Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added roles, revoking, and dropping users and roles #773

Merged
merged 1 commit into from
Feb 1, 2022
Merged

Added roles, revoking, and dropping users and roles #773

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
337 changes: 337 additions & 0 deletions enginetest/priv_auth_queries.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,6 +200,343 @@ var UserPrivTests = []UserPrivilegeTest{
},
},
},
{
Name: "Basic revoke SELECT privilege",
SetUpScript: []string{
"CREATE TABLE test (pk BIGINT PRIMARY KEY);",
"INSERT INTO test VALUES (1), (2), (3);",
"CREATE USER tester@localhost;",
"GRANT SELECT ON *.* TO tester@localhost;",
},
Assertions: []UserPrivilegeTestAssertion{
{
User: "tester",
Host: "localhost",
Query: "SELECT * FROM test;",
Expected: []sql.Row{{1}, {2}, {3}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT User, Host, Select_priv FROM mysql.user WHERE User = 'tester';",
Expected: []sql.Row{{"tester", "localhost", "Y"}},
},
{
User: "root",
Host: "localhost",
Query: "REVOKE SELECT ON *.* FROM tester@localhost;",
Expected: []sql.Row{{sql.NewOkResult(0)}},
},
{
User: "tester",
Host: "localhost",
Query: "SELECT * FROM test;",
ExpectedErr: sql.ErrPrivilegeCheckFailed,
},
{
User: "root",
Host: "localhost",
Query: "SELECT User, Host, Select_priv FROM mysql.user WHERE User = 'tester';",
Expected: []sql.Row{{"tester", "localhost", "N"}},
},
},
},
{
Name: "Basic revoke all global static privileges",
SetUpScript: []string{
"CREATE TABLE test (pk BIGINT PRIMARY KEY);",
"INSERT INTO test VALUES (1), (2), (3);",
"CREATE USER tester@localhost;",
"GRANT ALL ON *.* TO tester@localhost;",
},
Assertions: []UserPrivilegeTestAssertion{
{
User: "tester",
Host: "localhost",
Query: "INSERT INTO test VALUES (4);",
Expected: []sql.Row{{sql.NewOkResult(1)}},
},
{
User: "tester",
Host: "localhost",
Query: "SELECT * FROM test;",
Expected: []sql.Row{{1}, {2}, {3}, {4}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT User, Host, Select_priv, Insert_priv FROM mysql.user WHERE User = 'tester';",
Expected: []sql.Row{{"tester", "localhost", "Y", "Y"}},
},
{
User: "root",
Host: "localhost",
Query: "REVOKE ALL ON *.* FROM tester@localhost;",
Expected: []sql.Row{{sql.NewOkResult(0)}},
},
{
User: "tester",
Host: "localhost",
Query: "SELECT * FROM test;",
ExpectedErr: sql.ErrPrivilegeCheckFailed,
},
{
User: "tester",
Host: "localhost",
Query: "INSERT INTO test VALUES (5);",
ExpectedErr: sql.ErrPrivilegeCheckFailed,
},
{
User: "root",
Host: "localhost",
Query: "SELECT User, Host, Select_priv, Insert_priv FROM mysql.user WHERE User = 'tester';",
Expected: []sql.Row{{"tester", "localhost", "N", "N"}},
},
},
},
{
Name: "Basic role creation",
SetUpScript: []string{
"CREATE ROLE test_role;",
},
Assertions: []UserPrivilegeTestAssertion{
{
User: "root",
Host: "localhost",
Query: "SELECT User, Host, account_locked FROM mysql.user WHERE User = 'test_role';",
Expected: []sql.Row{{"test_role", "%", "Y"}},
},
},
},
{
Name: "Grant Role with SELECT Privilege",
SetUpScript: []string{
"SET @@GLOBAL.activate_all_roles_on_login = true;",
"CREATE TABLE test (pk BIGINT PRIMARY KEY);",
"INSERT INTO test VALUES (1), (2), (3);",
"CREATE USER tester@localhost;",
"CREATE ROLE test_role;",
"GRANT SELECT ON *.* TO test_role;",
},
Assertions: []UserPrivilegeTestAssertion{
{
User: "tester",
Host: "localhost",
Query: "SELECT * FROM test;",
ExpectedErr: sql.ErrPrivilegeCheckFailed,
},
{
User: "root",
Host: "localhost",
Query: "SELECT COUNT(*) FROM mysql.role_edges;",
Expected: []sql.Row{{0}},
},
{
User: "root",
Host: "localhost",
Query: "GRANT test_role TO tester@localhost;",
Expected: []sql.Row{{sql.NewOkResult(0)}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT * FROM mysql.role_edges;",
Expected: []sql.Row{{"%", "test_role", "localhost", "tester", "N"}},
},
{
User: "tester",
Host: "localhost",
Query: "SELECT * FROM test;",
Expected: []sql.Row{{1}, {2}, {3}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT User, Host, Select_priv FROM mysql.user WHERE User = 'tester';",
Expected: []sql.Row{{"tester", "localhost", "N"}},
},
},
},
{
Name: "Revoke role currently granted to a user",
SetUpScript: []string{
