OPTION FROM fake1@localhost, fake2@localhost, fake3@localhost;",
1373+
ExpectedErr: sql.ErrRevokeUserDoesNotExist,
1374+
},
1375+
{
1376+
// TODO: check warnings
1377+
User: "root",
1378+
Host: "localhost",
1379+
Query: "REVOKE IF EXISTS ALL PRIVILEGES, GRANT OPTION FROM fake1@localhost, fake2@localhost, fake3@localhost IGNORE UNKNOWN USER;",
1380+
Expected: []sql.Row{{types.NewOkResult(0)}},
1381+
},
13281382
},
13291383
},
13301384
{
@@ -1444,6 +1498,32 @@ var UserPrivTests = []UserPrivilegeTest{
14441498
Query: "SELECT COUNT(*) FROM mysql.user WHERE User = 'tester';",
14451499
Expected: []sql.Row{{1}},
14461500
},
1501+
{
1502+
User: "root",
1503+
Host: "localhost",
1504+
Query: "REVOKE fake_role FROM tester@localhost;",
1505+
ExpectedErr: sql.ErrGrantRevokeRoleDoesNotExist,
1506+
},
1507+
{
1508+
// TODO: check for warning
1509+
User: "root",
1510+
Host: "localhost",
1511+
Query: "REVOKE IF EXISTS fake_role FROM tester@localhost;",
1512+
Expected: []sql.Row{{types.NewOkResult(0)}},
1513+
},
1514+
{
1515+
User: "root",
1516+
Host: "localhost",
1517+
Query: "REVOKE test_role FROM fake_user@localhost;",
1518+
ExpectedErr: sql.ErrGrantRevokeRoleDoesNotExist,
1519+
},
1520+
{
1521+
// TODO: check for warning
1522+
User: "root",
1523+
Host: "localhost",
1524+
Query: "REVOKE test_role FROM fake_user@localhost IGNORE UNKNOWN USER;",
1525+
Expected: []sql.Row{{types.NewOkResult(0)}},
1526+
},
14471527
},
14481528
},
14491529
{

‎sql/plan/revoke.go‎

Lines changed: 26 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,12 @@ import (
2626

2727
// Revoke represents the statement REVOKE [privilege...] ON [item] FROM [user...].
2828
type Revoke struct {
29-
Privileges []Privilege
30-
ObjectType ObjectType
31-
PrivilegeLevel PrivilegeLevel
32-
Users []UserName
33-
MySQLDb sql.Database
29+
Privileges []Privilege
30+
ObjectType ObjectType
31+
PrivilegeLevel PrivilegeLevel
32+
Users []UserName
33+
IgnoreUnknownUser bool
34+
MySQLDb sql.Database
3435
}
3536

3637
var _ sql.Node = (*Revoke)(nil)
@@ -497,9 +498,11 @@ func (*RevokeAll) CollationCoercibility(ctx *sql.Context) (collation sql.Collati
497498

498499
// RevokeRole represents the statement REVOKE [role...] FROM [user...].
499500
type RevokeRole struct {
500-
Roles []UserName
501-
TargetUsers []UserName
502-
MySQLDb sql.Database
501+
Roles []UserName
502+
TargetUsers []UserName
503+
IfExists bool
504+
IgnoreUnknownUser bool
505+
MySQLDb sql.Database
503506
}
504507

505508
var _ sql.Node = (*RevokeRole)(nil)
@@ -508,11 +511,13 @@ var _ sql.CollationCoercible = (*RevokeRole)(nil)
508511
var _ sql.AuthorizationCheckerNode = (*RevokeRole)(nil)
509512

510513
// NewRevokeRole returns a new RevokeRole node.
511-
func NewRevokeRole(roles []UserName, users []UserName) *RevokeRole {
514+
func NewRevokeRole(roles []UserName, users []UserName, ifExists, ignoreUnknownUser bool) *RevokeRole {
512515
return &RevokeRole{
513-
Roles: roles,
514-
TargetUsers: users,
515-
MySQLDb: sql.UnresolvedDatabase("mysql"),
516+
Roles: roles,
517+
TargetUsers: users,
518+
IfExists: ifExists,
519+
IgnoreUnknownUser: ignoreUnknownUser,
520+
MySQLDb: sql.UnresolvedDatabase("mysql"),
516521
}
517522
}
518523

@@ -613,19 +618,23 @@ func (*RevokeRole) CollationCoercibility(ctx *sql.Context) (collation sql.Collat
613618

614619
// RevokeProxy represents the statement REVOKE PROXY.
615620
type RevokeProxy struct {
616-
On UserName
617-
From []UserName
621+
On UserName
622+
From []UserName
623+
IfExists bool
624+
ignoreUnknownUser bool
618625
}
619626

620627
var _ sql.Node = (*RevokeProxy)(nil)
621628
var _ sql.CollationCoercible = (*RevokeProxy)(nil)
622629
var _ sql.AuthorizationCheckerNode = (*RevokeProxy)(nil)
623630

