Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Add drop privilege for table objects. #33

Merged
merged 1 commit into from
Dec 9, 2021
Merged

feat: Add drop privilege for table objects. #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion redshift/helpers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ func validatePrivileges(privileges []string, objectType string) bool {
}
case "TABLE":
switch strings.ToUpper(p) {
case "SELECT", "UPDATE", "INSERT", "DELETE", "REFERENCES":
case "SELECT", "UPDATE", "INSERT", "DELETE", "DROP", "REFERENCES":
continue
default:
return false
Expand Down
2 changes: 1 addition & 1 deletion redshift/helpers_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ func TestValidatePrivileges(t *testing.T) {
expected: true,
},
"valid list for table": {
privileges: []string{"insert", "update", "delete", "select", "references"},
privileges: []string{"insert", "update", "delete", "select", "drop", "references"},
objectType: "table",
expected: true,
},
Expand Down
5 changes: 4 additions & 1 deletion redshift/resource_redshift_default_privileges.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,13 +194,14 @@ func resourceRedshiftDefaultPrivilegesReadImpl(db *DBConnection, d *schema.Resou
}

func readGroupTableDefaultPrivileges(tx *sql.Tx, d *schema.ResourceData, groupID, schemaID, ownerID int) error {
var tableSelect, tableUpdate, tableInsert, tableDelete, tableReferences bool
var tableSelect, tableUpdate, tableInsert, tableDelete, tableDrop, tableReferences bool
tableDefaultPrivilegeQuery := `
SELECT
decode(charindex('r',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as select,
decode(charindex('w',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as update,
decode(charindex('a',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as insert,
decode(charindex('d',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as delete,
decode(charindex('D',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as drop,
decode(charindex('x',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as references
FROM pg_group gr, pg_default_acl acl
WHERE
Expand All @@ -215,6 +216,7 @@ func readGroupTableDefaultPrivileges(tx *sql.Tx, d *schema.ResourceData, groupID
&tableUpdate,
&tableInsert,
&tableDelete,
&tableDrop,
&tableReferences); err != nil && err != sql.ErrNoRows {
return fmt.Errorf("failed to collect group privileges: %w", err)
}
Expand All @@ -224,6 +226,7 @@ func readGroupTableDefaultPrivileges(tx *sql.Tx, d *schema.ResourceData, groupID
appendIfTrue(tableUpdate, "update", &privileges)
appendIfTrue(tableInsert, "insert", &privileges)
appendIfTrue(tableDelete, "delete", &privileges)
appendIfTrue(tableDelete, "drop", &privileges)
appendIfTrue(tableReferences, "references", &privileges)

log.Printf("[DEBUG] Collected privileges for group ID %d: %v\n", groupID, privileges)
Expand Down
16 changes: 12 additions & 4 deletions redshift/resource_redshift_default_privileges_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,13 @@ func TestAccRedshiftDefaultPrivileges_Basic(t *testing.T) {
resource.TestCheckResourceAttr("redshift_default_privileges.simple_table", "id", fmt.Sprintf("%s_noschema_root_table", groupName)),
resource.TestCheckResourceAttr("redshift_default_privileges.simple_table", "group", groupName),
resource.TestCheckResourceAttr("redshift_default_privileges.simple_table", "object_type", "table"),
resource.TestCheckResourceAttr("redshift_default_privileges.simple_table", "privileges.#", "2"),
resource.TestCheckResourceAttr("redshift_default_privileges.simple_table", "privileges.#", "6"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.simple_table", "privileges.*", "select"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.simple_table", "privileges.*", "update"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.simple_table", "privileges.*", "insert"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.simple_table", "privileges.*", "delete"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.simple_table", "privileges.*", "drop"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.simple_table", "privileges.*", "references"),
),
},
},
Expand All @@ -46,9 +50,13 @@ func TestAccRedshiftDefaultPrivileges_UpdateToRevoke(t *testing.T) {
resource.TestCheckResourceAttr("redshift_default_privileges.priv", "id", fmt.Sprintf("%s_noschema_root_table", groupName)),
resource.TestCheckResourceAttr("redshift_default_privileges.priv", "group", groupName),
resource.TestCheckResourceAttr("redshift_default_privileges.priv", "object_type", "table"),
resource.TestCheckResourceAttr("redshift_default_privileges.priv", "privileges.#", "2"),
resource.TestCheckResourceAttr("redshift_default_privileges.priv", "privileges.#", "6"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.priv", "privileges.*", "select"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.priv", "privileges.*", "update"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.priv", "privileges.*", "insert"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.priv", "privileges.*", "delete"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.priv", "privileges.*", "drop"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.priv", "privileges.*", "references"),
),
},
{
Expand Down Expand Up @@ -122,7 +130,7 @@ resource "redshift_default_privileges" "simple_table" {
group = redshift_group.group.name
owner = "root"
object_type = "table"
privileges = ["SELECT", "update"]
privileges = ["select", "update", "insert", "delete", "drop", "references"]
}`, groupName)
}

