Skip to content

Converting database to schema leaves the schema in an unusable state #65697

@charsleysa

Description

@charsleysa

Describe the problem

Converting database to schema "succeeds" but is missing the USAGE permission for user appuser and adding the USAGE permission to the schema fails with the following error

ERROR: user appuser must not have DROP, SELECT, INSERT, DELETE, UPDATE privileges on system schema with ID=174

To Reproduce

Run the following script

---
CREATE USER appuser;

CREATE DATABASE maindb;
GRANT CREATE, DROP, SELECT, INSERT, DELETE, UPDATE ON DATABASE maindb TO appuser;
SET DATABASE TO maindb;

CREATE DATABASE test2;
GRANT CREATE, DROP, SELECT, INSERT, DELETE, UPDATE ON DATABASE test2 TO appuser;
CREATE TABLE test2.test_table(hello int);

ALTER DATABASE test2 CONVERT TO SCHEMA WITH PARENT maindb;
GRANT USAGE ON SCHEMA test2 TO appuser; -- fails here

Expected behavior
All statements should execute successfully.
The final result should be a database maindb with a schema test2 and a table test2.test_table that is usable by user appuser.

Environment:

  • CockroachDB: v20.2.7
  • Server OS: Amazon Linux 2
  • Client app: cockroach sql

Additional context
Since the issue occurs after the database is converted to a schema, all tables under that schema are left in an unusable state as only admin users can access the tables and app users cannot be granted access.

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-sql-privilegesSQL privilege handling and permission checks.C-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.O-communityOriginated from the communityT-sql-foundationsSQL Foundations Team (formerly SQL Schema + SQL Sessions)X-blathers-triagedblathers was able to find an owner

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions