Skip to content

Commit b94fbd7

Browse files
shghasemishghasemi
committed
sql: set rolreplication in pg_authid and pg_roles
Previously, rolreplication column from pg_authid and pg_roles was always set to false, therefore, it did not show whether or not the role has replication privilege. This change sets rolreplication to true if the user has at least one of REPLICATION, REPLICATIONSOURCE, or REPLICATIONDEST privileges. This change will improve the users ability to do introspection. Epic: CRDB-55074 Fixes: #147507 Release note: None
1 parent 738c039 commit b94fbd7

File tree

3 files changed

+87
-10
lines changed

3 files changed

+87
-10
lines changed

‎pkg/cli/clisqlshell/testdata/describe‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1966,10 +1966,10 @@ SELECT rolname AS "Role name",
19661966
memberof AS "Member of"
19671967
FROM roles
19681968
Role name,Attributes,Member of
1969-
myuser,"Superuser, Create role, Create DB, Bypass RLS",{admin}
1970-
root,"Superuser, Create role, Create DB, Bypass RLS",{admin}
1971-
admin,"Superuser, Create role, Create DB, Bypass RLS",{}
1972-
node,"Superuser, Create role, Create DB, Cannot login, Bypass RLS",{}
1969+
myuser,"Superuser, Create role, Create DB, Replication, Bypass RLS",{admin}
1970+
root,"Superuser, Create role, Create DB, Replication, Bypass RLS",{admin}
1971+
admin,"Superuser, Create role, Create DB, Replication, Bypass RLS",{}
1972+
node,"Superuser, Create role, Create DB, Cannot login, Replication, Bypass RLS",{}
19731973

19741974
cli
19751975
\du myuser
@@ -2008,7 +2008,7 @@ SELECT rolname AS "Role name",
20082008
memberof AS "Member of"
20092009
FROM roles
20102010
Role name,Attributes,Member of
2011-
myuser,"Superuser, Create role, Create DB, Bypass RLS",{admin}
2011+
myuser,"Superuser, Create role, Create DB, Replication, Bypass RLS",{admin}
20122012

20132013
subtest end
20142014

‎pkg/sql/logictest/testdata/logic_test/pg_catalog‎

Lines changed: 50 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2800,9 +2800,9 @@ FROM pg_catalog.pg_roles
28002800
ORDER BY rolname
28012801
----
28022802
oid rolname rolsuper rolinherit rolcreaterole rolcreatedb rolcatupdate rolcanlogin rolreplication
2803-
2310524507 admin true true true true false true false
2804-
3233629770 node true true true true false false false
2805-
1546506610 root true true true true false true false
2803+
2310524507 admin true true true true false true true
2804+
3233629770 node true true true true false false true
2805+
1546506610 root true true true true false true true
28062806
2264919399 testuser false true false false false true false
28072807

28082808
query OTITTBT colnames
@@ -2836,6 +2836,53 @@ testuser
28362836
statement ok
28372837
DELETE FROM system.users WHERE username = 'non_cached_user'
28382838

2839+
## rolreplication from pg_catalog.pg_authid and pg_catalog.pg_roles
2840+
statement ok
2841+
CREATE ROLE test_no_replication;
2842+
CREATE ROLE test_replication;
2843+
GRANT SYSTEM REPLICATION to test_replication;
2844+
CREATE ROLE test_src_replication;
2845+
GRANT SYSTEM REPLICATIONSOURCE to test_src_replication;
2846+
CREATE ROLE test_dst_replication;
2847+
GRANT SYSTEM REPLICATIONDEST to test_dst_replication;
2848+
2849+
query TB colnames
2850+
SELECT rolname, rolreplication FROM pg_catalog.pg_roles
2851+
ORDER BY rolname
2852+
----
2853+
rolname rolreplication
2854+
admin true
2855+
node true
2856+
root true
2857+
test_dst_replication true
2858+
test_no_replication false
2859+
test_replication true
2860+
test_src_replication true
2861+
testuser false
2862+
2863+
query TB colnames
2864+
SELECT rolname, rolreplication FROM pg_catalog.pg_authid
2865+
ORDER BY rolname
2866+
----
2867+
rolname rolreplication
2868+
admin true
2869+
node true
2870+
root true
2871+
test_dst_replication true
2872+
test_no_replication false
2873+
test_replication true
2874+
test_src_replication true
2875+
testuser false
2876+
2877+
statement ok
2878+
DROP ROLE test_no_replication;
2879+
REVOKE SYSTEM REPLICATION FROM test_replication;
2880+
REVOKE SYSTEM REPLICATIONSOURCE FROM test_src_replication;
2881+
REVOKE SYSTEM REPLICATIONDEST FROM test_dst_replication;
2882+
DROP ROLE test_replication;
2883+
DROP ROLE test_src_replication;
2884+
DROP ROLE test_dst_replication;
2885+
28392886
## pg_catalog.pg_auth_members
28402887

