diff --git a/contrib/babelfishpg_tsql/sql/ownership.sql b/contrib/babelfishpg_tsql/sql/ownership.sql index ee3a5446a4..a632a91815 100644 --- a/contrib/babelfishpg_tsql/sql/ownership.sql +++ b/contrib/babelfishpg_tsql/sql/ownership.sql @@ -17,11 +17,11 @@ GRANT SELECT on sys.babelfish_sysdatabases TO PUBLIC; -- BABELFISH_SCHEMA_PERMISSIONS CREATE TABLE sys.babelfish_schema_permissions ( dbid smallint NOT NULL, - schema_name NAME NOT NULL, - object_name NAME NOT NULL, - permission NAME NOT NULL, - grantee NAME NOT NULL, - object_type NAME, + schema_name NAME NOT NULL COLLATE sys.database_default, + object_name NAME NOT NULL COLLATE sys.database_default, + permission NAME NOT NULL COLLATE sys.database_default, + grantee NAME NOT NULL COLLATE sys.database_default, + object_type NAME COLLATE sys.database_default, PRIMARY KEY(dbid, schema_name, object_name, permission, grantee) ); diff --git a/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql b/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql index 05f0aadbbc..cdf3e45516 100644 --- a/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql +++ b/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql @@ -892,11 +892,11 @@ LANGUAGE plpgsql STABLE; -- BABELFISH_SCHEMA_PERMISSIONS CREATE TABLE IF NOT EXISTS sys.babelfish_schema_permissions ( dbid smallint NOT NULL, - schema_name NAME NOT NULL, - object_name NAME NOT NULL, - permission NAME NOT NULL, - grantee NAME NOT NULL, - object_type NAME, + schema_name NAME NOT NULL COLLATE sys.database_default, + object_name NAME NOT NULL COLLATE sys.database_default, + permission NAME NOT NULL COLLATE sys.database_default, + grantee NAME NOT NULL COLLATE sys.database_default, + object_type NAME COLLATE sys.database_default, PRIMARY KEY(dbid, schema_name, object_name, permission, grantee) ); diff --git a/contrib/babelfishpg_tsql/src/catalog.c b/contrib/babelfishpg_tsql/src/catalog.c index 8f1f9bdc2a..2d832e6a6e 100644 --- a/contrib/babelfishpg_tsql/src/catalog.c +++ b/contrib/babelfishpg_tsql/src/catalog.c @@ -2843,6 +2843,10 @@ add_entry_to_bbf_schema(const char *schema_name, bool new_record_nulls_bbf_schema[BBF_SCHEMA_PERMS_NUM_OF_COLS]; int16 dbid = get_cur_db_id(); + /* Immediately return, if grantee is NULL or PUBLIC. */ + if ((grantee == NULL) || (strcmp(grantee, "public") == 0)) + return; + /* Fetch the relation */ bbf_schema_rel = table_open(get_bbf_schema_perms_oid(), RowExclusiveLock); @@ -2885,45 +2889,65 @@ check_bbf_schema_for_entry(const char *schema_name, { Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; - ScanKeyData key[5]; - TableScanDesc scan; + ScanKeyData scanKey[5]; + SysScanDesc scan; bool catalog_entry_exists = false; int16 dbid = get_cur_db_id(); + /* Immediately return false, if grantee is NULL or PUBLIC. */ + if ((grantee == NULL) || (strcmp(grantee, "public") == 0)) + return false; + bbf_schema_rel = table_open(get_bbf_schema_perms_oid(), AccessShareLock); - ScanKeyInit(&key[0], + ScanKeyInit(&scanKey[0], Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&key[1], + ScanKeyEntryInitialize(&scanKey[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); - ScanKeyInit(&key[2], + ScanKeyEntryInitialize(&scanKey[2], 0, Anum_bbf_schema_perms_object_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(object_name)); - ScanKeyInit(&key[3], + ScanKeyEntryInitialize(&scanKey[3], 0, Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(permission)); - ScanKeyInit(&key[4], + ScanKeyEntryInitialize(&scanKey[4], 0, Anum_bbf_schema_perms_grantee, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(grantee)); + scan = systable_beginscan(bbf_schema_rel, + get_bbf_schema_perms_idx_oid(), + true, NULL, 5, scanKey); - scan = table_beginscan_catalog(bbf_schema_rel, 5, key); - - tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + tuple_bbf_schema = systable_getnext(scan); if (HeapTupleIsValid(tuple_bbf_schema)) catalog_entry_exists = true; - table_endscan(scan); + systable_endscan(scan); table_close(bbf_schema_rel, AccessShareLock); return catalog_entry_exists; } +/* + * Checks if a particular schema has any SCHEMA level permission granted to any user. + */ bool check_bbf_schema_for_schema(const char *schema_name, const char *object_name, @@ -2932,7 +2956,7 @@ check_bbf_schema_for_schema(const char *schema_name, Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; ScanKeyData key[4]; - TableScanDesc scan; + SysScanDesc scan; bool catalog_entry_exists = false; int16 dbid = get_cur_db_id(); @@ -2942,26 +2966,37 @@ check_bbf_schema_for_schema(const char *schema_name, Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&key[1], + ScanKeyEntryInitialize(&key[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); - ScanKeyInit(&key[2], + ScanKeyEntryInitialize(&key[2], 0, Anum_bbf_schema_perms_object_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(object_name)); - ScanKeyInit(&key[3], + ScanKeyEntryInitialize(&key[3], 0, Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(permission)); - scan = table_beginscan_catalog(bbf_schema_rel, 4, key); + scan = systable_beginscan(bbf_schema_rel, + get_bbf_schema_perms_idx_oid(), + true, NULL, 4, key); - tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + tuple_bbf_schema = systable_getnext(scan); if (HeapTupleIsValid(tuple_bbf_schema)) catalog_entry_exists = true; - table_endscan(scan); + systable_endscan(scan); table_close(bbf_schema_rel, AccessShareLock); return catalog_entry_exists; } @@ -2974,44 +3009,59 @@ del_from_bbf_schema(const char *schema_name, { Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; - ScanKeyData key[5]; - TableScanDesc scan; + ScanKeyData scanKey[5]; + SysScanDesc scan; int16 dbid = get_cur_db_id(); + /* Immediately return, if