release-25.4.10-rc: server: resolve role membership for CONNECT privilege checks in DB Console APIs#168493
Merged
angles-n-daemons merged 3 commits intocockroachdb:release-25.4.10-rcfrom Apr 20, 2026
Conversation
pull the left join condition on role_members out into the where clause Epic: None Release: None
the admin user currently has no view into all the database/tables due to its non-existence in the role_members table, this change adds a third condition to the where clause to allow the view Epic: None Release: None
…nsole APIs The API endpoints backing the DB Console Databases page (/api/v2/database_metadata/, /api/v2/table_metadata/, and /api/v2/table_metadata/updatejob/) only checked direct username and 'public' as grantees when verifying CONNECT privileges. This meant users who inherited CONNECT through a role hierarchy (e.g., user -> role_a -> role_b where role_b has CONNECT) saw an empty Databases page and got 404s, even though SQL correctly resolves inherited grants. This is most visible in environments that have revoked CONNECT from 'public' as a security hardening measure. Fix all three query functions to use a recursive CTE that traverses system.role_members to resolve the full role membership chain. Resolves: cockroachdb#165991 Release note (bug fix): Fixed a bug where DB Console Databases page privilege checks did not resolve role membership chains for CONNECT grants. Users who inherited CONNECT through role hierarchies now correctly see their authorized databases and tables. Epic: none Co-Authored-By: roachdev-claude <roachdev-claude-bot@cockroachlabs.com>
angles-n-daemons
requested review from
dhartunian
and removed request for
a team
|
Thanks for opening a backport. Before merging, please confirm that it falls into one of the following categories (select one):
Add a brief release justification to the PR description explaining your selection. Also, confirm that the change does not break backward compatibility and complies with all aspects of the backport policy. All backports must be reviewed by the TL and EM for the owning area. |
blathers-crl
Bot
added
backport
Member
|
This change is |
dhartunian
approved these changes
Apr 16, 2026
angles-n-daemons
merged commit 387ffa9
into
cockroachdb:release-25.4.10-rc
18 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport 3/3 commits from #156854 and #167430 on behalf of @kyle-a-wong.
Fixes ENGREQ-409
Summary
/api/v2/database_metadata/,/api/v2/table_metadata/,/api/v2/table_metadata/updatejob/) only checkeddirect username and
publicas grantees when verifying CONNECT privileges.Users who inherited CONNECT through a role hierarchy (e.g.,
user -> role_a -> role_bwhererole_bhas CONNECT) saw an empty Databasespage and got 404s, even though
SHOW DATABASESin SQL correctly resolvesinherited grants.
getDatabaseMetadataBaseQuery,getTableMetadataBaseQuery,updateTableMetadataJobAuthorized) to use arecursive CTE that traverses
system.role_membersto resolve the full rolemembership chain.
are properly resolved and that breaking the role chain revokes access.
Resolves: #165991
Epic: none
Release note (bug fix): Fixed a bug where DB Console Databases page
privilege checks did not resolve role membership chains for CONNECT
grants. Users who inherited CONNECT through role hierarchies now
correctly see their authorized databases and tables.
Release justification: bug fix for customer-impacting issue (ENGREQ-409). Active production incident affecting operator visibility into cluster databases when CONNECT is inherited through role chains.