Skip to content

Commit 4f41f5e

Browse files
annrpomannrpom
committed
sql: add show default privileges for grantee
Previously, `SHOW DEFAULT PRIVILEGES [FOR <ROLE|USER|ALL ROLES>]` statements were supported. However, support for finding default privileges for a grantee did not exist. This patch adds a new syntax for showing the default privileges that a grantee received. Fixes: cockroachdb#107741 Epic: CRDB-25481 Release note (sql change): This adds a new syntax to `SHOW DEFAULT PRIVILEGES`, `SHOW DEFAULT PRIVILEGES FOR GRANTEE <grantee>`, that shows the default privileges that a grantee received.
1 parent e9add29 commit 4f41f5e

File tree

7 files changed

+326
-191
lines changed

7 files changed

+326
-191
lines changed

‎docs/generated/sql/bnf/show_default_privileges_stmt.bnf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,5 @@ show_default_privileges_stmt ::=
22
'SHOW' 'DEFAULT' 'PRIVILEGES' 'FOR' 'ROLE' role_spec_list ( 'IN' 'SCHEMA' ( ( qualifiable_schema_name ) ( ( ',' qualifiable_schema_name ) )* ) | )
33
| 'SHOW' 'DEFAULT' 'PRIVILEGES' 'FOR' 'USER' role_spec_list ( 'IN' 'SCHEMA' ( ( qualifiable_schema_name ) ( ( ',' qualifiable_schema_name ) )* ) | )
44
| 'SHOW' 'DEFAULT' 'PRIVILEGES' ( 'IN' 'SCHEMA' ( ( qualifiable_schema_name ) ( ( ',' qualifiable_schema_name ) )* ) | )
5+
| 'SHOW' 'DEFAULT' 'PRIVILEGES' 'FOR' 'GRANTEE' role_spec_list ( 'IN' 'SCHEMA' ( ( qualifiable_schema_name ) ( ( ',' qualifiable_schema_name ) )* ) | )
56
| 'SHOW' 'DEFAULT' 'PRIVILEGES' 'FOR' 'ALL' 'ROLES' ( 'IN' 'SCHEMA' ( ( qualifiable_schema_name ) ( ( ',' qualifiable_schema_name ) )* ) | )

‎docs/generated/sql/bnf/stmt_block.bnf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -954,6 +954,7 @@ show_full_scans_stmt ::=
954954

955955
show_default_privileges_stmt ::=
956956
'SHOW' 'DEFAULT' 'PRIVILEGES' opt_for_roles opt_in_schema
957+
| 'SHOW' 'DEFAULT' 'PRIVILEGES' 'FOR' 'GRANTEE' role_spec_list opt_in_schema
957958
| 'SHOW' 'DEFAULT' 'PRIVILEGES' 'FOR' 'ALL' 'ROLES' opt_in_schema
958959

959960
opt_table ::=
@@ -1145,6 +1146,7 @@ unreserved_keyword ::=
11451146
| 'GEOMETRYCOLLECTIONZM'
11461147
| 'GLOBAL'
11471148
| 'GOAL'
1149+
| 'GRANTEE'
11481150
| 'GRANTS'
11491151
| 'GROUPS'
11501152
| 'HASH'
@@ -3667,6 +3669,7 @@ bare_label_keywords ::=
36673669
| 'GEOMETRYZM'
36683670
| 'GLOBAL'
36693671
| 'GOAL'
3672+
| 'GRANTEE'
36703673
| 'GRANTS'
36713674
| 'GREATEST'
36723675
| 'GROUPING'

‎pkg/sql/delegate/show_default_privileges.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,20 @@ func (d *delegator) delegateShowDefaultPrivileges(
4444
if n.ForAllRoles {
4545
query += " AND for_all_roles=true"
4646
} else if len(n.Roles) > 0 {
47+
targetCol := "grantee"
48+
if !n.ForGrantee {
49+
targetCol = "role"
50+
query += " AND for_all_roles=false"
51+
}
52+
4753
targetRoles, err := decodeusername.FromRoleSpecList(
4854
d.evalCtx.SessionData(), username.PurposeValidation, n.Roles,
4955
)
5056
if err != nil {
5157
return nil, err
5258
}
5359

