Commit a09483d
LAV-3061: Cover GRANT account CREATE and APPLY privileges (#3417)
* LAV-3061: cover account CREATE and APPLY grant vocabulary
Capture every indexed account CREATE/APPLY privilege on Enterprise and the edition-specific rejections on Standard. Extend the parser and account grant error handling; record Cloud grantor attribution for delegated system roles.
Co-authored-by: Sabir Akhadov <sabir.akhadov@localstack.cloud>
## Test matrix
APPLY AGGREGATION POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_aggregation_policy]
APPLY AUTHENTICATION POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_authentication_policy]
APPLY CONTACT / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_contact]
APPLY JOIN POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_join_policy]
APPLY MASKING POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_masking_policy]
APPLY PACKAGES POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_packages_policy]
APPLY PASSWORD POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_password_policy]
APPLY PROJECTION POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_projection_policy]
APPLY ROW ACCESS POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_row_access_policy]
APPLY SESSION POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_session_policy]
APPLY STORAGE LIFECYCLE POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_storage_lifecycle_policy]
APPLY TAG / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_tag]
CREATE ACCOUNT / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_account]
CREATE APPLICATION / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_application]
CREATE APPLICATION PACKAGE / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_application_package]
CREATE COMPUTE POOL / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_compute_pool]
CREATE DATABASE / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_database]
CREATE EXTERNAL VOLUME / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_external_volume]
CREATE FAILOVER GROUP / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_failover_group]
CREATE INTEGRATION / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_integration]
CREATE LISTING / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_listing]
CREATE NETWORK POLICY / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_network_policy]
CREATE ORGANIZATION LISTING / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_organization_listing]
CREATE ORGANIZATION PROFILE / Enterprise rejected grant, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_organization_profile]
CREATE PREVIEW APPLICATION / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_preview_application]
CREATE REPLICATION GROUP / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_replication_group]
CREATE ROLE / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_role]
CREATE SHARE / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_share]
CREATE USER / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_user]
CREATE WAREHOUSE / Enterprise grant, SHOW, revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[create_warehouse]
APPLY AGGREGATION POLICY / Standard rejected grant and revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_standard_account_create_apply_rejected[apply_aggregation_policy]
APPLY JOIN POLICY / Standard rejected grant and revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_standard_account_create_apply_rejected[apply_join_policy]
APPLY PROJECTION POLICY / Standard rejected grant and revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_standard_account_create_apply_rejected[apply_projection_policy]
APPLY ROW ACCESS POLICY / Standard rejected grant and revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_standard_account_create_apply_rejected[apply_row_access_policy]
CREATE ORGANIZATION PROFILE / Standard rejected grant and revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_standard_account_create_apply_rejected[create_organization_profile]
APPLY CONTACT / WITH GRANT OPTION, SHOW, revoke -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_with_grant_option[apply_contact]
CREATE PREVIEW APPLICATION / WITH GRANT OPTION, SHOW, revoke -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_with_grant_option[create_preview_application]
CREATE ORGANIZATION PROFILE / Enterprise rejected revoke, empty SHOW -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_organization_profile_revoke_rejected
## Deviations
The hint names the GRANT rewrite and reader as starting points. Missing index spellings also required the vendored parser, and Cloud grantor rows required the store writer.
* LAV-3061: report source position for account APPLY JOIN POLICY errors
Locate JOIN from the tokenized account privilege clause and report its Cloud-recorded line and UTF-16 position. Capture extra spacing, a multiline revoke, a privilege list, and a comment; each rejection leaves SHOW GRANTS empty.
Swept both account grant and revoke call sites for fixed-position errors; both use the same locator. Token scanning excludes comments, literals, and quoted identifiers; no sibling fixed-position account CREATE/APPLY errors remain.
