-
Notifications
You must be signed in to change notification settings - Fork 403
Closed
Labels
3.2Target is 3.2 and all newer release/master branchesTarget is 3.2 and all newer release/master branchesbugSomething isn't workingSomething isn't working
Description
Currently, Tarantool considers the following users and roles as system:
tarantool> for _, tuple in box.space._user:pairs() do print(tuple) end
[0, 1, 'guest', 'user', {'chap-sha1': 'vhvewKp0tNyweZQ+cFKAlsyphfg='}, [], 0]
[1, 1, 'admin', 'user', {}, [], 0]
[2, 1, 'public', 'role', {}, [], 0]
[3, 1, 'replication', 'role', {}, [], 0]
[31, 1, 'super', 'role', {}, [], 0]System users: guest, admin
System roles: public, super, replication
At the same time, there are places in the code where checks are done against system users/roles e.g.
tarantool/src/box/lua/schema.lua
Lines 4095 to 4100 in 37bca56
| if uid >= box.schema.SYSTEM_USER_ID_MIN and | |
| uid <= box.schema.SYSTEM_USER_ID_MAX or uid == box.schema.SUPER_ROLE_ID then | |
| -- gh-1205: box.schema.user.info fails | |
| box.error(box.error.DROP_USER, name, | |
| "the user or the role is a system", 2) | |
| end |
But the predefined role replication is not considered system, because
tarantool> box.schema.SYSTEM_USER_ID_MIN
---
- 0
tarantool> box.schema.SYSTEM_USER_ID_MAX
---
- 2
tarantool> box.schema.SUPER_ROLE_ID
---
- 31replication (id = 3) does not fall into the system ID range and is not listed in
Lines 183 to 191 in 37bca56
| /** Predefined user ids. */ | |
| enum { | |
| BOX_SYSTEM_USER_ID_MIN = 0, | |
| GUEST = 0, | |
| ADMIN = 1, | |
| PUBLIC = 2, /* role */ | |
| SUPER = 31, /* role */ | |
| BOX_SYSTEM_USER_ID_MAX = PUBLIC | |
| }; |
Question
Is this intentional (i.e. replication is not supposed to be treated as a system role), or is it an oversight and the role was simply forgotten in the system definitions?
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
3.2Target is 3.2 and all newer release/master branchesTarget is 3.2 and all newer release/master branchesbugSomething isn't workingSomething isn't working