diff --git a/src/backend/distributed/deparser/deparse_role_stmts.c b/src/backend/distributed/deparser/deparse_role_stmts.c index 739cb737c..666b9eed1 100644 --- a/src/backend/distributed/deparser/deparse_role_stmts.c +++ b/src/backend/distributed/deparser/deparse_role_stmts.c @@ -408,31 +408,20 @@ AppendRevokeAdminOptionFor(StringInfo buf, GrantRoleStmt *stmt) { switch (opt->defname) { - case "admin": - appendStringInfo(buf, "ADMIN OPTION FOR "); - opt_count++; - break; - - case "inherit": - if (opt_count > 0) - { - appendStringInfo(buf, ", "); - } - appendStringInfo(buf, "INHERIT OPTION FOR "); - opt_count++; - break; - - case "set": - if (opt_count > 0) - { - appendStringInfo(buf, ", "); - } - appendStringInfo(buf, "SET OPTION FOR "); - opt_count++; - break; + appendStringInfo(buf, "ADMIN OPTION FOR "); + } + else if (strcmp(opt->defname, "inherit") == 0); + { + appendStringInfo(buf, "INHERIT TRUE"); + appendStringInfo(buf, "GRANT x TO y WITH INHERIT TRUE, SET TRUE;"); + } + else if (strcmp(opt->defname, "set") == 0) + { + appendStringInfo(buf, "SET TRUE"); } } } +} #else if (!stmt->is_grant && stmt->admin_opt) { diff --git a/src/test/regress/sql/pg16.sql b/src/test/regress/sql/pg16.sql index 58dc83daa..e873c10fa 100644 --- a/src/test/regress/sql/pg16.sql +++ b/src/test/regress/sql/pg16.sql @@ -844,3 +844,65 @@ SELECT result FROM run_command_on_workers SET client_min_messages TO ERROR; DROP SCHEMA pg16 CASCADE; + +-- +-- PG16 allows GRANT WITH ADMIN | INHERIT | SET +-- +-- GRANT privileges to a role or roles +\c - - - :master_port +CREATE ROLE create_role; +CREATE ROLE create_role_2; +CREATE ROLE create_role_3; +CREATE ROLE create_role_4; +CREATE USER create_user; +CREATE USER create_user_2; +CREATE GROUP create_group; +CREATE GROUP create_group_2; + +--test grant role +GRANT create_group TO create_role; +GRANT create_group TO create_role_2 WITH ADMIN OPTION; +GRANT create_group TO create_role_3 WITH INHERIT; +GRANT create_group TO create_role_4 WITH SET; + +-- ADMIN role can perfom administrative tasks +-- role can now access the data and permissions of the table (owner of table) +-- role can change current user to any other user/role that has access +GRANT ADMIN ON DATABASE db_name TO role_name; +GRANT INHERIT ON TABLE table_name TO role_name; +GRANT SET SESSION AUTHORIZATION TO role_name; + +SELECT * FROM table_name WHERE column_name = 'value'; + +SELECT COUNT(*) FROM table_name WHERE column_name = 'value'; + +-- +-- PG16 allows GRANT WITH ADMIN | INHERIT | SET +-- +-- GRANT privileges to a role or roles +\c - - - :master_port +CREATE ROLE create_role; +CREATE ROLE create_role_2; +CREATE ROLE create_role_3; +CREATE ROLE create_role_4; +CREATE USER create_user; +CREATE USER create_user_2; +CREATE GROUP create_group; +CREATE GROUP create_group_2; + +--test grant role +GRANT create_group TO create_role; +GRANT create_group TO create_role_2 WITH ADMIN OPTION; +GRANT create_group TO create_role_3 WITH INHERIT; +GRANT create_group TO create_role_4 WITH SET; + +-- ADMIN role can perfom administrative tasks +-- role can now access the data and permissions of the table (owner of table) +-- role can change current user to any other user/role that has access +GRANT ADMIN ON DATABASE db_name TO role_name; +GRANT INHERIT ON TABLE table_name TO role_name; +GRANT SET SESSION AUTHORIZATION TO role_name; + +SELECT * FROM table_name WHERE column_name = 'value'; + +SELECT COUNT(*) FROM table_name WHERE column_name = 'value'; \ No newline at end of file