"SET @@GLOBAL.activate_all_roles_on_login = true;",
"CREATE TABLE test (pk BIGINT PRIMARY KEY);",
"INSERT INTO test VALUES (1), (2), (3);",
"CREATE USER tester@localhost;",
"CREATE ROLE test_role;",
"GRANT SELECT ON *.* TO test_role;",
"GRANT test_role TO tester@localhost;",
},
Assertions: []UserPrivilegeTestAssertion{
{
User: "tester",
Host: "localhost",
Query: "SELECT * FROM test;",
Expected: []sql.Row{{1}, {2}, {3}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT * FROM mysql.role_edges;",
Expected: []sql.Row{{"%", "test_role", "localhost", "tester", "N"}},
},
{
User: "root",
Host: "localhost",
Query: "REVOKE test_role FROM tester@localhost;",
Expected: []sql.Row{{sql.NewOkResult(0)}},
},
{
User: "tester",
Host: "localhost",
Query: "SELECT * FROM test;",
ExpectedErr: sql.ErrPrivilegeCheckFailed,
},
{
User: "root",
Host: "localhost",
Query: "SELECT COUNT(*) FROM mysql.role_edges;",
Expected: []sql.Row{{0}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT COUNT(*) FROM mysql.user WHERE User = 'test_role';",
Expected: []sql.Row{{1}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT COUNT(*) FROM mysql.user WHERE User = 'tester';",
Expected: []sql.Row{{1}},
},
},
},
{
Name: "Drop role currently granted to a user",
SetUpScript: []string{
"SET @@GLOBAL.activate_all_roles_on_login = true;",
"CREATE TABLE test (pk BIGINT PRIMARY KEY);",
"INSERT INTO test VALUES (1), (2), (3);",
"CREATE USER tester@localhost;",
"CREATE ROLE test_role;",
"GRANT SELECT ON *.* TO test_role;",
"GRANT test_role TO tester@localhost;",
},
Assertions: []UserPrivilegeTestAssertion{
{
User: "tester",
Host: "localhost",
Query: "SELECT * FROM test;",
Expected: []sql.Row{{1}, {2}, {3}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT * FROM mysql.role_edges;",
Expected: []sql.Row{{"%", "test_role", "localhost", "tester", "N"}},
},
{
User: "root",
Host: "localhost",
Query: "DROP ROLE test_role;",
Expected: []sql.Row{{sql.NewOkResult(0)}},
},
{
User: "tester",
Host: "localhost",
Query: "SELECT * FROM test;",
ExpectedErr: sql.ErrPrivilegeCheckFailed,
},
{
User: "root",
Host: "localhost",
Query: "SELECT COUNT(*) FROM mysql.role_edges;",
Expected: []sql.Row{{0}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT COUNT(*) FROM mysql.user WHERE User = 'test_role';",
Expected: []sql.Row{{0}},
},
{ // Ensure nothing wonky happened like the user was deleted as well
User: "root",
Host: "localhost",
Query: "SELECT COUNT(*) FROM mysql.user WHERE User = 'tester';",
Expected: []sql.Row{{1}},
},
{
User: "root",
Host: "localhost",
Query: "DROP ROLE test_role;",
ExpectedErr: sql.ErrRoleDeletionFailure,
},
{
User: "root",
Host: "localhost",
Query: "DROP ROLE IF EXISTS test_role;",
Expected: []sql.Row{{sql.NewOkResult(0)}},
},
},
},
{
Name: "Drop user with role currently granted",
SetUpScript: []string{
"SET @@GLOBAL.activate_all_roles_on_login = true;",
"CREATE TABLE test (pk BIGINT PRIMARY KEY);",
"INSERT INTO test VALUES (1), (2), (3);",
"CREATE USER tester@localhost;",
"CREATE ROLE test_role;",
"GRANT SELECT ON *.* TO test_role;",
"GRANT test_role TO tester@localhost;",
},
Assertions: []UserPrivilegeTestAssertion{
{
User: "root",
Host: "localhost",
Query: "SELECT * FROM mysql.role_edges;",
Expected: []sql.Row{{"%", "test_role", "localhost", "tester", "N"}},
},
{
User: "root",
Host: "localhost",
Query: "DROP USER tester@localhost;",
Expected: []sql.Row{{sql.NewOkResult(0)}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT COUNT(*) FROM mysql.role_edges;",
Expected: []sql.Row{{0}},
},
{
User: "root",
Host: "localhost",
Query: "SELECT COUNT(*) FROM mysql.user WHERE User = 'tester';",
Expected: []sql.Row{{0}},
},
{ // Ensure nothing wonky happened like the role was deleted as well
User: "root",
Host: "localhost",
Query: "SELECT COUNT(*) FROM mysql.user WHERE User = 'test_role';",
Expected: []sql.Row{{1}},
},
{
User: "root",
Host: "localhost",
Query: "DROP USER tester@localhost;",
ExpectedErr: sql.ErrUserDeletionFailure,
},
{
User: "root",
Host: "localhost",
Query: "DROP USER IF EXISTS tester@localhost;",
Expected: []sql.Row{{sql.NewOkResult(0)}},
},
},
},
}

// ServerAuthTests test the server authentication system. These tests always have the root account available, and the
Expand Down
Loading