diff --git a/src/test/regress/expected/metadata_sync_2pc.out b/src/test/regress/expected/metadata_sync_2pc.out index 23c1b5b20..7130a4db8 100644 --- a/src/test/regress/expected/metadata_sync_2pc.out +++ b/src/test/regress/expected/metadata_sync_2pc.out @@ -2,6 +2,7 @@ CREATE SCHEMA metadata_sync_2pc_schema; SET search_path TO metadata_sync_2pc_schema; set citus.enable_create_database_propagation to on; CREATE DATABASE metadata_sync_2pc_db; +revoke connect,temp,temporary on database metadata_sync_2pc_db from public; \c metadata_sync_2pc_db SHOW citus.main_db; citus.main_db @@ -21,10 +22,45 @@ select 1 from citus_remove_node('localhost', :worker_2_port); 1 (1 row) +--tests for grant role \c metadata_sync_2pc_db grant grant_role2pc_user1,grant_role2pc_user2 to grant_role2pc_user3 WITH ADMIN OPTION; grant grant_role2pc_user1,grant_role2pc_user2 to grant_role2pc_user4,grant_role2pc_user5 granted by grant_role2pc_user3; +--test for grant on database +\c metadata_sync_2pc_db - - :master_port +grant create on database metadata_sync_2pc_db to grant_role2pc_user1; +grant connect on database metadata_sync_2pc_db to grant_role2pc_user2; +grant ALL on database metadata_sync_2pc_db to grant_role2pc_user3; \c regression +select check_database_privileges('grant_role2pc_user1','metadata_sync_2pc_db',ARRAY['CREATE']); + check_database_privileges +--------------------------------------------------------------------- + (CREATE,t) + (CREATE,t) +(2 rows) + +select check_database_privileges('grant_role2pc_user2','metadata_sync_2pc_db',ARRAY['CONNECT']); + check_database_privileges +--------------------------------------------------------------------- + (CONNECT,t) + (CONNECT,t) +(2 rows) + +select check_database_privileges('grant_role2pc_user3','metadata_sync_2pc_db',ARRAY['CREATE','CONNECT','TEMP','TEMPORARY']); + check_database_privileges +--------------------------------------------------------------------- + (CREATE,t) + (CREATE,t) + (CONNECT,t) + (CONNECT,t) + (TEMP,t) + (TEMP,t) + (TEMPORARY,t) + (TEMPORARY,t) +(8 rows) + +\c regression +set citus.enable_create_database_propagation to on; select 1 from citus_add_node('localhost', :worker_2_port); ?column? --------------------------------------------------------------------- @@ -48,10 +84,46 @@ $$); [{"member":"grant_role2pc_user3","role":"grant_role2pc_user1","grantor":"postgres","admin_option":true},{"member":"grant_role2pc_user3","role":"grant_role2pc_user2","grantor":"postgres","admin_option":true},{"member":"grant_role2pc_user4","role":"grant_role2pc_user1","grantor":"postgres","admin_option":false},{"member":"grant_role2pc_user4","role":"grant_role2pc_user2","grantor":"postgres","admin_option":false},{"member":"grant_role2pc_user5","role":"grant_role2pc_user1","grantor":"postgres","admin_option":false},{"member":"grant_role2pc_user5","role":"grant_role2pc_user2","grantor":"postgres","admin_option":false}] (3 rows) +select check_database_privileges('grant_role2pc_user1','metadata_sync_2pc_db',ARRAY['CREATE']); + check_database_privileges +--------------------------------------------------------------------- + (CREATE,t) + (CREATE,t) + (CREATE,t) +(3 rows) + +select check_database_privileges('grant_role2pc_user2','metadata_sync_2pc_db',ARRAY['CONNECT']); + check_database_privileges +--------------------------------------------------------------------- + (CONNECT,t) + (CONNECT,t) + (CONNECT,t) +(3 rows) + +select check_database_privileges('grant_role2pc_user3','metadata_sync_2pc_db',ARRAY['CREATE','CONNECT','TEMP','TEMPORARY']); + check_database_privileges +--------------------------------------------------------------------- + (CREATE,t) + (CREATE,t) + (CREATE,t) + (CONNECT,t) + (CONNECT,t) + (CONNECT,t) + (TEMP,t) + (TEMP,t) + (TEMP,t) + (TEMPORARY,t) + (TEMPORARY,t) + (TEMPORARY,t) +(12 rows) + \c metadata_sync_2pc_db revoke grant_role2pc_user1,grant_role2pc_user2 from grant_role2pc_user4,grant_role2pc_user5 granted by grant_role2pc_user3; revoke admin option for grant_role2pc_user1,grant_role2pc_user2 from grant_role2pc_user3; revoke grant_role2pc_user1,grant_role2pc_user2 from grant_role2pc_user3; +revoke ALL on database metadata_sync_2pc_db from grant_role2pc_user3; +revoke CONNECT on database metadata_sync_2pc_db from grant_role2pc_user2; +revoke CREATE on database metadata_sync_2pc_db from grant_role2pc_user1; \c regression drop user grant_role2pc_user1,grant_role2pc_user2,grant_role2pc_user3,grant_role2pc_user4,grant_role2pc_user5; set citus.enable_create_database_propagation to on; diff --git a/src/test/regress/sql/metadata_sync_2pc.sql b/src/test/regress/sql/metadata_sync_2pc.sql index 8d6ee6467..c0de67674 100644 --- a/src/test/regress/sql/metadata_sync_2pc.sql +++ b/src/test/regress/sql/metadata_sync_2pc.sql @@ -5,8 +5,11 @@ SET search_path TO metadata_sync_2pc_schema; set citus.enable_create_database_propagation to on; + CREATE DATABASE metadata_sync_2pc_db; +revoke connect,temp,temporary on database metadata_sync_2pc_db from public; + \c metadata_sync_2pc_db SHOW citus.main_db; @@ -20,14 +23,32 @@ CREATE USER grant_role2pc_user5; \c regression select 1 from citus_remove_node('localhost', :worker_2_port); +--tests for grant role \c metadata_sync_2pc_db grant grant_role2pc_user1,grant_role2pc_user2 to grant_role2pc_user3 WITH ADMIN OPTION; grant grant_role2pc_user1,grant_role2pc_user2 to grant_role2pc_user4,grant_role2pc_user5 granted by grant_role2pc_user3; + +--test for grant on database +\c metadata_sync_2pc_db - - :master_port +grant create on database metadata_sync_2pc_db to grant_role2pc_user1; +grant connect on database metadata_sync_2pc_db to grant_role2pc_user2; +grant ALL on database metadata_sync_2pc_db to grant_role2pc_user3; + \c regression + +select check_database_privileges('grant_role2pc_user1','metadata_sync_2pc_db',ARRAY['CREATE']); +select check_database_privileges('grant_role2pc_user2','metadata_sync_2pc_db',ARRAY['CONNECT']); +select check_database_privileges('grant_role2pc_user3','metadata_sync_2pc_db',ARRAY['CREATE','CONNECT','TEMP','TEMPORARY']); + + + +\c regression +set citus.enable_create_database_propagation to on; select 1 from citus_add_node('localhost', :worker_2_port); + select result FROM run_command_on_all_nodes($$ SELECT array_to_json(array_agg(row_to_json(t))) FROM ( @@ -39,6 +60,10 @@ FROM ( ) t $$); +select check_database_privileges('grant_role2pc_user1','metadata_sync_2pc_db',ARRAY['CREATE']); +select check_database_privileges('grant_role2pc_user2','metadata_sync_2pc_db',ARRAY['CONNECT']); +select check_database_privileges('grant_role2pc_user3','metadata_sync_2pc_db',ARRAY['CREATE','CONNECT','TEMP','TEMPORARY']); + \c metadata_sync_2pc_db revoke grant_role2pc_user1,grant_role2pc_user2 from grant_role2pc_user4,grant_role2pc_user5 granted by grant_role2pc_user3; @@ -47,6 +72,10 @@ revoke admin option for grant_role2pc_user1,grant_role2pc_user2 from grant_role2 revoke grant_role2pc_user1,grant_role2pc_user2 from grant_role2pc_user3; +revoke ALL on database metadata_sync_2pc_db from grant_role2pc_user3; +revoke CONNECT on database metadata_sync_2pc_db from grant_role2pc_user2; +revoke CREATE on database metadata_sync_2pc_db from grant_role2pc_user1; + \c regression drop user grant_role2pc_user1,grant_role2pc_user2,grant_role2pc_user3,grant_role2pc_user4,grant_role2pc_user5;