Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add rule and trigger permissions to grant and default_grant #63

Merged
merged 2 commits into from
Apr 20, 2022
Merged

Add rule and trigger permissions to grant and default_grant #63

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e55c905
add rule and trigger permissions to grant and default_grant
mtesch-um Mar 18, 2022
e4ae35e
8 privs now
mtesch-um Mar 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion redshift/helpers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ func validatePrivileges(privileges []string, objectType string) bool {
}
case "TABLE":
switch strings.ToUpper(p) {
case "SELECT", "UPDATE", "INSERT", "DELETE", "DROP", "REFERENCES":
case "SELECT", "UPDATE", "INSERT", "DELETE", "DROP", "REFERENCES", "RULE", "TRIGGER":
continue
default:
return false
Expand Down
2 changes: 1 addition & 1 deletion redshift/helpers_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ func TestValidatePrivileges(t *testing.T) {
expected: true,
},
"valid list for table": {
privileges: []string{"insert", "update", "delete", "select", "drop", "references"},
privileges: []string{"insert", "update", "delete", "select", "drop", "references", "rule", "trigger"},
objectType: "table",
expected: true,
},
Expand Down
16 changes: 12 additions & 4 deletions redshift/resource_redshift_default_privileges.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,7 @@ func resourceRedshiftDefaultPrivilegesReadImpl(db *DBConnection, d *schema.Resou
}

func readGroupTableDefaultPrivileges(tx *sql.Tx, d *schema.ResourceData, entityID, schemaID, ownerID int, entityIsUser bool) error {
var tableSelect, tableUpdate, tableInsert, tableDelete, tableDrop, tableReferences bool
var tableSelect, tableUpdate, tableInsert, tableDelete, tableDrop, tableReferences, tableRule, tableTrigger bool
var query string

if entityIsUser {
Expand All @@ -225,7 +225,9 @@ func readGroupTableDefaultPrivileges(tx *sql.Tx, d *schema.ResourceData, entityI
decode(charindex('a',split_part(split_part(regexp_replace(array_to_string(defaclacl, '|'), 'group '||u.usename), u.usename||'=', 2) ,'/',1)),0,0,1) as insert,
decode(charindex('d',split_part(split_part(regexp_replace(array_to_string(defaclacl, '|'), 'group '||u.usename), u.usename||'=', 2) ,'/',1)),0,0,1) as delete,
decode(charindex('D',split_part(split_part(regexp_replace(array_to_string(defaclacl, '|'), 'group '||u.usename), u.usename||'=', 2) ,'/',1)),0,0,1) as drop,
decode(charindex('x',split_part(split_part(regexp_replace(array_to_string(defaclacl, '|'), 'group '||u.usename), u.usename||'=', 2) ,'/',1)),0,0,1) as references
decode(charindex('x',split_part(split_part(regexp_replace(array_to_string(defaclacl, '|'), 'group '||u.usename), u.usename||'=', 2) ,'/',1)),0,0,1) as references,
decode(charindex('R',split_part(split_part(regexp_replace(array_to_string(defaclacl, '|'), 'group '||u.usename), u.usename||'=', 2) ,'/',1)),0,0,1) as rule,
decode(charindex('t',split_part(split_part(regexp_replace(array_to_string(defaclacl, '|'), 'group '||u.usename), u.usename||'=', 2) ,'/',1)),0,0,1) as trigger
FROM pg_user u, pg_default_acl acl
WHERE
acl.defaclnamespace = $1
Expand All @@ -242,7 +244,9 @@ func readGroupTableDefaultPrivileges(tx *sql.Tx, d *schema.ResourceData, entityI
decode(charindex('a',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as insert,
decode(charindex('d',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as delete,
decode(charindex('D',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as drop,
decode(charindex('x',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as references
decode(charindex('x',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as references,
decode(charindex('R',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as rule,
decode(charindex('t',split_part(split_part(array_to_string(defaclacl, '|'),'group ' || gr.groname,2 ) ,'/',1)),0,0,1) as trigger
FROM pg_group gr, pg_default_acl acl
WHERE
acl.defaclnamespace = $1
Expand All @@ -259,7 +263,9 @@ func readGroupTableDefaultPrivileges(tx *sql.Tx, d *schema.ResourceData, entityI
&tableInsert,
&tableDelete,
&tableDrop,
&tableReferences); err != nil && err != sql.ErrNoRows {
&tableReferences,
&tableRule,
&tableTrigger); err != nil && err != sql.ErrNoRows {
return fmt.Errorf("failed to collect privileges: %w", err)
}

Expand All @@ -270,6 +276,8 @@ func readGroupTableDefaultPrivileges(tx *sql.Tx, d *schema.ResourceData, entityI
appendIfTrue(tableDelete, "delete", &privileges)
appendIfTrue(tableDrop, "drop", &privileges)
appendIfTrue(tableReferences, "references", &privileges)
appendIfTrue(tableRule, "rule", &privileges)
appendIfTrue(tableTrigger, "trigger", &privileges)

log.Printf("[DEBUG] Collected privileges for ID %d: %v\n", entityID, privileges)

Expand Down
24 changes: 16 additions & 8 deletions redshift/resource_redshift_default_privileges_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,14 +29,14 @@ resource "redshift_default_privileges" "group" {
group = redshift_group.group.name
owner = "root"
object_type = "table"
privileges = ["select", "update", "insert", "delete", "drop", "references"]
privileges = ["select", "update", "insert", "delete", "drop", "references", "rule", "trigger"]
}

resource "redshift_default_privileges" "user" {
user = redshift_user.user.name
owner = "root"
object_type = "table"
privileges = ["select", "update", "insert", "delete", "drop", "references"]
privileges = ["select", "update", "insert", "delete", "drop", "references", "rule", "trigger"]
}
`, groupName, userName)

Expand All @@ -51,24 +51,28 @@ resource "redshift_default_privileges" "user" {
resource.TestCheckResourceAttr("redshift_default_privileges.group", "id", fmt.Sprintf("gn:%s_noschema_on:root_ot:table", groupName)),
resource.TestCheckResourceAttr("redshift_default_privileges.group", "group", groupName),
resource.TestCheckResourceAttr("redshift_default_privileges.group", "object_type", "table"),
resource.TestCheckResourceAttr("redshift_default_privileges.group", "privileges.#", "6"),
resource.TestCheckResourceAttr("redshift_default_privileges.group", "privileges.#", "8"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "select"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "update"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "insert"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "delete"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "drop"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "references"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "rule"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "trigger"),

resource.TestCheckResourceAttr("redshift_default_privileges.user", "id", fmt.Sprintf("un:%s_noschema_on:root_ot:table", userName)),
resource.TestCheckResourceAttr("redshift_default_privileges.user", "user", userName),
resource.TestCheckResourceAttr("redshift_default_privileges.user", "object_type", "table"),
resource.TestCheckResourceAttr("redshift_default_privileges.user", "privileges.#", "6"),
resource.TestCheckResourceAttr("redshift_default_privileges.user", "privileges.#", "8"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "select"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "update"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "insert"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "delete"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "drop"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "references"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "rule"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "trigger"),
),
},
},
Expand All @@ -92,14 +96,14 @@ resource "redshift_default_privileges" "group" {
group = redshift_group.group.name
owner = "root"
object_type = "table"
privileges = ["select", "update", "insert", "delete", "drop", "references"]
privileges = ["select", "update", "insert", "delete", "drop", "references", "rule", "trigger"]
}

resource "redshift_default_privileges" "user" {
user = redshift_user.user.name
owner = "root"
object_type = "table"
privileges = ["select", "update", "insert", "delete", "drop", "references"]
privileges = ["select", "update", "insert", "delete", "drop", "references", "rule", "trigger"]
}
`, groupName, userName)

Expand Down Expand Up @@ -139,24 +143,28 @@ resource "redshift_default_privileges" "user" {
resource.TestCheckResourceAttr("redshift_default_privileges.group", "id", fmt.Sprintf("gn:%s_noschema_on:root_ot:table", groupName)),
resource.TestCheckResourceAttr("redshift_default_privileges.group", "group", groupName),
resource.TestCheckResourceAttr("redshift_default_privileges.group", "object_type", "table"),
resource.TestCheckResourceAttr("redshift_default_privileges.group", "privileges.#", "6"),
resource.TestCheckResourceAttr("redshift_default_privileges.group", "privileges.#", "8"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "select"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "update"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "insert"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "delete"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "drop"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "references"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "rule"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.group", "privileges.*", "trigger"),

resource.TestCheckResourceAttr("redshift_default_privileges.user", "id", fmt.Sprintf("un:%s_noschema_on:root_ot:table", userName)),
resource.TestCheckResourceAttr("redshift_default_privileges.user", "user", userName),
resource.TestCheckResourceAttr("redshift_default_privileges.user", "object_type", "table"),
resource.TestCheckResourceAttr("redshift_default_privileges.user", "privileges.#", "6"),
resource.TestCheckResourceAttr("redshift_default_privileges.user", "privileges.#", "8"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "select"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "update"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "insert"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "delete"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "drop"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "references"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "rule"),
resource.TestCheckTypeSetElemAttr("redshift_default_privileges.user", "privileges.*", "trigger"),
),
},
{
Expand Down
18 changes: 14 additions & 4 deletions redshift/resource_redshift_grant.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,7 +292,9 @@ func readTableGrants(db *DBConnection, d *schema.ResourceData) error {
decode(charindex('a',split_part(split_part(regexp_replace(array_to_string(relacl, '|'),'group '||u.usename), u.usename||'=', 2) ,'/',1)),null,0,0,0,1) as insert,
decode(charindex('d',split_part(split_part(regexp_replace(array_to_string(relacl, '|'),'group '||u.usename), u.usename||'=', 2) ,'/',1)),null,0,0,0,1) as delete,
decode(charindex('D',split_part(split_part(regexp_replace(array_to_string(relacl, '|'),'group '||u.usename), u.usename||'=', 2) ,'/',1)),null,0,0,0,1) as drop,
decode(charindex('x',split_part(split_part(regexp_replace(array_to_string(relacl, '|'),'group '||u.usename), u.usename||'=', 2) ,'/',1)),null,0,0,0,1) as references
decode(charindex('x',split_part(split_part(regexp_replace(array_to_string(relacl, '|'),'group '||u.usename), u.usename||'=', 2) ,'/',1)),null,0,0,0,1) as references,
decode(charindex('R',split_part(split_part(regexp_replace(array_to_string(relacl, '|'),'group '||u.usename), u.usename||'=', 2) ,'/',1)),null,0,0,0,1) as rule,
decode(charindex('t',split_part(split_part(regexp_replace(array_to_string(relacl, '|'),'group '||u.usename), u.usename||'=', 2) ,'/',1)),null,0,0,0,1) as trigger
FROM pg_user u, pg_class cl
JOIN pg_namespace nsp ON nsp.oid = cl.relnamespace
WHERE
Expand All @@ -310,7 +312,9 @@ func readTableGrants(db *DBConnection, d *schema.ResourceData) error {
decode(charindex('a',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as insert,
decode(charindex('d',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as delete,
decode(charindex('D',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as drop,
decode(charindex('x',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as references
decode(charindex('x',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as references,
decode(charindex('R',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as rule,
decode(charindex('t',split_part(split_part(array_to_string(relacl, '|'),'group ' || gr.groname,2 ) ,'/',1)), null,0, 0,0, 1) as trigger
FROM pg_group gr, pg_class cl
JOIN pg_namespace nsp ON nsp.oid = cl.relnamespace
WHERE
Expand All @@ -330,9 +334,9 @@ func readTableGrants(db *DBConnection, d *schema.ResourceData) error {

for rows.Next() {
var objName string
var tableSelect, tableUpdate, tableInsert, tableDelete, tableDrop, tableReferences bool
var tableSelect, tableUpdate, tableInsert, tableDelete, tableDrop, tableReferences, tableRule, tableTrigger bool

if err := rows.Scan(&objName, &tableSelect, &tableUpdate, &tableInsert, &tableDelete, &tableDrop, &tableReferences); err != nil {
if err := rows.Scan(&objName, &tableSelect, &tableUpdate, &tableInsert, &tableDelete, &tableDrop, &tableReferences, &tableRule, &tableTrigger); err != nil {
return err
}