grantee is NULL or PUBLIC. */ + if ((grantee == NULL) || (strcmp(grantee, "public") == 0)) + return; + bbf_schema_rel = table_open(get_bbf_schema_perms_oid(), RowExclusiveLock); - ScanKeyInit(&key[0], + ScanKeyInit(&scanKey[0], Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&key[1], + ScanKeyEntryInitialize(&scanKey[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); - ScanKeyInit(&key[2], + ScanKeyEntryInitialize(&scanKey[2], 0, Anum_bbf_schema_perms_object_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(object_name)); - ScanKeyInit(&key[3], + ScanKeyEntryInitialize(&scanKey[3], 0, Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(permission)); - ScanKeyInit(&key[4], + ScanKeyEntryInitialize(&scanKey[4], 0, Anum_bbf_schema_perms_grantee, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(grantee)); + scan = systable_beginscan(bbf_schema_rel, + get_bbf_schema_perms_idx_oid(), + true, NULL, 5, scanKey); - scan = table_beginscan_catalog(bbf_schema_rel, 5, key); - - tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + tuple_bbf_schema = systable_getnext(scan); if (HeapTupleIsValid(tuple_bbf_schema)) CatalogTupleDelete(bbf_schema_rel, &tuple_bbf_schema->t_self); - table_endscan(scan); + systable_endscan(scan); table_close(bbf_schema_rel, RowExclusiveLock); - - CommandCounterIncrement(); } void @@ -3035,9 +3085,12 @@ clean_up_bbf_schema(const char *schema_name, Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&scanKey[1], + ScanKeyEntryInitialize(&scanKey[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); scan = systable_beginscan(bbf_schema_rel, get_bbf_schema_perms_idx_oid(), @@ -3050,13 +3103,19 @@ clean_up_bbf_schema(const char *schema_name, Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&scanKey[1], + ScanKeyEntryInitialize(&scanKey[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); - ScanKeyInit(&scanKey[2], + ScanKeyEntryInitialize(&scanKey[2], 0, Anum_bbf_schema_perms_object_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(object_name)); scan = systable_beginscan(bbf_schema_rel, get_bbf_schema_perms_idx_oid(), @@ -3074,12 +3133,18 @@ clean_up_bbf_schema(const char *schema_name, table_close(bbf_schema_rel, RowExclusiveLock); } +/* + * For all objects belonging to a schema which has OBJECT level permission, + * It grants the permission explicitly when REVOKE has been executed on that + * specific schema. + */ + void grant_perms_to_objects_in_schema(const char *schema_name, const char *permission, const char *grantee) { - TableScanDesc scan; + SysScanDesc scan; Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; const char *object_name; @@ -3095,21 +3160,31 @@ grant_perms_to_objects_in_schema(const char *schema_name, Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&scanKey[1], + ScanKeyEntryInitialize(&scanKey[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); - ScanKeyInit(&scanKey[2], + ScanKeyEntryInitialize(&scanKey[2], 0, Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(permission)); - ScanKeyInit(&scanKey[3], + ScanKeyEntryInitialize(&scanKey[3], 0, Anum_bbf_schema_perms_grantee, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(grantee)); - scan = table_beginscan_catalog(bbf_schema_rel, 4, scanKey); - tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + scan = systable_beginscan(bbf_schema_rel, get_bbf_schema_perms_idx_oid(), + true, NULL, 4, scanKey); + tuple_bbf_schema = systable_getnext(scan); while (HeapTupleIsValid(tuple_bbf_schema)) { @@ -3162,9 +3237,9 @@ grant_perms_to_objects_in_schema(const char *schema_name, /* make sure later steps can see the object created here */ CommandCounterIncrement(); } - tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + tuple_bbf_schema = systable_getnext(scan); } - table_endscan(scan); + systable_endscan(scan); table_close(bbf_schema_rel, AccessShareLock); } diff --git a/contrib/babelfishpg_tsql/src/catalog.h b/contrib/babelfishpg_tsql/src/catalog.h index 7b8ad195c2..c3a7de0085 100644 --- a/contrib/babelfishpg_tsql/src/catalog.h +++ b/contrib/babelfishpg_tsql/src/catalog.h @@ -299,6 +299,8 @@ typedef FormData_bbf_function_ext *Form_bbf_function_ext; #define Anum_bbf_schema_perms_grantee 5 #define Anum_bbf_schema_perms_object_type 6 +#define PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA "ALL" + extern Oid bbf_schema_perms_oid; extern Oid bbf_schema_perms_idx_oid; diff --git a/contrib/babelfishpg_tsql/src/pl_exec-2.c b/contrib/babelfishpg_tsql/src/pl_exec-2.c index 4e948a0be0..3e98b678e8 100644 --- a/contrib/babelfishpg_tsql/src/pl_exec-2.c +++ b/contrib/babelfishpg_tsql/src/pl_exec-2.c @@ -3683,32 +3683,36 @@ exec_stmt_grantschema(PLtsql_execstate *estate, PLtsql_stmt_grantschema *stmt) char *dbname = get_cur_db_name(); char *login = GetUserNameFromId(GetSessionUserId(), false); bool login_is_db_owner; - Oid datdba; char *rolname; char *schema_name; ListCell *lc; ListCell *lc1; Oid schemaOid; + char *user = GetUserNameFromId(GetUserId(), false); /* * If the login is not the db owner or the login is not the member of * sysadmin or login is not the schema owner, then it doesn't have the permission to GRANT/REVOKE. */ login_is_db_owner = 0 == strncmp(login, get_owner_of_db(dbname), NAMEDATALEN); - datdba = get_role_oid("sysadmin", false); schema_name = get_physical_schema_name(dbname, stmt->schema_name); - schemaOid = LookupExplicitNamespace(schema_name, true); + + if(schema_name) + { + schemaOid = LookupExplicitNamespace(schema_name, true); + } + else + { + ereport(ERROR, + (errcode(ERRCODE_UNDEFINED_SCHEMA), + errmsg("An object or column name is missing or empty. For SELECT INTO statements, verify each column has a name. For other statements, look for empty alias names. Aliases defined