-
Notifications
You must be signed in to change notification settings - Fork 4.1k
Converting database to schema leaves the schema in an unusable state #65697
Copy link
Copy link
Closed
Copy link
Labels
A-sql-privilegesSQL privilege handling and permission checks.SQL privilege handling and permission checks.C-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.O-communityOriginated from the communityOriginated from the communityT-sql-foundationsSQL Foundations Team (formerly SQL Schema + SQL Sessions)SQL Foundations Team (formerly SQL Schema + SQL Sessions)X-blathers-triagedblathers was able to find an ownerblathers was able to find an owner
Description
Describe the problem
Converting database to schema "succeeds" but is missing the USAGE permission for user appuser and adding the USAGE permission to the schema fails with the following error
ERROR: user appuser must not have DROP, SELECT, INSERT, DELETE, UPDATE privileges on system schema with ID=174
To Reproduce
Run the following script
---
CREATE USER appuser;
CREATE DATABASE maindb;
GRANT CREATE, DROP, SELECT, INSERT, DELETE, UPDATE ON DATABASE maindb TO appuser;
SET DATABASE TO maindb;
CREATE DATABASE test2;
GRANT CREATE, DROP, SELECT, INSERT, DELETE, UPDATE ON DATABASE test2 TO appuser;
CREATE TABLE test2.test_table(hello int);
ALTER DATABASE test2 CONVERT TO SCHEMA WITH PARENT maindb;
GRANT USAGE ON SCHEMA test2 TO appuser; -- fails hereExpected behavior
All statements should execute successfully.
The final result should be a database maindb with a schema test2 and a table test2.test_table that is usable by user appuser.
Environment:
- CockroachDB: v20.2.7
- Server OS: Amazon Linux 2
- Client app:
cockroach sql
Additional context
Since the issue occurs after the database is converted to a schema, all tables under that schema are left in an unusable state as only admin users can access the tables and app users cannot be granted access.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
A-sql-privilegesSQL privilege handling and permission checks.SQL privilege handling and permission checks.C-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.O-communityOriginated from the communityOriginated from the communityT-sql-foundationsSQL Foundations Team (formerly SQL Schema + SQL Sessions)SQL Foundations Team (formerly SQL Schema + SQL Sessions)X-blathers-triagedblathers was able to find an ownerblathers was able to find an owner