Expand All @@ -359,6 +363,12 @@ func readTableGrants(db *DBConnection, d *schema.ResourceData) error {
if tableReferences {
privilegesSet.Add("references")
}
if tableRule {
privilegesSet.Add("rule")
}
if tableTrigger {
privilegesSet.Add("trigger")
}

if !privilegesSet.Equal(d.Get(grantPrivilegesAttr).(*schema.Set)) {
d.Set(grantPrivilegesAttr, privilegesSet)
Expand Down
12 changes: 8 additions & 4 deletions redshift/resource_redshift_grant_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ resource "redshift_grant" "grant" {

object_type = "table"
objects = ["pg_user_info"]
privileges = ["select", "update", "insert", "delete", "drop", "references"]
privileges = ["select", "update", "insert", "delete", "drop", "references", "rule", "trigger"]
}

resource "redshift_grant" "grant_user" {
Expand All @@ -155,7 +155,7 @@ resource "redshift_grant" "grant_user" {

object_type = "table"
objects = ["pg_user_info"]
privileges = ["select", "update", "insert", "delete", "drop", "references"]
privileges = ["select", "update", "insert", "delete", "drop", "references", "rule", "trigger"]
}
`, groupName, userName)

Expand All @@ -173,27 +173,31 @@ resource "redshift_grant" "grant_user" {
resource.TestCheckResourceAttr("redshift_grant.grant", "object_type", "table"),
resource.TestCheckResourceAttr("redshift_grant.grant", "objects.#", "1"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "objects.*", "pg_user_info"),
resource.TestCheckResourceAttr("redshift_grant.grant", "privileges.#", "6"),
resource.TestCheckResourceAttr("redshift_grant.grant", "privileges.#", "8"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "select"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "update"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "insert"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "delete"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "drop"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "references"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "rule"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant", "privileges.*", "trigger"),

resource.TestCheckResourceAttr("redshift_grant.grant_user", "id", fmt.Sprintf("un:%s_ot:table_pg_catalog_pg_user_info", userName)),
resource.TestCheckResourceAttr("redshift_grant.grant_user", "user", userName),
resource.TestCheckResourceAttr("redshift_grant.grant_user", "schema", "pg_catalog"),
resource.TestCheckResourceAttr("redshift_grant.grant_user", "object_type", "table"),
resource.TestCheckResourceAttr("redshift_grant.grant_user", "objects.#", "1"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant_user", "objects.*", "pg_user_info"),
resource.TestCheckResourceAttr("redshift_grant.grant_user", "privileges.#", "6"),
resource.TestCheckResourceAttr("redshift_grant.grant_user", "privileges.#", "8"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant_user", "privileges.*", "select"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant_user", "privileges.*", "update"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant_user", "privileges.*", "insert"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant_user", "privileges.*", "delete"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant_user", "privileges.*", "drop"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant_user", "privileges.*", "references"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant_user", "privileges.*", "rule"),
resource.TestCheckTypeSetElemAttr("redshift_grant.grant_user", "privileges.*", "trigger"),
),
},
},
Expand Down
2 changes: 2 additions & 0 deletions redshift/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,7 @@ var reservedWords = []string{
"resort",
"restore",
"right",
"rule",
"select",
"session_user",
"similar",
Expand All @@ -149,6 +150,7 @@ var reservedWords = []string{
"to",
"top",
"trailing",
"trigger",
"true",
"truncatecolumns",
"union",
Expand Down