as \"\" or [] are not allowed. Change the alias to a valid name."))); + } if (!OidIsValid(schemaOid)) ereport(ERROR, (errcode(ERRCODE_UNDEFINED_SCHEMA), errmsg("schema \"%s\" does not exist", schema_name))); - - if (!is_member_of_role(GetSessionUserId(), datdba) && !login_is_db_owner && !pg_namespace_ownercheck(schemaOid, GetUserId())) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("Cannot find the schema \"%s\", because it does not exist or you do not have permission.", stmt->schema_name))); foreach(lc1, stmt->privileges) { @@ -3718,20 +3722,27 @@ exec_stmt_grantschema(PLtsql_execstate *estate, PLtsql_stmt_grantschema *stmt) char *grantee_name = (char *) lfirst(lc); Oid role_oid; bool grantee_is_db_owner; - rolname = get_physical_user_name(dbname, grantee_name); + if (strcmp(grantee_name, "public") != 0) + rolname = get_physical_user_name(dbname, grantee_name); + else + rolname = pstrdup("public"); role_oid = get_role_oid(rolname, true); grantee_is_db_owner = 0 == strncmp(grantee_name, get_owner_of_db(dbname), NAMEDATALEN); - - if (role_oid == InvalidOid) + if (strcmp(grantee_name, "public") != 0 && role_oid == InvalidOid) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("Cannot find the principal '%s', because it does not exist or you do not have permission.", grantee_name))); - if (pg_namespace_ownercheck(schemaOid, role_oid) || is_member_of_role(role_oid, datdba) || grantee_is_db_owner) + if ((strcmp(rolname, user) == 0) || pg_namespace_ownercheck(schemaOid, role_oid) || is_member_of_role(role_oid, get_sysadmin_oid()) || grantee_is_db_owner) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("Cannot grant, deny, or revoke permissions to sa, dbo, entity owner, information_schema, sys, or yourself."))); + if (!is_member_of_role(GetSessionUserId(), get_sysadmin_oid()) && !login_is_db_owner && !pg_namespace_ownercheck(schemaOid, GetUserId())) + ereport(ERROR, + (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), + errmsg("Cannot find the schema \"%s\", because it does not exist or you do not have permission.", stmt->schema_name))); + parsetree_list = gen_grantschema_subcmds(schema_name, rolname, stmt->is_grant, stmt->with_grant_option, priv_name); /* Run all subcommands */ foreach(parsetree_item, parsetree_list) @@ -3761,17 +3772,22 @@ exec_stmt_grantschema(PLtsql_execstate *estate, PLtsql_stmt_grantschema *stmt) CommandCounterIncrement(); } /* Add entry for each grant statement. */ - if (stmt->is_grant && !check_bbf_schema_for_entry(stmt->schema_name, "ALL", priv_name, rolname)) - add_entry_to_bbf_schema(stmt->schema_name, "ALL", priv_name, rolname, NULL); + if (stmt->is_grant && !check_bbf_schema_for_entry(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname)) + add_entry_to_bbf_schema(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname, NULL); /* Remove entry for each revoke statement. */ - if (!stmt->is_grant && check_bbf_schema_for_entry(stmt->schema_name, "ALL", priv_name, rolname)) + if (!stmt->is_grant && check_bbf_schema_for_entry(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname)) { /* If any object in the schema has the OBJECT level permission. Then, internally grant that permission back. */ grant_perms_to_objects_in_schema(stmt->schema_name, priv_name, rolname); - del_from_bbf_schema(stmt->schema_name, "ALL", priv_name, rolname); + del_from_bbf_schema(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname); } + pfree(rolname); } } + pfree(user); + pfree(schema_name); + pfree(dbname); + pfree(login); return PLTSQL_RC_OK; } diff --git a/contrib/babelfishpg_tsql/src/pl_handler.c b/contrib/babelfishpg_tsql/src/pl_handler.c index 10297b0c90..ab83ccdf4a 100644 --- a/contrib/babelfishpg_tsql/src/pl_handler.c +++ b/contrib/babelfishpg_tsql/src/pl_handler.c @@ -3641,7 +3641,10 @@ bbf_ProcessUtility(PlannedStmt *pstmt, char *permissions[] = {"select", "insert", "update", "references", "delete"}; for(i = 0; i < 5; i++) { - if ((rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logical_schema, obj, permissions[i], rol_spec->rolename)) + /* + * If object permission doesn't exist already, add an entry to the catalog. + */ + if (!check_bbf_schema_for_entry(logical_schema, obj, permissions[i], rol_spec->rolename)) add_entry_to_bbf_schema(logical_schema, obj, permissions[i], rol_spec->rolename, obj_type); } } @@ -3657,10 +3660,15 @@ bbf_ProcessUtility(PlannedStmt *pstmt, char *permissions[] = {"select", "insert", "update", "references", "delete"}; for(i = 0; i < 5; i++) { - if ((rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logical_schema, "ALL", permissions[i], rol_spec->rolename) && !has_schema_perms) + /* + * 1. If only schema permission exists, don't revoke any permission. + * 2. If only object permission exists, delete entry from the catalog and revoke permission. + * 3. If both schema and object permission exist, don't revoke any permission but delete object + * entry from the catalog. + */ + if (check_bbf_schema_for_entry(logical_schema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, permissions[i], rol_spec->rolename) && !has_schema_perms) has_schema_perms = true; - if ((rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logical_schema, obj, permissions[i], rol_spec->rolename)) - del_from_bbf_schema(logical_schema, obj, permissions[i], rol_spec->rolename); + del_from_bbf_schema(logical_schema, obj, permissions[i], rol_spec->rolename); } if (has_schema_perms) return; @@ -3687,7 +3695,12 @@ bbf_ProcessUtility(PlannedStmt *pstmt, foreach(lc, grant->grantees) { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - if ((ap->cols == NULL) && (rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logical_schema, obj, ap->priv_name, rol_spec->rolename)) + /* + * Don't