sql: Add multi-role grant/revoke privilege stmt (#19171)

This commit adds the ability to specify multiple roles in a GRANT/REVOKE privilege statement. Resolves #18972
MaterializeInc · May 9, 2023 · 0e5efd4 · 0e5efd4
1 parent 677e418
commit 0e5efd4
Show file tree

Hide file tree

Showing 12 changed files with 418 additions and 156 deletions.
diff --git a/doc/user/layouts/partials/sql-grammar/grant-privilege.svg b/doc/user/layouts/partials/sql-grammar/grant-privilege.svg
diff --git a/doc/user/layouts/partials/sql-grammar/revoke-privilege.svg b/doc/user/layouts/partials/sql-grammar/revoke-privilege.svg
diff --git a/doc/user/sql-grammar/sql-grammar.bnf b/doc/user/sql-grammar/sql-grammar.bnf
@@ -214,7 +214,7 @@ format_spec ::=
   'TEXT' |
   'BYTES'
 grant_privilege ::=
-  'GRANT' privilege (',' privilege)* ON ('TABLE'? | 'TYPE' | 'SECRET' | 'CONNECTION' | 'DATABASE' | 'SCHEMA' | 'CLUSTER') object_name 'TO' 'GROUP'? role_name
+  'GRANT' privilege (',' privilege)* ON ('TABLE'? | 'TYPE' | 'SECRET' | 'CONNECTION' | 'DATABASE' | 'SCHEMA' | 'CLUSTER') object_name 'TO' 'GROUP'? role_name ( ',' role_name )*
 grant_role ::=
   'GRANT' role_name 'TO' 'GROUP'? member_name ( ',' member_name )*
 key_strat ::=
@@ -288,7 +288,7 @@ privilege ::=
 reset_session_variable ::=
   'RESET' variable_name
 revoke_privilege ::=
-  'REVOKE' privilege (',' privilege)* ON ('TABLE'? | 'TYPE' | 'SECRET' | 'CONNECTION' | 'DATABASE' | 'SCHEMA' | 'CLUSTER') object_name 'FROM' 'GROUP'? role_name
+  'REVOKE' privilege (',' privilege)* ON ('TABLE'? | 'TYPE' | 'SECRET' | 'CONNECTION' | 'DATABASE' | 'SCHEMA' | 'CLUSTER') object_name 'FROM' 'GROUP'? role_name ( ',' role_name )*
 revoke_role ::=
   'REVOKE' role_name 'FROM' 'GROUP'? member_name ( ',' member_name )*
 rollback ::=

diff --git a/src/adapter/src/catalog.rs b/src/adapter/src/catalog.rs
@@ -104,7 +104,7 @@ use crate::config::{SynchronizedParameters, SystemParameterFrontend};
 use crate::coord::{TargetCluster, DEFAULT_LOGICAL_COMPACTION_WINDOW};
 use crate::session::{PreparedStatement, Session, DEFAULT_DATABASE_NAME};
 use crate::util::{index_sql, ResultExt};
-use crate::{rbac, AdapterError, DUMMY_AVAILABILITY_ZONE};
+use crate::{rbac, AdapterError, ExecuteResponse, DUMMY_AVAILABILITY_ZONE};
 
 use self::builtin::{BuiltinCluster, BuiltinSource};
 
@@ -6862,6 +6862,15 @@ pub enum UpdatePrivilegeVariant {
     Revoke,
 }
 
+impl From<UpdatePrivilegeVariant> for ExecuteResponse {
+    fn from(variant: UpdatePrivilegeVariant) -> Self {
+        match variant {
+            UpdatePrivilegeVariant::Grant => ExecuteResponse::GrantedPrivilege,
+            UpdatePrivilegeVariant::Revoke => ExecuteResponse::RevokedPrivilege,
+        }
+    }
+}
+
 #[derive(Debug, Clone)]
 pub enum Op {
     AlterSink {