28412888
query OOOB colnames

‎pkg/sql/pg_catalog.go‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -607,6 +607,26 @@ func userIsSuper(
607607
return tree.DBool(isSuper), err
608608
}
609609

610+
func userHasReplicationPrivilegeOrRoleOption(
611+
ctx context.Context, p *planner, userName username.SQLUsername,
612+
) (tree.DBool, error) {
613+
replication, err := p.UserHasGlobalPrivilegeOrRoleOption(ctx, privilege.REPLICATION, userName)
614+
if err != nil {
615+
return *tree.DBoolFalse, err
616+
}
617+
618+
replicationDest, err := p.UserHasGlobalPrivilegeOrRoleOption(ctx, privilege.REPLICATIONDEST, userName)
619+
if err != nil {
620+
return *tree.DBoolFalse, err
621+
}
622+
623+
replicationSrc, err := p.UserHasGlobalPrivilegeOrRoleOption(ctx, privilege.REPLICATIONSOURCE, userName)
624+
if err != nil {
625+
return *tree.DBoolFalse, err
626+
}
627+
return tree.DBool(replication || replicationDest || replicationSrc), nil
628+
}
629+
610630
var pgCatalogAuthIDTable = virtualSchemaTable{
611631
comment: `authorization identifiers - differs from postgres as we do not display passwords,
612632
and thus do not require admin privileges for access.
@@ -649,6 +669,11 @@ https://www.postgresql.org/docs/9.5/catalog-pg-authid.html`,
649669
return err
650670
}
651671

672+
replication, err := userHasReplicationPrivilegeOrRoleOption(ctx, p, userName)
673+
if err != nil {
674+
return err
675+
}
676+
652677
return addRow(
653678
h.UserOid(userName), // oid
654679
tree.NewDName(userName.Normalized()), // rolname
@@ -657,7 +682,7 @@ https://www.postgresql.org/docs/9.5/catalog-pg-authid.html`,
657682
tree.MakeDBool(isRoot || tree.DBool(createRole)), // rolcreaterole
658683
tree.MakeDBool(isRoot || tree.DBool(createDB)), // rolcreatedb
659684
tree.MakeDBool(roleCanLogin), // rolcanlogin.
660-
tree.DBoolFalse, // rolreplication
685+
tree.MakeDBool(replication), // rolreplication
661686
tree.MakeDBool(tree.DBool(bypassRLS)), // rolbypassrls
662687
negOneVal, // rolconnlimit
663688
passwdStarString, // rolpassword
@@ -3022,6 +3047,11 @@ https://www.postgresql.org/docs/9.5/view-pg-roles.html`,
30223047
return err
30233048
}
30243049

3050+
replication, err := userHasReplicationPrivilegeOrRoleOption(ctx, p, userName)
3051+
if err != nil {
3052+
return err
3053+
}
3054+
30253055
return addRow(
30263056
h.UserOid(userName), // oid
30273057
tree.NewDName(userName.Normalized()), // rolname
@@ -3031,7 +3061,7 @@ https://www.postgresql.org/docs/9.5/view-pg-roles.html`,
30313061
tree.MakeDBool(isSuper || tree.DBool(createDB)), // rolcreatedb
30323062
tree.DBoolFalse, // rolcatupdate
30333063
tree.MakeDBool(roleCanLogin), // rolcanlogin.
3034-
tree.DBoolFalse, // rolreplication
3064+
tree.MakeDBool(replication), // rolreplication
30353065
negOneVal, // rolconnlimit
30363066
passwdStarString, // rolpassword
30373067
rolValidUntil, // rolvaliduntil

0 commit comments

Comments
 (0)