Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Get-DbaPermission does not process DENY #9416

Merged
merged 1 commit into from
Jul 16, 2024
Merged

Get-DbaPermission does not process DENY #9416

merged 1 commit into from
Jul 16, 2024

Conversation

pollusb
Copy link
Contributor

@pollusb pollusb commented Jul 4, 2024

Type of Change

  • Bug fix (non-breaking change, fixes # )
  • New feature (non-breaking change, adds functionality, fixes # )
  • Breaking change (affects multiple commands or functionality, fixes # )
  • Ran manual Pester test and has passed (.\tests\manual.pester.ps1)
  • Adding code coverage to existing functionality
  • Pester test is included
  • If new file reference added for test, has is been added to github.com/dataplat/appveyor-lab ?
  • Unit test is included
  • Documentation
  • Build system

Purpose

Resolve wrong GrantStatement

Commands to test

PS> $perm = Get-DbaPermission @splat -ExcludeSystemObjects 
PS> $perm|? PermState -eq DENY|select -f 1 PermState,PermissionName,GrantStatement

PermState      : DENY
PermissionName : DELETE
GrantStatement : GRANT DELETE ON [dbo].[table1] TO [user1]

PS> $perm = Get-DbaPermission @splat -ExcludeSystemObjects 
PS> $perm|? PermState -eq DENY|select -f 1 PermState,PermissionName,GrantStatement

PermState      : DENY
PermissionName : DELETE
GrantStatement : DENY DELETE ON [dbo].[table1] TO [user1]

@pollusb
Get-DbaPermission does not process DENY
e1359bb 
PS> $perm = Get-DbaPermission @Splat -ExcludeSystemObjects
PS> $perm|? PermState -eq DENY|select -f 1 PermState,PermissionName,GrantStatement

PermState      : DENY
PermissionName : DELETE
GrantStatement : GRANT DELETE ON [dbo].[table1] TO [user1]

PS> $perm = Get-DbaPermission @Splat -ExcludeSystemObjects
PS> $perm|? PermState -eq DENY|select -f 1 PermState,PermissionName,GrantStatement

PermState      : DENY
PermissionName : DELETE
GrantStatement : GRANT DELETE ON [dbo].[table1] TO [user1]
@pollusb
Copy link
Contributor Author

pollusb commented Jul 5, 2024

What can I do to help it pass the last check?

Thanks

@niphlod
Copy link
Contributor

niphlod commented Jul 5, 2024

hi @pollusb , failure was seemingly unrelated. I restarted the CI process.
PS: If I'm not around just pushing a new commit will trigger the CI automatically.

@pollusb
Copy link
Contributor Author

pollusb commented Jul 5, 2024 via email

Imran-imtiaz48

This comment was marked as outdated.

Sign in to view

@pollusb
Copy link
Contributor Author

pollusb commented Jul 10, 2024

@Imran-imtiaz48
Are you asking something from me?
If so, please clarify exactly what you expect from me.

Thanks

@pollusb
Copy link
Contributor Author

pollusb commented Jul 11, 2024

The actual code does not provide the right TSQL command. On database objects, you can GRANT or DENY an ACTION on an OBJECT to a USER. Let's use this example:
GRANT SELECT on dbo.Table1 to User1
When you ask Get-DbaPermission to provide 'GrantStatement' it will resolve correctly. But if you try to DENY it then the actual rationale is wrong.
DENY SELECT on dbo.Table1 to User1 would produce GRANT SELECT on dbo.Table1 to User1 in column GrantStatement.

I know that the column name is GrantStatement and RevokeStatement. We shouldn't create a new column DenyColumn because you can REVOKE both GRANT or DENY in the same way.

GRANT SELECT on dbo.Table1 to User1 -- would give access
DENY SELECT on dbo.Table1 to User1 -- would revoke the precedent grant and deny access
REVOKE SELECT on dbo.Table1 to User1 -- would revoke the precedent deny

@potatoqualitee
Copy link
Member

@pollusb please ignore the review, it's AI generated. I appreciate AI but it needs to be implemented with intent and after a discussion with the team.

@potatoqualitee
Copy link
Member

and thank you! 🥳

@potatoqualitee potatoqualitee merged commit 35baf52 into dataplat:development Jul 16, 2024
3 checks passed
@pollusb
Copy link
Contributor Author

pollusb commented Jul 16, 2024

Thanks to you.

@pollusb pollusb deleted the Get-DbaPermission_DENY branch July 16, 2024 23:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Imran-imtiaz48 Imran-imtiaz48 Imran-imtiaz48 left review comments

@niphlod niphlod niphlod approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@pollusb @niphlod @potatoqualitee @Imran-imtiaz48