morningman commented on PR #70371: URL: https://github.com/apache/doris/pull/70371#issuecomment-6733684106
Added an end-to-end regression suite for the two rules this PR introduces. The current coverage is the `GrantRoleScopeTest` unit test plus the adjusted p0 suites; this adds a suite that drives both rules over real MySQL connections. `regression-test/suites/auth_call/test_grant_role_scope_auth.groovy`: - A `grant_priv`-only account cannot grant a role carrying `SELECT` to itself, to another account, or as a new account's `DEFAULT ROLE`, nor the built-in `admin` role; once it also holds the role's privilege the grant succeeds, and the target then gaining `USE` access to the database confirms the grant took effect end to end. - Changing another account's password or `REQUIRE` needs `admin_priv`; one's own credentials and locking another account stay under `grant_priv`; an `admin_priv` account may grant any role and change another account's credentials. Verified locally on a single-FE cluster built from this branch: the suite reports `succeed` (`failed 0 suites`), with each refusal carrying the expected message — `you need all [Grant_priv, Select_priv]` for the role grants, `[Admin_priv, Grant_priv]` for the built-in `admin` role, and `(ADMIN)` for the credential changes. One gap worth noting: this runs on a single FE, so it does not exercise the follower→master forwarding path for `SET PASSWORD` (`SetOptionsCommand.afterForwardToMaster` re-runs `validate` on the follower). Covering that would need a two-FE setup. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