add an entry, if the permission is granted on column list. + */ + if (ap->cols != NULL) + break; + if (!check_bbf_schema_for_entry(logical_schema, obj, ap->priv_name, rol_spec->rolename)) add_entry_to_bbf_schema(logical_schema, obj, ap->priv_name, rol_spec->rolename, obj_type); } } @@ -3700,7 +3713,7 @@ bbf_ProcessUtility(PlannedStmt *pstmt, * 1. If GRANT on schema does not exist, execute REVOKE statement and remove the catalog entry if exists. * 2. If GRANT on schema exist, only remove the entry from the catalog if exists. */ - if ((logical_schema != NULL) && (rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logical_schema, "ALL", ap->priv_name, rol_spec->rolename)) + if ((logical_schema != NULL) && !check_bbf_schema_for_entry(logical_schema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, ap->priv_name, rol_spec->rolename)) { if (prev_ProcessUtility) prev_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, @@ -3709,8 +3722,12 @@ bbf_ProcessUtility(PlannedStmt *pstmt, standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, queryEnv, dest, qc); } - if ((ap->cols == NULL) && (rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logical_schema, obj, ap->priv_name, rol_spec->rolename)) - del_from_bbf_schema(logical_schema, obj, ap->priv_name, rol_spec->rolename); + /* + * Don't remove an entry, if the permission is revoked on column list. + */ + if (ap->cols != NULL) + break; + del_from_bbf_schema(logical_schema, obj, ap->priv_name, rol_spec->rolename); } } } @@ -3743,28 +3760,28 @@ bbf_ProcessUtility(PlannedStmt *pstmt, logicalschema = get_logical_schema_name(schemaname, true); funcname = strVal(func); } - /* - * Case: When ALL PRIVILEGES is revoked internally during create function. - * Check if schema entry exists in the catalog, do not revoke any permission if exists. - */ - if (pstmt->stmt_len == 0 && list_length(grant->privileges) == 0) - { - if(check_bbf_schema_for_schema(logicalschema, "ALL", "execute")) - return; - break; - } + /* If ALL PRIVILEGES is granted/revoked. */ if (list_length(grant->privileges) == 0) { + /* + * Case: When ALL PRIVILEGES is revoked internally during create function. + * Check if schema entry exists in the catalog, do not revoke any permission if exists. + */ + if (pstmt->stmt_len == 0) + { + if(check_bbf_schema_for_schema(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, "execute")) + return; + } + if (grant->is_grant) { foreach(lc, grant->grantees) { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - if ((rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logicalschema, funcname, "execute", rol_spec->rolename)) + if (!check_bbf_schema_for_entry(logicalschema, funcname, "execute", rol_spec->rolename)) add_entry_to_bbf_schema(logicalschema, funcname, "execute", rol_spec->rolename, obj_type); } - break; } else { @@ -3772,15 +3789,14 @@ bbf_ProcessUtility(PlannedStmt *pstmt, { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); bool has_schema_perms = false; - if ((rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logicalschema, "ALL", "execute", rol_spec->rolename) && !has_schema_perms) + if (check_bbf_schema_for_entry(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, "execute", rol_spec->rolename) && !has_schema_perms) has_schema_perms = true; - if ((rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logicalschema, funcname, "execute", rol_spec->rolename)) - del_from_bbf_schema(logicalschema, funcname, "execute", rol_spec->rolename); + del_from_bbf_schema(logicalschema, funcname, "execute", rol_spec->rolename); if (has_schema_perms) return; } - break; } + break; } foreach(lc1, grant->privileges) { @@ -3798,9 +3814,11 @@ bbf_ProcessUtility(PlannedStmt *pstmt, foreach(lc, grant->grantees) { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - /* Don't store a row in catalog, if permission is granted for column */ - if ((rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logicalschema, funcname, ap->priv_name, rol_spec->rolename)) + /* Add an entry to the catalog, if an entry doesn't exist already. */ + if (!check_bbf_schema_for_entry(logicalschema, funcname, ap->priv_name, rol_spec->rolename)) + { add_entry_to_bbf_schema(logicalschema, funcname, ap->priv_name, rol_spec->rolename, obj_type); + } } } else @@ -3809,10 +3827,10 @@ bbf_ProcessUtility(PlannedStmt *pstmt, { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); /* - * 1. If GRANT on schema does not exist, execute REVOKE statement and remove the catalog entry if exists. - * 2. If GRANT on schema exist, only remove the entry from the catalog if exists. - */ - if ((rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logicalschema, "ALL", ap->priv_name, rol_spec->rolename)) + * 1. If GRANT on schema does not exist, execute REVOKE statement and remove the catalog entry if exists. + * 2. If GRANT on schema exist, only remove the entry from the catalog if exists. + */ + if (!check_bbf_schema_for_entry(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, ap->priv_name, rol_spec->rolename)) { /* Execute REVOKE statement. */ if (prev_ProcessUtility) @@ -3822,8 +3840,8 @@ bbf_ProcessUtility(PlannedStmt *pstmt, standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, queryEnv, dest, qc); } - if ((rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logicalschema, funcname, ap->priv_name, rol_spec->rolename)) - del_from_bbf_schema(logicalschema, funcname, ap->priv_name, rol_spec->rolename); + /* Remove an entry from the catalog, if it exists. */ + del_from_bbf_schema(logicalschema, funcname, ap->priv_name, rol_spec->rolename); } } } diff --git a/contrib/babelfishpg_tsql/src/pltsql_utils.c b/contrib/babelfishpg_tsql/src/pltsql_utils.c index df3c57df71..d635d81ab7 