54-
query = fmt.Sprintf("%s AND for_all_roles=false AND role IN (", query)
60+
query = fmt.Sprintf("%s AND %s IN (", query, targetCol)
5561
for i, role := range targetRoles {
5662
if i != 0 {
5763
query += fmt.Sprintf(", '%s'", role.Normalized())

‎pkg/sql/logictest/testdata/logic_test/show_default_privileges‎

Lines changed: 257 additions & 187 deletions
Large diffs are not rendered by default.

‎pkg/sql/parser/sql.y‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -935,7 +935,7 @@ func (u *sqlSymUnion) showCreateFormatOption() tree.ShowCreateFormatOption {
935935

936936
%token <str> GENERATED GEOGRAPHY GEOMETRY GEOMETRYM GEOMETRYZ GEOMETRYZM
937937
%token <str> GEOMETRYCOLLECTION GEOMETRYCOLLECTIONM GEOMETRYCOLLECTIONZ GEOMETRYCOLLECTIONZM
938-
%token <str> GLOBAL GOAL GRANT GRANTS GREATEST GROUP GROUPING GROUPS
938+
%token <str> GLOBAL GOAL GRANT GRANTEE GRANTS GREATEST GROUP GROUPING GROUPS
939939

940940
%token <str> HAVING HASH HEADER HIGH HISTOGRAM HOLD HOUR
941941

@@ -7824,13 +7824,21 @@ show_databases_stmt:
78247824
// %Help: SHOW DEFAULT PRIVILEGES - list default privileges
78257825
// %Category: DDL
78267826
// %Text: SHOW DEFAULT PRIVILEGES
7827+
// %SeeAlso: WEBDOCS/show-default-privileges
78277828
show_default_privileges_stmt:
78287829
SHOW DEFAULT PRIVILEGES opt_for_roles opt_in_schema {
78297830
$$.val = &tree.ShowDefaultPrivileges{
78307831
Roles: $4.roleSpecList(),
78317832
Schema: tree.Name($5),
78327833
}
78337834
}
7835+
| SHOW DEFAULT PRIVILEGES FOR GRANTEE role_spec_list opt_in_schema {
7836+
$$.val = &tree.ShowDefaultPrivileges{
7837+
Roles: $6.roleSpecList(),
7838+
ForGrantee: true,
7839+
Schema: tree.Name($7),
7840+
}
7841+
}
78347842
| SHOW DEFAULT PRIVILEGES FOR ALL ROLES opt_in_schema {
78357843
$$.val = &tree.ShowDefaultPrivileges{
78367844
ForAllRoles: true,
@@ -9117,7 +9125,6 @@ for_grantee_clause:
91179125
$$.val = tree.RoleSpecList(nil)
91189126
}
91199127

9120-
91219128
// %Help: PAUSE - pause background tasks
91229129
// %Category: Group
91239130
// %Text: PAUSE JOBS, PAUSE SCHEDULES, PAUSE ALL JOBS
@@ -16655,6 +16662,7 @@ unreserved_keyword:
1665516662
| GEOMETRYCOLLECTIONZM
1665616663
| GLOBAL
1665716664
| GOAL
16665+
| GRANTEE
1665816666
| GRANTS
1665916667
| GROUPS
1666016668
| HASH
@@ -17166,6 +17174,7 @@ bare_label_keywords:
1716617174
| GEOMETRYZM
1716717175
| GLOBAL
1716817176
| GOAL
17177+
| GRANTEE
1716917178
| GRANTS
1717017179
| GREATEST
1717117180
| GROUPING