624631
// NewRevokeProxy returns a new RevokeProxy node.
625-
func NewRevokeProxy(on UserName, from []UserName) *RevokeProxy {
632+
func NewRevokeProxy(on UserName, from []UserName, ifExists, ignoreUnknownUser bool) *RevokeProxy {
626633
return &RevokeProxy{
627-
On: on,
628-
From: from,
634+
On: on,
635+
From: from,
636+
IfExists: ifExists,
637+
ignoreUnknownUser: ignoreUnknownUser,
629638
}
630639
}
631640

‎sql/planbuilder/priv.go‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -516,11 +516,12 @@ func (b *Builder) buildRevokePrivilege(inScope *scope, n *ast.RevokePrivilege) (
516516
}
517517
outScope = inScope.push()
518518
outScope.node = &plan.Revoke{
519-
Privileges: privs,
520-
ObjectType: objType,
521-
PrivilegeLevel: level,
522-
Users: users,
523-
MySQLDb: b.resolveDb("mysql"),
519+
Privileges: privs,
520+
ObjectType: objType,
521+
PrivilegeLevel: level,
522+
Users: users,
523+
IgnoreUnknownUser: n.IgnoreUnknownUser,
524+
MySQLDb: b.resolveDb("mysql"),
524525
}
525526
n.Auth.Extra = outScope.node
526527
if err := b.cat.AuthorizationHandler().HandleAuth(b.ctx, b.authQueryState, n.Auth); err != nil && b.authEnabled {
@@ -542,9 +543,11 @@ func (b *Builder) buildRevokeAllPrivileges(inScope *scope, n *ast.RevokeAllPrivi
542543
func (b *Builder) buildRevokeRole(inScope *scope, n *ast.RevokeRole) (outScope *scope) {
543544
outScope = inScope.push()
544545
outScope.node = &plan.RevokeRole{
545-
Roles: convertAccountName(n.Roles...),
546-
TargetUsers: convertAccountName(n.From...),
547-
MySQLDb: b.resolveDb("mysql"),
546+
Roles: convertAccountName(n.Roles...),
547+
TargetUsers: convertAccountName(n.From...),
548+
IfExists: n.IfExists,
549+
IgnoreUnknownUser: n.IgnoreUnknownUser,
550+
MySQLDb: b.resolveDb("mysql"),
548551
}
549552
n.Auth.Extra = outScope.node
550553
if err := b.cat.AuthorizationHandler().HandleAuth(b.ctx, b.authQueryState, n.Auth); err != nil && b.authEnabled {
@@ -558,7 +561,7 @@ func (b *Builder) buildRevokeProxy(inScope *scope, n *ast.RevokeProxy) (outScope
558561
b.handleErr(err)
559562
}
560563
outScope = inScope.push()
561-
outScope.node = plan.NewRevokeProxy(convertAccountName(n.On)[0], convertAccountName(n.From...))
564+
outScope.node = plan.NewRevokeProxy(convertAccountName(n.On)[0], convertAccountName(n.From...), n.IfExists, n.IgnoreUnknownUser)
562565
return
563566
}
564567

‎sql/rowexec/priv.go‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,12 +88,22 @@ func (b *BaseBuilder) buildRevokeRole(ctx *sql.Context, n *plan.RevokeRole, row
8888
for _, targetUser := range n.TargetUsers {
8989
user := mysqlDb.GetUser(editor, targetUser.Name, targetUser.Host, false)
9090
if user == nil {
91-
return nil, sql.ErrGrantRevokeRoleDoesNotExist.New(targetUser.String("`"))
91+
err := sql.ErrGrantRevokeRoleDoesNotExist.New(targetUser.String("`"))
92+
if n.IgnoreUnknownUser {
93+
ctx.Warn(1362, err.Error())
94+
continue
95+
}
96+
return nil, err
9297
}
9398
for _, targetRole := range n.Roles {
9499
role := mysqlDb.GetUser(editor, targetRole.Name, targetRole.Host, true)
95100
if role == nil {
96-
return nil, sql.ErrGrantRevokeRoleDoesNotExist.New(targetRole.String("`"))
101+
err := sql.ErrGrantRevokeRoleDoesNotExist.New(targetUser.String("`"))
102+
if n.IfExists {
103+
ctx.Warn(3523, err.Error())
104+
continue
105+
}
106+
return nil, err
97107
}
98108
//TODO: if a role is mentioned in the "mandatory_roles" system variable then they cannot be revoked
99109
editor.RemoveRoleEdge(mysql_db.RoleEdgesPrimaryKey{
@@ -210,7 +220,12 @@ func (b *BaseBuilder) buildRevoke(ctx *sql.Context, n *plan.Revoke, row sql.Row)
210220
for _, revokeUser := range n.Users {
211221
user := mysqlDb.GetUser(editor, revokeUser.Name, revokeUser.Host, false)
212222
if user == nil {
213-
return nil, sql.ErrGrantUserDoesNotExist.New()
223+
err := sql.ErrRevokeUserDoesNotExist.New(revokeUser.Name, revokeUser.Host)
224+
if n.IgnoreUnknownUser {
225+
ctx.Warn(3162, err.Error())
226+
continue
227+
}
228+
return nil, err
214229
}
215230
users = append(users, user)
216231
}

0 commit comments

Comments
 (0)