100644 --- a/contrib/babelfishpg_tsql/src/pltsql_utils.c +++ b/contrib/babelfishpg_tsql/src/pltsql_utils.c @@ -1036,7 +1036,10 @@ update_GrantStmt(Node *n, const char *object, const char *obj_schema, const char if (grantee && stmt->grantees) { RoleSpec *tmp = (RoleSpec *) llast(stmt->grantees); - + if (strcmp(grantee, "public") == 0) + { + tmp->roletype = ROLESPEC_PUBLIC; + } tmp->rolename = pstrdup(grantee); } diff --git a/contrib/babelfishpg_tsql/src/tsqlIface.cpp b/contrib/babelfishpg_tsql/src/tsqlIface.cpp index 695b28dc46..be3ceece6c 100644 --- a/contrib/babelfishpg_tsql/src/tsqlIface.cpp +++ b/contrib/babelfishpg_tsql/src/tsqlIface.cpp @@ -5527,6 +5527,11 @@ makeGrantdbStatement(TSqlParser::Security_statementContext *ctx) char *grantee_name = pstrdup(downcase_truncate_identifier(id_str.c_str(), id_str.length(), true)); grantee_list = lappend(grantee_list, grantee_name); } + if (prin->PUBLIC()) + { + char *grantee_name = pstrdup("public"); + grantee_list = lappend(grantee_list, grantee_name); + } } result->grantees = grantee_list; return (PLtsql_stmt *) result; @@ -5555,6 +5560,11 @@ makeGrantdbStatement(TSqlParser::Security_statementContext *ctx) char *grantee_name = pstrdup(downcase_truncate_identifier(id_str.c_str(), id_str.length(), true)); grantee_list = lappend(grantee_list, grantee_name); } + if (prin->PUBLIC()) + { + char *grantee_name = pstrdup("public"); + grantee_list = lappend(grantee_list, grantee_name); + } } result->grantees = grantee_list; return (PLtsql_stmt *) result; @@ -5585,6 +5595,11 @@ makeGrantdbStatement(TSqlParser::Security_statementContext *ctx) char *grantee_name = pstrdup(downcase_truncate_identifier(id_str.c_str(), id_str.length(), true)); grantee_list = lappend(grantee_list, grantee_name); } + if (prin->PUBLIC()) + { + char *grantee_name = pstrdup("public"); + grantee_list = lappend(grantee_list, grantee_name); + } } List *privilege_list = NIL; for (auto perm: ctx->grant_statement()->permissions()->permission()) @@ -5637,6 +5652,11 @@ makeGrantdbStatement(TSqlParser::Security_statementContext *ctx) char *grantee_name = pstrdup(downcase_truncate_identifier(id_str.c_str(), id_str.length(), true)); grantee_list = lappend(grantee_list, grantee_name); } + if (prin->PUBLIC()) + { + char *grantee_name = pstrdup("public"); + grantee_list = lappend(grantee_list, grantee_name); + } } List *privilege_list = NIL; for (auto perm: ctx->revoke_statement()->permissions()->permission()) diff --git a/contrib/babelfishpg_tsql/src/tsqlUnsupportedFeatureHandler.cpp b/contrib/babelfishpg_tsql/src/tsqlUnsupportedFeatureHandler.cpp index 29cdc5ac32..64a4d12f89 100644 --- a/contrib/babelfishpg_tsql/src/tsqlUnsupportedFeatureHandler.cpp +++ b/contrib/babelfishpg_tsql/src/tsqlUnsupportedFeatureHandler.cpp @@ -1704,7 +1704,8 @@ void TsqlUnsupportedFeatureHandlerImpl::checkSupportedGrantStmt(TSqlParser::Gran continue; else { - unsupported_feature = "GRANT PERMISSION " + perm->getText(); + unsupported_feature = "GRANT PERMISSION " + ::getFullText(single_perm); + std::transform(unsupported_feature.begin(), unsupported_feature.end(), unsupported_feature.begin(), ::toupper); handle(INSTR_UNSUPPORTED_TSQL_REVOKE_STMT, unsupported_feature.c_str(), getLineAndPos(perm)); } } @@ -1719,6 +1720,7 @@ void TsqlUnsupportedFeatureHandlerImpl::checkSupportedGrantStmt(TSqlParser::Gran if (obj_type && !(obj_type->OBJECT() || obj_type->SCHEMA())) { unsupported_feature = "GRANT ON " + obj_type->getText(); + std::transform(unsupported_feature.begin(), unsupported_feature.end(), unsupported_feature.begin(), ::toupper); handle(INSTR_UNSUPPORTED_TSQL_REVOKE_STMT, unsupported_feature.c_str(), getLineAndPos(obj_type)); } } @@ -1798,7 +1800,8 @@ void TsqlUnsupportedFeatureHandlerImpl::checkSupportedRevokeStmt(TSqlParser::Rev continue; else { - unsupported_feature = "REVOKE PERMISSION " + perm->getText(); + unsupported_feature = "REVOKE PERMISSION " + ::getFullText(single_perm); + std::transform(unsupported_feature.begin(), unsupported_feature.end(), unsupported_feature.begin(), ::toupper); handle(INSTR_UNSUPPORTED_TSQL_REVOKE_STMT, unsupported_feature.c_str(), getLineAndPos(perm)); } } @@ -1813,6 +1816,7 @@ void TsqlUnsupportedFeatureHandlerImpl::checkSupportedRevokeStmt(TSqlParser::Rev if (obj_type && !(obj_type->OBJECT() || obj_type->SCHEMA())) { unsupported_feature = "REVOKE ON " + obj_type->getText(); + std::transform(unsupported_feature.begin(), unsupported_feature.end(), unsupported_feature.begin(), ::toupper); handle(INSTR_UNSUPPORTED_TSQL_REVOKE_STMT, unsupported_feature.c_str(), getLineAndPos(obj_type)); } } diff --git a/test/JDBC/expected/BABEL-GRANT.out b/test/JDBC/expected/BABEL-GRANT.out index d3f48b241f..2a59cf3dea 100644 --- a/test/JDBC/expected/BABEL-GRANT.out +++ b/test/JDBC/expected/BABEL-GRANT.out @@ -174,7 +174,7 @@ GO REVOKE SELECT ON SCHEMA::scm FROM guest; GO -GRANT SHOWPLAN ON OBJECT::t1 TO guest; -- unsupported permission +GRANT showplan ON OBJECT::t1 TO guest; -- unsupported permission GO ~~ERROR (Code: 33557097)~~ @@ -188,20 +188,48 @@ GO ~~ERROR (Message: 'REVOKE PERMISSION SHOWPLAN' is not currently supported in Babelfish)~~ -GRANT ALL ON SCHEMA::scm TO guest; -- unsupported class +GRANT ALL ON SCHEMA::scm TO guest; GO ~~ERROR (Code: 33557097)~~ ~~ERROR (Message: The all permission has been deprecated and is not available for this class of entity.)~~ -REVOKE ALL ON SCHEMA::scm TO guest; -- unsupported class +REVOKE ALL ON SCHEMA::scm TO guest; GO ~~ERROR (Code: 33557097)~~ ~~ERROR (Message: The all permission has been deprecated and is not available for this class of entity.)