Co-authored-by: Sabir Akhadov <sabir.akhadov@localstack.cloud>
## Test matrix
Standard APPLY JOIN POLICY / bare GRANT and REVOKE rejection -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_standard_account_create_apply_rejected[apply_join_policy]
Standard APPLY JOIN POLICY / GRANT extra space, no grant -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_standard_apply_join_policy_position[grant_extra_space]
Standard APPLY JOIN POLICY / multiline REVOKE, no grant -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_standard_apply_join_policy_position[revoke_multiline]
Standard APPLY JOIN POLICY / GRANT after CREATE SHARE, no grant -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_standard_apply_join_policy_position[grant_privilege_list]
Standard APPLY JOIN POLICY / comment containing ON, no grant -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_standard_apply_join_policy_position[grant_comment]
Enterprise APPLY JOIN POLICY / GRANT, SHOW, REVOKE -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege[apply_join_policy]
Other indexed CREATE/APPLY / GRANT, SHOW, REVOKE or edition rejection -> tests/queries/access_control/test_grant_privilege_vocabulary.py::test_account_create_apply_privilege and test_standard_account_create_apply_rejected
Verified: make check; make test-compat for the privilege vocabulary file (58 passed before the comment case, 4 targeted cases after); .spiral/check.sh (59 compat cases passed). Cloud snapshots captured serially on Standard.
---------
Co-authored-by: spiral <spiral@localhost>
Co-authored-by: Sabir Akhadov <sabir.akhadov@localstack.cloud>1 parent fa4f6e6 commit a09483d
3 files changed
Lines changed: 26 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
11249 | 11249 | | |
11250 | 11250 | | |
11251 | 11251 | | |
| 11252 | + | |
| 11253 | + | |
| 11254 | + | |
| 11255 | + | |
| 11256 | + | |
| 11257 | + | |
11252 | 11258 | | |
11253 | 11259 | | |
11254 | 11260 | | |
| |||
11303 | 11309 | | |
11304 | 11310 | | |
11305 | 11311 | | |
| 11312 | + | |
| 11313 | + | |
| 11314 | + | |
11306 | 11315 | | |
11307 | 11316 | | |
11308 | 11317 | | |
| |||
11339 | 11348 | | |
11340 | 11349 | | |
11341 | 11350 | | |
| 11351 | + | |
| 11352 | + | |
11342 | 11353 | | |
11343 | 11354 | | |
11344 | 11355 | | |
| |||
11351 | 11362 | | |
11352 | 11363 | | |
11353 | 11364 | | |
| 11365 | + | |
| 11366 | + | |
11354 | 11367 | | |
11355 | 11368 | | |
11356 | 11369 | | |
| |||
11361 | 11374 | | |
11362 | 11375 | | |
11363 | 11376 | | |
| 11377 | + | |
11364 | 11378 | | |
11365 | 11379 | | |
11366 | 11380 | | |
11367 | 11381 | | |
11368 | 11382 | | |
11369 | 11383 | | |
| 11384 | + | |
11370 | 11385 | | |
11371 | 11386 | | |
11372 | 11387 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
886 | 886 | | |
887 | 887 | | |
888 | 888 | | |
| 889 | + | |
889 | 890 | | |
890 | 891 | | |
891 | 892 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
20812 | 20812 | | |
20813 | 20813 | | |
20814 | 20814 | | |
| 20815 | + | |
| 20816 | + | |
20815 | 20817 | | |
20816 | 20818 | | |
| 20819 | + | |
| 20820 | + | |
20817 | 20821 | | |
20818 | 20822 | | |
20819 | 20823 | | |
| |||
20836 | 20840 | | |
20837 | 20841 | | |
20838 | 20842 | | |
| 20843 | + | |
| 20844 | + | |
20839 | 20845 | | |
20840 | 20846 | | |
20841 | 20847 | | |
| |||
20884 | 20890 | | |
20885 | 20891 | | |
20886 | 20892 | | |
| 20893 | + | |
| 20894 | + | |
| 20895 | + | |
| 20896 | + | |
20887 | 20897 | | |
20888 | 20898 | | |
20889 | 20899 | | |
| |||
0 commit comments