privileges and views

Author: jeeminso

tests/bwc/test_rolling_upgrade.py

@@ -1,5 +1,7 @@
 import unittest
 from crate.client import connect
+from crate.client.exceptions import ProgrammingError
+
 from crate.qa.tests import NodeProvider, insert_data, wait_for_active_shards, UpgradePath
 
 ROLLING_UPGRADES_V4 = (
@@ -103,6 +105,7 @@ def _test_rolling_upgrade(self, path, nodes):
                 ) CLUSTERED INTO {shards} SHARDS
                 WITH (number_of_replicas={replicas})
             ''')
+            c.execute("deny dql on table doc.t1 to arthur")
             c.execute("CREATE VIEW doc.v1 AS SELECT type, title, value FROM doc.t1")
             insert_data(conn, 'doc', 't1', 1000)
 
@@ -150,6 +153,11 @@ def _test_rolling_upgrade(self, path, nodes):
                 c = custom_user_conn.cursor()
                 wait_for_active_shards(c, expected_active_shards)
                 c.execute("SELECT 1")
+                # has no privilege
+                with self.assertRaisesRegex(ProgrammingError, "RelationUnknown.*"):
+                    c.execute("EXPLAIN SELECT * FROM doc.t1")
+                # has privilege
+                c.execute("EXPLAIN SELECT * FROM doc.v1")
 
             cluster[idx] = new_node
             with connect(new_node.http_url, error_trace=True) as conn:
@@ -160,7 +168,10 @@ def _test_rolling_upgrade(self, path, nodes):
                 self.assertEqual(c.fetchall(), [["arthur"], ["crate"]])
 
                 c.execute("select * from sys.privileges")
-                self.assertEqual(c.fetchall(), [["CLUSTER", "arthur", "crate", None, "GRANT", "DQL"]])
+                self.assertEqual(
+                    c.fetchall(),
+                    [['TABLE', 'arthur', 'crate', 'doc.t1', 'DENY', 'DQL'],
+                     ['CLUSTER', 'arthur', 'crate', None, 'GRANT', 'DQL']])
 
                 c.execute('''
                     SELECT type, AVG(value)
@@ -239,3 +250,14 @@ def _test_rolling_upgrade(self, path, nodes):
             ''')
             res = c.fetchone()
             self.assertEqual(res[0], nodes + 1)
+
+        # Ensure Arthur can be dropped and re-added
+        c.execute("drop user arthur")
+        c.execute("select * from sys.privileges")
+        self.assertEqual(c.fetchall(), [])
+
+        # Ensure view 'v' can be dropped and re-added
+        c.execute("DROP VIEW doc.v1")
+        c.execute("CREATE VIEW doc.v1 AS SELECT 11")
+        c.execute("SELECT * FROM doc.v1")
+        self.assertEqual(c.fetchall(), [[11]])