~~ +GRANT create table ON OBJECT::t1 TO guest; -- unsupported permission +GO +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: 'GRANT PERMISSION CREATE TABLE' is not currently supported in Babelfish)~~ + + +REVOKE create table ON OBJECT::t2 FROM alogin; -- unsupported permission +GO +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: 'REVOKE PERMISSION CREATE TABLE' is not currently supported in Babelfish)~~ + + +GRANT SELECT ON table::t1 TO guest; -- unsupported object +GO +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: 'GRANT ON TABLE' is not currently supported in Babelfish)~~ + + +REVOKE SELECT ON table::t1 FROM guest; -- unsupported object +GO +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: 'REVOKE ON TABLE' is not currently supported in Babelfish)~~ + + GRANT ALL ON OBJECT::t1 TO guest WITH GRANT OPTION AS superuser; GO ~~ERROR (Code: 33557097)~~ diff --git a/test/JDBC/expected/GRANT_SCHEMA.out b/test/JDBC/expected/GRANT_SCHEMA.out index 1891d68597..935acbe2f5 100644 --- a/test/JDBC/expected/GRANT_SCHEMA.out +++ b/test/JDBC/expected/GRANT_SCHEMA.out @@ -12,9 +12,18 @@ go create user babel_4344_u1 for login babel_4344_l1; go +create login αιώνια with password = '12345678' +go + +create user αιώνια for login αιώνια; +go + create schema babel_4344_s1; go +create schema αγάπη; +go + create schema babel_4344_s2 authorization babel_4344_u1; go @@ -27,6 +36,9 @@ go create table babel_4344_s2.babel_4344_t1(a int); go +create table αγάπη.abc(a int); +go + create table babel_4344_t3(a int, b int); go @@ -45,12 +57,69 @@ go create proc babel_4344_s1.babel_4344_p1 as select 2; go +create proc babel_4344_s1.babel_4344_p3 as select 3; +go + CREATE FUNCTION babel_4344_f1() RETURNS INT AS BEGIN RETURN (SELECT COUNT(*) FROM sys.tables) END go CREATE FUNCTION babel_4344_s1.babel_4344_f1() RETURNS INT AS BEGIN RETURN (SELECT COUNT(*) FROM sys.objects) END go +grant SELECT on schema::babel_4344_S1 to public, αιώνια; +go + +grant select on schema::αγάπη to αιώνια; +go + +-- tsql user=αιώνια password=12345678 +use babel_4344_d1; +go + +select * from αγάπη.abc; +go +~~START~~ +int +~~END~~ + + +select * from babel_4344_S1.babel_4344_t1; +go +~~START~~ +int +~~END~~ + + +use master; +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go + +-- User has select privileges, tables and views be accessible +select * from babel_4344_s1.babel_4344_t1 +go +~~START~~ +int +~~END~~ + +select * from babel_4344_s1.babel_4344_v1; +go +~~START~~ +int +2 +~~END~~ + +use master; +go + +-- tsql +use babel_4344_d1; +go +revoke select on schema::babel_4344_s1 from public, αιώνια; +go + -- tsql user=babel_4344_l1 password=12345678 use babel_4344_d1; go @@ -117,9 +186,9 @@ go -- GRANT OBJECT privilege use babel_4344_d1; go -grant select on babel_4344_t1 to babel_4344_u1; +grant SELECT on babel_4344_t1 to BABEL_4344_U1; go -grant select on babel_4344_s1.babel_4344_t1 to babel_4344_u1; +grant SELECT on babel_4344_s1.babel_4344_t1 to babel_4344_u1; go grant all on babel_4344_s1.babel_4344_t1 to babel_4344_u1; go @@ -135,7 +204,14 @@ grant execute on babel_4344_p1 to babel_4344_u1; go grant execute on babel_4344_s1.babel_4344_p1 to babel_4344_u1; go -grant execute on babel_4344_f1 to babel_4344_u1; +-- inside a transaction, permission will not be granted since it is rolled back +begin transaction; +exec sp_executesql N'grant execute on babel_4344_s1.babel_4344_p3 to babel_4344_u1;'; +rollback transaction; +go + +-- Mixed case +grant Execute on Babel_4344_F1 to babel_4344_u1; go grant execute on babel_4344_s1.babel_4344_f1 to babel_4344_u1; go @@ -152,8 +228,36 @@ go ~~ERROR (Message: Cannot find the principal 'jdbc_user', because it does not exist or you do not have permission.)~~ -grant select on schema::babel_4344_s2 to guest; -- should pass +grant SELECT on schema::babel_4344_s2 to guest; -- should pass +go +grant select on schema::"" to guest; -- should fail go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: An object or column name is missing or empty. For SELECT INTO statements, verify each column has a name. For other statements, look for empty alias names. Aliases defined as "" or [] are not allowed. Change the alias to a valid name.)~~ + +grant select on schema::non_existing_schema to guest; -- should fail +go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: schema "non_existing_schema" does not exist)~~ + +-- grant statement via a procedure +create procedure grant_perm_proc as begin exec('grant select on schema::[] to guest') end; +go +exec grant_perm_proc; -- should fail +go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: An object or column name is missing or empty. For SELECT INTO statements, verify each column has a name. For other statements, look for empty alias names. Aliases defined as "" or [] are not allowed. Change the alias to a valid name.)~~ + +-- non-existing role +grant SELECT on schema::dbo to guest, babel_4344_u3; -- should fail +go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: Cannot find the principal 'babel_4344_u3', because it does not exist or you do not have permission.)~~ + -- tsql user=babel_4344_l1 password=12345678 -- User has OBJECT privileges, should be accessible. @@ -215,6 +319,12 @@ int 2 ~~END~~ +exec babel_4344_s1.babel_4344_p3; -- should fail, grant statement was rolled back +go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: permission denied for procedure babel_4344_p3)~~ + select * from babel_4344_f1(); go ~~START~~ @@ -242,7 +352,7 @@ grant select on schema::babel_4344_s1 to babel_4344_u1; -- should fail go ~~ERROR (Code: 33557097)~~ -~~ERROR (Message: Cannot find the schema "babel_4344_s1", because it does not exist or you do not have permission.)~~ +~~ERROR (Message: Cannot grant, deny, or revoke permissions to sa, dbo, entity owner, information_schema, sys, or yourself.)