sql: users with select permissions can alter tables and partitions with zone configurations

[awoods187]

In our docs, we specify that Currently, only members of the admin role can configure replication zones. By default, the root user belongs to the admin role.

We don't appear to follow that. Here is an example of creating users and databases:

create user andy;
create database foo;
use foo;
create table t (a int);
ALTER TABLE t PARTITION BY LIST (rowid) ( PARTITION new_york VALUES IN ('1'), PARTITION chicago VALUES IN ('2'), PARTITION seattle VALUES IN ('3') );
grant select on table t to andy;

Andy is able to alter tables and partitions:

./cockroach sql --insecure --user=andy
use foo;
ALTER TABLE t CONFIGURE ZONE USING gc.ttlseconds = 600;
ALTER PARTITION seattle OF TABLE t CONFIGURE ZONE USING constraints='[]';

Proof of no create table privileges:

create table t2 (a int);
pq: user andy does not have CREATE privilege on database foo

[solongordon]

Here are the privileges I'm planning to require:

• ALTER TABLE ... CONFIGURE ZONE: CREATE privilege on table
• ALTER DATABASE ... CONFIGURE ZONE: CREATE privilege on database
• ALTER RANGE ... CONFIGURE ZONE: Only root user or users with the admin role

[solongordon]

Turns out this is complicated by the fact that we want to allow CONFIGURE ZONE on system tables, but no one has CREATE privileges on them, including the root user. So probably we always want to allow admins to run CONFIGURE ZONE on system tables, even if they don't have CREATE permission.