Fix dropping role with table privileges granted by non-neon_superuser #10964
+86
−9
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tristan957
commented
Feb 24, 2025
Comment on lines
21
to
28
| SET LOCAL ROLE neon_superuser; | ||
|
|
||
| revoke_query := format( | ||
| 'REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM {role_name} GRANTED BY neon_superuser;', | ||
| 'REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM {role_name} GRANTED BY neon_superuser', | ||
| schema | ||
| ); | ||
|
|
||
| EXECUTE revoke_query; |
There was a problem hiding this comment.
It is not at all clear to me why I need to keep this statement around, but if I don't, test_compute_drop_role will fail. Help in diagnosing this is appreciated.
There was a problem hiding this comment.
Keeping this statement around tells me there is probably something more to look at than just information_schema.role_table_grants.
There was a problem hiding this comment.
I tried:
FOR grantor IN
SELECT DISTINCT t.grantor
FROM (
SELECT DISTINCT rtg.grantor
FROM information_schema.role_table_grants AS rtg
WHERE grantee = '{role_name}'
UNION
SELECT DISTINCT tp.grantor
FROM information_schema.table_privileges AS tp
WHERE grantee = '{role_name}') AS t
LOOP
But that doesn't work for test_compute_drop_role.
7755 tests run: 7377 passed, 0 failed, 378 skipped (full report)Flaky tests (3)Postgres 17
Code coverage* (full report)
* collected from Rust tests only The comment gets automatically updated with the latest test results
fff6e6e at 2025-02-27T05:12:05.225Z :recycle: |
We were previously only revoking privileges granted by neon_superuser. However, we need to do it for all grantors. Signed-off-by: Tristan Partin <tristan@neon.tech>
tristan957
force-pushed
the
tristan957/ci-fixes
branch
from
2017f90 to
fff6e6e
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We were previously only revoking privileges granted by neon_superuser. However, we need to do it for all grantors.