~~ use master; go @@ -256,6 +366,19 @@ go use master; go +-- psql +-- GRANT statement add an entry to the catalog +select schema_name, object_name, permission, grantee from sys.babelfish_schema_permissions +where schema_name = 'babel_4344_s1' collate "C" and object_name = 'ALL' collate "C" order by permission; +go +~~START~~ +name#!#name#!#name#!#name +babel_4344_s1#!#ALL#!#execute#!#babel_4344_d1_babel_4344_u1 +babel_4344_s1#!#ALL#!#insert#!#babel_4344_d1_babel_4344_u1 +babel_4344_s1#!#ALL#!#select#!#babel_4344_d1_babel_4344_u1 +~~END~~ + + -- tsql user=babel_4344_l1 password=12345678 -- User has OBJECT and SCHEMA privileges, should be accessible. use babel_4344_d1; @@ -295,7 +418,7 @@ select * from babel_4344_s1.babel_4344_f1(); go ~~START~~ int -10 +11 ~~END~~ use master; @@ -339,14 +462,14 @@ int 2 ~~END~~ -exec babel_4344_s1.babel_4344_p1; -- TODO: should be accessible +exec babel_4344_s1.babel_4344_p1; go ~~START~~ int 2 ~~END~~ -select * from babel_4344_s1.babel_4344_f1(); -- TODO: should be accessible +select * from babel_4344_s1.babel_4344_f1(); go ~~START~~ int @@ -412,7 +535,7 @@ select * from babel_4344_s1.babel_4344_f2(); go ~~START~~ int -14 +15 ~~END~~ use master; @@ -477,7 +600,7 @@ select * from babel_4344_s1.babel_4344_f1(); go ~~START~~ int -14 +15 ~~END~~ select * from babel_4344_s2.babel_4344_t1; @@ -498,6 +621,15 @@ go use master; go +-- psql +-- REVOKE on schema removes the entry from the catalog +select * from sys.babelfish_schema_permissions where schema_name = 'babel_4344_s1' collate sys.database_default; +go +~~START~~ +int2#!#name#!#name#!#name#!#name#!#name +~~END~~ + + -- tsql user=babel_4344_l1 password=12345678 -- User has no privileges, shouldn't be accessible. use babel_4344_d1; @@ -541,6 +673,54 @@ go use master; go +-- psql +-- grant object permission +grant select on babel_4344_s1.babel_4344_t1 to babel_4344_d1_babel_4344_u1; +go + +-- tsql +-- grant schema permission +use babel_4344_d1; +go +grant select on schema::babel_4344_s1 to babel_4344_u1; +go +use master +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go +select * from babel_4344_s1.babel_4344_t1; -- accessible +go +~~START~~ +int +2 +3 +3 +4 +5 +~~END~~ + +use master +go + +-- psql +-- revoke schema permission +revoke select on all tables in schema babel_4344_s1 from babel_4344_d1_babel_4344_u1; +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go +select * from babel_4344_s1.babel_4344_t1; -- not accessible +go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: permission denied for table babel_4344_t1)~~ + +use master +go + -- tsql -- Drop objects use babel_4344_d1; @@ -579,6 +759,9 @@ go drop proc babel_4344_s1.babel_4344_p2; go +drop proc babel_4344_s1.babel_4344_p3; +go + drop function babel_4344_f1; go @@ -597,9 +780,18 @@ go drop schema babel_4344_s2; go +drop table αγάπη.abc; +go + +drop schema αγάπη; +go + drop user babel_4344_u1; go +drop user αιώνια; +go + use master; go @@ -629,3 +821,27 @@ void -- tsql drop login babel_4344_l1; go + +-- psql +-- Need to terminate active session before cleaning up the login +SELECT pg_terminate_backend(pid) FROM pg_stat_get_activity(NULL) +WHERE sys.suser_name(usesysid) = 'αιώνια' AND backend_type = 'client backend' AND usesysid IS NOT NULL; +go +~~START~~ +bool +t +~~END~~ + + +-- Wait to sync with another session +SELECT pg_sleep(1); +go +~~START~~ +void + +~~END~~ + + +-- tsql +drop login αιώνια; +go diff --git a/test/JDBC/input/BABEL-GRANT.sql b/test/JDBC/input/BABEL-GRANT.sql index 3e0155ea28..8388f782ff 100644 --- a/test/JDBC/input/BABEL-GRANT.sql +++ b/test/JDBC/input/BABEL-GRANT.sql @@ -164,16 +164,28 @@ GO REVOKE SELECT ON SCHEMA::scm FROM guest; GO -GRANT SHOWPLAN ON OBJECT::t1 TO guest; -- unsupported permission +GRANT showplan ON OBJECT::t1 TO guest; -- unsupported permission GO REVOKE SHOWPLAN ON OBJECT::t2 TO alogin; -- unsupported permission GO -GRANT ALL ON SCHEMA::scm TO guest; -- unsupported class +GRANT ALL ON SCHEMA::scm TO guest; GO -REVOKE ALL ON SCHEMA::scm TO guest; -- unsupported class +REVOKE ALL ON SCHEMA::scm TO guest; +GO + +GRANT create table ON OBJECT::t1 TO guest; -- unsupported permission +GO + +REVOKE create table ON OBJECT::t2 FROM alogin; -- unsupported permission +GO + +GRANT SELECT ON table::t1 TO guest; -- unsupported object +GO + +REVOKE SELECT ON table::t1 FROM guest; -- unsupported object GO GRANT ALL ON OBJECT::t1 TO guest WITH GRANT OPTION AS superuser; diff --git a/test/JDBC/input/GRANT_SCHEMA.mix b/test/JDBC/input/GRANT_SCHEMA.mix index 1572bea803..f4af9f7af7 100644 --- a/test/JDBC/input/GRANT_SCHEMA.mix +++ b/test/JDBC/input/GRANT_SCHEMA.mix @@ -12,9 +12,18 @@ go create user babel_4344_u1 for login babel_4344_l1; go +create login αιώνια with password = '12345678' +go + +create user αιώνια for login αιώνια; +go + create schema babel_4344_s1; go +create schema αγάπη; +go + create schema babel_4344_s2 authorization babel_4344_u1; go @@ -27,6 +36,9 @@ go create table babel_4344_s2.babel_4344_t1(a int); go +create table αγάπη.abc(a int); +go + create table babel_4344_t3(a int, b int); go @@ -45,12 +57,52 @@ go create proc babel_4344_s1.babel_4344_p1 as select 2; go +create proc babel_4344_s1.babel_4344_p3 as select 3; +go + CREATE FUNCTION babel_4344_f1() RETURNS INT AS BEGIN RETURN (SELECT COUNT(*) FROM sys.tables) END go CREATE FUNCTION babel_4344_s1.babel_4344_f1() RETURNS INT AS BEGIN RETURN (SELECT COUNT(*) FROM sys.objects) END go +grant SELECT on schema::babel_4344_S1 to public, αιώνια; +go + +grant select on schema::αγάπη to αιώνια; +go + +-- tsql user=αιώνια password=12345678 +use babel_4344_d1; +go + +select * from αγάπη.abc; +go + +select * from babel_4344_S1.babel_4344_t1; +go + +use