Grant to spaces for user don't cause error

[laines-it]

Bug description

After this commit, granting access to space is not denied for user (see below).

• OS: Linux
• OS Version: Archlinux
• Architecture: amd64

$ tarantool --version
Tarantool 3.6.0-entrypoint-126-g1fd4404bf6
Target: Linux-x86_64-RelWithDebInfo
Build options: cmake . -DCMAKE_INSTALL_PREFIX=/usr/local -DENABLE_BACKTRACE=TRUE
Compiler: GNU-15.2.1
C_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/victo/sidedisk/vk/tarantool/tarantool=. -std=c11 -Wall -Wextra -Wno-gnu-alignof-expression -fno-gnu89-inline -Wno-cast-function-type -O2 -g -DNDEBUG -ggdb -O2 
CXX_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/victo/sidedisk/vk/tarantool/tarantool=. -std=c++17 -Wall -Wextra -Wno-invalid-offsetof -Wno-gnu-alignof-expression -Wno-cast-function-type -O2 -g -DNDEBUG -ggdb -O2

Steps to reproduce

The reproducer script (test.lua):

box.cfg{}

box.schema.space.create('space1')

box.schema.user.create('test1', {password = 'test1'})
box.schema.user.grant('test1', 'super', nil, nil, { if_not_exists = true })

box.schema.user.create('test2', {password = 'test1'})

box.session.su('test1')

local status, err = pcall(function() 
    box.schema.user.grant('test2', 'read', 'space', 'space1', {if_not_exists = false})
end)
print('Granted:', status)
if not status then
    print('Error:', err)
    print('Error code:', err.code)
end

Run (on the previous commit):

$ tarantool test.lua 
Granted:  false
Error:  Grant access to space 'space1' is denied for user 'test'
Error code:  42

Run (on the issue commit):

$ tarantool test.lua 
Granted:  true

[mkostoevr]

Hi! Let me explain the reasoning behind the new behaviour and let me know if it's not expected and if there are unwanted consequences of this.

The referenced comit introduced the new "grant" privilege, allowing to grant accesses on available objects and entities to available users. Since the "super" role has all privileges set, it also includes the new "grant" privilege and thus, the user is able to grant accesses on the space to the user with no errors.

The error occured previously cause "test1" is not an owner of the granted space, but now, when he has the "grant" privilege, he can grant it without being its owner.

And, since "super" has "read" access to "universe", both the space and the user are available to him for granting (visisble via _vspace and _vuser sysview spaces).