‎pkg/sql/parser/testdata/show_default_privileges‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,38 @@ SHOW DEFAULT PRIVILEGES FOR ALL ROLES -- fully parenthesized
4646
SHOW DEFAULT PRIVILEGES FOR ALL ROLES -- literals removed
4747
SHOW DEFAULT PRIVILEGES FOR ALL ROLES -- identifiers removed
4848

49+
parse
50+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo
51+
----
52+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo -- normalized!
53+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo -- fully parenthesized
54+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo -- literals removed
55+
SHOW DEFAULT PRIVILEGES FOR GRANTEE _ -- identifiers removed
56+
57+
parse
58+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar
59+
----
60+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar -- normalized!
61+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar -- fully parenthesized
62+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar -- literals removed
63+
SHOW DEFAULT PRIVILEGES FOR GRANTEE _, _ -- identifiers removed
64+
65+
parse
66+
SHOW DEFAULT PRIVILEGES FOR GRANTEE fOo, baR
67+
----
68+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar -- normalized!
69+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar -- fully parenthesized
70+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar -- literals removed
71+
SHOW DEFAULT PRIVILEGES FOR GRANTEE _, _ -- identifiers removed
72+
73+
parse
74+
SHOW DEFAULT PRIVILEGES FOR GRANTEE "fOo", "baR"
75+
----
76+
SHOW DEFAULT PRIVILEGES FOR GRANTEE "fOo", "baR" -- normalized!
77+
SHOW DEFAULT PRIVILEGES FOR GRANTEE "fOo", "baR" -- fully parenthesized
78+
SHOW DEFAULT PRIVILEGES FOR GRANTEE "fOo", "baR" -- literals removed
79+
SHOW DEFAULT PRIVILEGES FOR GRANTEE _, _ -- identifiers removed
80+
4981
parse
5082
SHOW DEFAULT PRIVILEGES IN SCHEMA s
5183
----
@@ -69,3 +101,11 @@ SHOW DEFAULT PRIVILEGES FOR ALL ROLES IN SCHEMA s
69101
SHOW DEFAULT PRIVILEGES FOR ALL ROLES IN SCHEMA s -- fully parenthesized
70102
SHOW DEFAULT PRIVILEGES FOR ALL ROLES IN SCHEMA s -- literals removed
71103
SHOW DEFAULT PRIVILEGES FOR ALL ROLES IN SCHEMA _ -- identifiers removed
104+
105+
parse
106+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar IN SCHEMA s
107+
----
108+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar IN SCHEMA s
109+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar IN SCHEMA s -- fully parenthesized
110+
SHOW DEFAULT PRIVILEGES FOR GRANTEE foo, bar IN SCHEMA s -- literals removed
111+
SHOW DEFAULT PRIVILEGES FOR GRANTEE _, _ IN SCHEMA _ -- identifiers removed

‎pkg/sql/sem/tree/show.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1322,6 +1322,7 @@ func (n *ShowSchedules) Format(ctx *FmtCtx) {
13221322
type ShowDefaultPrivileges struct {
13231323
Roles RoleSpecList
13241324
ForAllRoles bool
1325+
ForGrantee bool
13251326
// If Schema is not specified, SHOW DEFAULT PRIVILEGES is being
13261327
// run on the current database.
13271328
Schema Name
@@ -1333,7 +1334,12 @@ var _ Statement = &ShowDefaultPrivileges{}
13331334
func (n *ShowDefaultPrivileges) Format(ctx *FmtCtx) {
13341335
ctx.WriteString("SHOW DEFAULT PRIVILEGES ")
13351336
if len(n.Roles) > 0 {
1336-
ctx.WriteString("FOR ROLE ")
1337+
if n.ForGrantee {
1338+
ctx.WriteString("FOR GRANTEE ")
1339+
} else {
1340+
ctx.WriteString("FOR ROLE ")
1341+
}
1342+
13371343
for i := range n.Roles {
13381344
if i > 0 {
13391345
ctx.WriteString(", ")

0 commit comments

Comments
 (0)