forked from pingcap/tidb
-
Notifications
You must be signed in to change notification settings - Fork 0
/
revoke_test.go
145 lines (123 loc) · 6.1 KB
/
revoke_test.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
// Copyright 2017 PingCAP, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// See the License for the specific language governing permissions and
// limitations under the License.
package executor_test
import (
"fmt"
"strings"
. "github.com/pingcap/check"
"github.com/pingcap/tidb/mysql"
"github.com/pingcap/tidb/util/testkit"
)
func (s *testSuite) TestRevokeGlobal(c *C) {
tk := testkit.NewTestKit(c, s.store)
_, err := tk.Exec(`REVOKE ALL PRIVILEGES ON *.* FROM 'nonexistuser'@'host'`)
c.Assert(err, NotNil)
// Create a new user.
createUserSQL := `CREATE USER 'testGlobalRevoke'@'localhost' IDENTIFIED BY '123';`
tk.MustExec(createUserSQL)
grantPrivSQL := `GRANT ALL PRIVILEGES ON *.* to 'testGlobalRevoke'@'localhost';`
tk.MustExec(grantPrivSQL)
// Make sure all the global privs for new user is "Y".
for _, v := range mysql.AllDBPrivs {
sql := fmt.Sprintf(`SELECT %s FROM mysql.User WHERE User="testGlobalRevoke" and host="localhost";`, mysql.Priv2UserCol[v])
r := tk.MustQuery(sql)
r.Check(testkit.Rows("Y"))
}
// Revoke each priv from the user.
for _, v := range mysql.AllGlobalPrivs {
sql := fmt.Sprintf("REVOKE %s ON *.* FROM 'testGlobalRevoke'@'localhost';", mysql.Priv2Str[v])
tk.MustExec(sql)
sql = fmt.Sprintf(`SELECT %s FROM mysql.User WHERE User="testGlobalRevoke" and host="localhost"`, mysql.Priv2UserCol[v])
tk.MustQuery(sql).Check(testkit.Rows("N"))
}
}
func (s *testSuite) TestRevokeDBScope(c *C) {
tk := testkit.NewTestKit(c, s.store)
// Create a new user.
tk.MustExec(`CREATE USER 'testDBRevoke'@'localhost' IDENTIFIED BY '123';`)
tk.MustExec(`GRANT ALL ON test.* TO 'testDBRevoke'@'localhost';`)
_, err := tk.Exec(`REVOKE ALL PRIVILEGES ON nonexistdb.* FROM 'testDBRevoke'@'localhost'`)
c.Assert(err, NotNil)
// Revoke each priv from the user.
for _, v := range mysql.AllDBPrivs {
check := fmt.Sprintf(`SELECT %s FROM mysql.DB WHERE User="testDBRevoke" and host="localhost" and db="test"`, mysql.Priv2UserCol[v])
sql := fmt.Sprintf("REVOKE %s ON test.* FROM 'testDBRevoke'@'localhost';", mysql.Priv2Str[v])
tk.MustQuery(check).Check(testkit.Rows("Y"))
tk.MustExec(sql)
tk.MustQuery(check).Check(testkit.Rows("N"))
}
}
func (s *testSuite) TestRevokeTableScope(c *C) {
tk := testkit.NewTestKit(c, s.store)
// Create a new user.
tk.MustExec(`CREATE USER 'testTblRevoke'@'localhost' IDENTIFIED BY '123';`)
tk.MustExec(`CREATE TABLE test.test1(c1 int);`)
tk.MustExec(`GRANT ALL PRIVILEGES ON test.test1 TO 'testTblRevoke'@'localhost';`)
_, err := tk.Exec(`REVOKE ALL PRIVILEGES ON test.nonexisttable FROM 'testTblRevoke'@'localhost'`)
c.Assert(err, NotNil)
// Make sure all the table privs for new user is Y.
res := tk.MustQuery(`SELECT Table_priv FROM mysql.tables_priv WHERE User="testTblRevoke" and host="localhost" and db="test" and Table_name="test1"`)
res.Check(testkit.Rows("Select,Insert,Update,Delete,Create,Drop,Grant,Index,Alter"))
// Revoke each priv from the user.