master; +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go + +-- User has select privileges, tables and views be accessible +select * from babel_4344_s1.babel_4344_t1 +go +select * from babel_4344_s1.babel_4344_v1; +go +use master; +go + +-- tsql +use babel_4344_d1; +go +revoke select on schema::babel_4344_s1 from public, αιώνια; +go + -- tsql user=babel_4344_l1 password=12345678 use babel_4344_d1; go @@ -81,9 +133,9 @@ go -- GRANT OBJECT privilege use babel_4344_d1; go -grant select on babel_4344_t1 to babel_4344_u1; +grant SELECT on babel_4344_t1 to BABEL_4344_U1; go -grant select on babel_4344_s1.babel_4344_t1 to babel_4344_u1; +grant SELECT on babel_4344_s1.babel_4344_t1 to babel_4344_u1; go grant all on babel_4344_s1.babel_4344_t1 to babel_4344_u1; go @@ -99,7 +151,14 @@ grant execute on babel_4344_p1 to babel_4344_u1; go grant execute on babel_4344_s1.babel_4344_p1 to babel_4344_u1; go -grant execute on babel_4344_f1 to babel_4344_u1; +-- inside a transaction, permission will not be granted since it is rolled back +begin transaction; +exec sp_executesql N'grant execute on babel_4344_s1.babel_4344_p3 to babel_4344_u1;'; +rollback transaction; +go + +-- Mixed case +grant Execute on Babel_4344_F1 to babel_4344_u1; go grant execute on babel_4344_s1.babel_4344_f1 to babel_4344_u1; go @@ -108,7 +167,19 @@ grant select on schema::babel_4344_s2 to babel_4344_u1; -- should fail go grant select on schema::babel_4344_s2 to jdbc_user; -- should fail go -grant select on schema::babel_4344_s2 to guest; -- should pass +grant SELECT on schema::babel_4344_s2 to guest; -- should pass +go +grant select on schema::"" to guest; -- should fail +go +grant select on schema::non_existing_schema to guest; -- should fail +go +-- grant statement via a procedure +create procedure grant_perm_proc as begin exec('grant select on schema::[] to guest') end; +go +exec grant_perm_proc; -- should fail +go +-- non-existing role +grant SELECT on schema::dbo to guest, babel_4344_u3; -- should fail go -- tsql user=babel_4344_l1 password=12345678 @@ -133,6 +204,8 @@ exec babel_4344_p1; go exec babel_4344_s1.babel_4344_p1; go +exec babel_4344_s1.babel_4344_p3; -- should fail, grant statement was rolled back +go select * from babel_4344_f1(); go select * from babel_4344_s1.babel_4344_f1(); @@ -156,6 +229,12 @@ go use master; go +-- psql +-- GRANT statement add an entry to the catalog +select schema_name, object_name, permission, grantee from sys.babelfish_schema_permissions +where schema_name = 'babel_4344_s1' collate "C" and object_name = 'ALL' collate "C" order by permission; +go + -- tsql user=babel_4344_l1 password=12345678 -- User has OBJECT and SCHEMA privileges, should be accessible. use babel_4344_d1; @@ -196,9 +275,9 @@ select * from babel_4344_s1.babel_4344_t3 -- not accessible go select * from babel_4344_s1.babel_4344_v1; go -exec babel_4344_s1.babel_4344_p1; -- TODO: should be accessible +exec babel_4344_s1.babel_4344_p1; go -select * from babel_4344_s1.babel_4344_f1(); -- TODO: should be accessible +select * from babel_4344_s1.babel_4344_f1(); go select * from babel_4344_s2.babel_4344_t1; go @@ -287,6 +366,11 @@ go use master; go +-- psql +-- REVOKE on schema removes the entry from the catalog +select * from sys.babelfish_schema_permissions where schema_name = 'babel_4344_s1' collate sys.database_default; +go + -- tsql user=babel_4344_l1 password=12345678 -- User has no privileges, shouldn't be accessible. use babel_4344_d1; @@ -306,6 +390,41 @@ go use master; go +-- psql +-- grant object permission +grant select on babel_4344_s1.babel_4344_t1 to babel_4344_d1_babel_4344_u1; +go + +-- tsql +-- grant schema permission +use babel_4344_d1; +go +grant select on schema::babel_4344_s1 to babel_4344_u1; +go +use master +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go +select * from babel_4344_s1.babel_4344_t1; -- accessible +go +use master +go + +-- psql +-- revoke schema permission +revoke select on all tables in schema babel_4344_s1 from babel_4344_d1_babel_4344_u1; +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go +select * from babel_4344_s1.babel_4344_t1; -- not accessible +go +use master +go + -- tsql -- Drop objects use babel_4344_d1; @@ -344,6 +463,9 @@ go drop proc babel_4344_s1.babel_4344_p2; go +drop proc babel_4344_s1.babel_4344_p3; +go + drop function babel_4344_f1; go @@ -362,9 +484,18 @@ go drop schema babel_4344_s2; go +drop table αγάπη.abc; +go + +drop schema αγάπη; +go + drop user babel_4344_u1; go +drop user αιώνια; +go + use master; go @@ -384,3 +515,17 @@ go -- tsql drop login babel_4344_l1; go + +-- psql +-- Need to terminate active session before cleaning up the login +SELECT pg_terminate_backend(pid) FROM pg_stat_get_activity(NULL) +WHERE sys.suser_name(usesysid) = 'αιώνια' AND backend_type = 'client backend' AND usesysid IS NOT NULL; +go + +-- Wait to sync with another session +SELECT pg_sleep(1); +go + +-- tsql +drop login αιώνια; +go diff --git a/test/python/expected/sql_validation_framework/expected_create.out b/test/python/expected/sql_validation_framework/expected_create.out index 0aa3907ff7..700ab049b7 100644 --- a/test/python/expected/sql_validation_framework/expected_create.out +++ b/test/python/expected/sql_validation_framework/expected_create.out @@ -73,7 +73,6 @@ Could not find tests for procedure sys.printarg Could not find tests for procedure sys.sp_cursor_list Could not find tests for procedure sys.sp_describe_cursor Could not find tests for table sys.babelfish_helpcollation -Could not find tests for table sys.babelfish_schema_permissions Could not find tests for table sys.babelfish_syslanguages Could not find tests for table sys.service_settings Could not find tests for table sys.spt_datatype_info_table