Expand All @@ -136,7 +144,7 @@ resource "redshift_default_privileges" "priv" {
group = redshift_group.group.name
owner = "root"
object_type = "table"
privileges = ["insert", "select"]
privileges = ["select", "update", "insert", "delete", "drop", "references"]
}`, groupName)
}

Expand Down
8 changes: 6 additions & 2 deletions redshift/resource_redshift_grant.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,6 +246,7 @@ func readGroupTableGrants(db *DBConnection, d *schema.ResourceData) error {
decode(charindex('w',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as update,
decode(charindex('a',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as insert,
decode(charindex('d',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as delete,
decode(charindex('D',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as drop,
decode(charindex('x',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as references
FROM pg_group gr, pg_class cl
JOIN pg_namespace nsp ON nsp.oid = cl.relnamespace
Expand All @@ -266,9 +267,9 @@ func readGroupTableGrants(db *DBConnection, d *schema.ResourceData) error {

for rows.Next() {
var objName string
var tableSelect, tableUpdate, tableInsert, tableDelete, tableReferences bool
var tableSelect, tableUpdate, tableInsert, tableDelete, tableDrop, tableReferences bool

if err := rows.Scan(&objName, &tableSelect, &tableUpdate, &tableInsert, &tableDelete, &tableReferences); err != nil {
if err := rows.Scan(&objName, &tableSelect, &tableUpdate, &tableInsert, &tableDelete, &tableDrop, &tableReferences); err != nil {
return err
}

Expand All @@ -289,6 +290,9 @@ func readGroupTableGrants(db *DBConnection, d *schema.ResourceData) error {
if tableDelete {
privilegesSet.Add("delete")
}
if tableDrop {
privilegesSet.Add("drop")
}
if tableReferences {
privilegesSet.Add("references")
}
Expand Down
9 changes: 7 additions & 2 deletions redshift/resource_redshift_grant_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,8 +113,13 @@ func TestAccRedshiftGrant_BasicTable(t *testing.T) {
resource.TestCheckResourceAttr("redshift_grant.grant", "object_type", "table"),
resource.TestCheckResourceAttr("redshift_grant.grant", "objects.#", "1"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "objects.*", "pg_user_info"),
resource.TestCheckResourceAttr("redshift_grant.grant", "privileges.#", "1"),
resource.TestCheckResourceAttr("redshift_grant.grant", "privileges.#", "6"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "select"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "update"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "insert"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "delete"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "drop"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "references"),
),
},
},
Expand All @@ -133,7 +138,7 @@ resource "redshift_grant" "grant" {

object_type = "table"
objects = ["pg_user_info"]
privileges = ["select"]
privileges = ["select", "update", "insert", "delete", "drop", "references"]
}
`, groupName)
}
Expand Down
6 changes: 4 additions & 2 deletions redshift/resource_redshift_privilege.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,13 +225,14 @@ func readGroupSchemaPrivileges(tx *sql.Tx, d *schema.ResourceData, groupID, sche
}

func readGroupTablePrivileges(tx *sql.Tx, d *schema.ResourceData, groupID, schemaID int) error {
var tableSelect, tableUpdate, tableInsert, tableDelete, tableReferences bool
var tableSelect, tableUpdate, tableInsert, tableDelete, tableDrop, tableReferences bool
tableDefaultPrivilegeQuery := `
SELECT
decode(charindex('r',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as select,
decode(charindex('w',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as update,
decode(charindex('a',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as insert,
decode(charindex('d',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as delete,
decode(charindex('D',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as drop,
decode(charindex('x',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as references
FROM pg_group gr, pg_default_acl acl, pg_namespace ns
WHERE
Expand All @@ -241,7 +242,7 @@ func readGroupTablePrivileges(tx *sql.Tx, d *schema.ResourceData, groupID, schem
AND gr.grosysid = $2
AND acl.defaclobjtype = $3`

if err := tx.QueryRow(tableDefaultPrivilegeQuery, schemaID, groupID, objectTypesCodes["table"]).Scan(&tableSelect, &tableUpdate, &tableInsert, &tableDelete, &tableReferences); err != nil && err != sql.ErrNoRows {
if err := tx.QueryRow(tableDefaultPrivilegeQuery, schemaID, groupID, objectTypesCodes["table"]).Scan(&tableSelect, &tableUpdate, &tableInsert, &tableDelete, &tableDrop, &tableReferences); err != nil && err != sql.ErrNoRows {
return fmt.Errorf("failed to collect group privileges: %w", err)
}

Expand All @@ -250,6 +251,7 @@ func readGroupTablePrivileges(tx *sql.Tx, d *schema.ResourceData, groupID, schem
appendIfTrue(tableUpdate, "update", &privileges)
appendIfTrue(tableInsert, "insert", &privileges)
appendIfTrue(tableDelete, "delete", &privileges)
appendIfTrue(tableDrop, "drop", &privileges)
appendIfTrue(tableReferences, "references", &privileges)

d.Set(privilegePrivilegesAttr, privileges)
Expand Down
1 change: 1 addition & 0 deletions redshift/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ var reservedWords = []string{
"disable",
"distinct",
"do",
"drop",
"else",
"emptyasnull",
"enable",
Expand Down