for _, v := range mysql.AllTablePrivs {
sql := fmt.Sprintf("REVOKE %s ON test.test1 FROM 'testTblRevoke'@'localhost';", mysql.Priv2Str[v])
tk.MustExec(sql)
rows := tk.MustQuery(`SELECT Table_priv FROM mysql.tables_priv WHERE User="testTblRevoke" and host="localhost" and db="test" and Table_name="test1";`).Rows()
c.Assert(rows, HasLen, 1)
row := rows[0]
c.Assert(row, HasLen, 1)
p := fmt.Sprintf("%v", row[0])
c.Assert(strings.Index(p, mysql.Priv2SetStr[v]), Equals, -1)
}
// Revoke all table scope privs.
tk.MustExec("REVOKE ALL ON test.test1 FROM 'testTblRevoke'@'localhost';")
tk.MustQuery(`SELECT Table_priv FROM mysql.Tables_priv WHERE User="testTblRevoke" and host="localhost" and db="test" and Table_name="test1"`).Check(testkit.Rows(""))
}
func (s *testSuite) TestRevokeColumnScope(c *C) {
tk := testkit.NewTestKit(c, s.store)
// Create a new user.
tk.MustExec(`CREATE USER 'testColRevoke'@'localhost' IDENTIFIED BY '123';`)
tk.MustExec(`CREATE TABLE test.test3(c1 int, c2 int);`)
tk.MustQuery(`SELECT * FROM mysql.Columns_priv WHERE User="testColRevoke" and host="localhost" and db="test" and Table_name="test3" and Column_name="c2"`).Check(testkit.Rows())
// Grant and Revoke each priv on the user.
for _, v := range mysql.AllColumnPrivs {
grantSQL := fmt.Sprintf("GRANT %s(c1) ON test.test3 TO 'testColRevoke'@'localhost';", mysql.Priv2Str[v])
revokeSQL := fmt.Sprintf("REVOKE %s(c1) ON test.test3 FROM 'testColRevoke'@'localhost';", mysql.Priv2Str[v])
checkSQL := `SELECT Column_priv FROM mysql.Columns_priv WHERE User="testColRevoke" and host="localhost" and db="test" and Table_name="test3" and Column_name="c1"`
tk.MustExec(grantSQL)
rows := tk.MustQuery(checkSQL).Rows()
c.Assert(rows, HasLen, 1)
row := rows[0]
c.Assert(row, HasLen, 1)
p := fmt.Sprintf("%v", row[0])
c.Assert(strings.Index(p, mysql.Priv2SetStr[v]), Greater, -1)
tk.MustExec(revokeSQL)
tk.MustQuery(checkSQL).Check(testkit.Rows(""))
}
// Create a new user.
tk.MustExec("CREATE USER 'testCol1Revoke'@'localhost' IDENTIFIED BY '123';")
tk.MustExec("USE test;")
// Grant all column scope privs.
tk.MustExec("GRANT ALL(c2) ON test3 TO 'testCol1Revoke'@'localhost';")
// Make sure all the column privs for granted user are in the Column_priv set.
for _, v := range mysql.AllColumnPrivs {
rows := tk.MustQuery(`SELECT Column_priv FROM mysql.Columns_priv WHERE User="testCol1Revoke" and host="localhost" and db="test" and Table_name="test3" and Column_name="c2";`).Rows()
c.Assert(rows, HasLen, 1)
row := rows[0]
c.Assert(row, HasLen, 1)
p := fmt.Sprintf("%v", row[0])
c.Assert(strings.Index(p, mysql.Priv2SetStr[v]), Greater, -1)
}
tk.MustExec("REVOKE ALL(c2) ON test3 FROM 'testCol1Revoke'@'localhost'")
tk.MustQuery(`SELECT Column_priv FROM mysql.Columns_priv WHERE User="testCol1Revoke" and host="localhost" and db="test" and Table_name="test3"`).Check(testkit.Rows(""))
}