add test for revoke interpreter
use common_base::tokio;
use common_exception::Result;
use common_meta_types::AuthInfo;
+use common_meta_types::GrantObject;
use common_meta_types::PasswordHashMethod;
+use common_meta_types::RoleIdentity;
+use common_meta_types::RoleInfo;
use common_meta_types::UserGrantSet;
use common_meta_types::UserInfo;
+use common_meta_types::UserPrivilegeSet;
+use common_meta_types::UserPrivilegeType;
use databend_query::interpreters::*;
use databend_query::sql::PlanParser;
use futures::stream::StreamExt;
@@ -41,7 +46,6 @@ async fn test_revoke_privilege_interpreter() -> Result<()> {
assert_eq!(user_info.grants, UserGrantSet::empty());
let user_mgr = ctx.get_user_manager();
user_mgr.add_user(&tenant, user_info).await?;
-
let query = format!("REVOKE ALL ON *.* FROM '{}'@'{}'", name, hostname);
let plan = PlanParser::parse(ctx.clone(), &query).await?;
let executor = InterpreterFactory::get(ctx, plan.clone())?;
@@ -53,3 +57,40 @@ async fn test_revoke_privilege_interpreter() -> Result<()> {
Ok(())
}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+async fn test_revoke_privilege_interpreter_on_role() -> Result<()> {
+ common_tracing::init_default_ut_tracing();
+
+ let ctx = crate::tests::create_query_context()?;
+ let tenant = ctx.get_tenant().to_string();
+
+ let mut role_info = RoleInfo::new("role1".to_string(), "%".to_string());
+ role_info.grants.grant_privileges(
+ "role1",
+ "%",
+ &GrantObject::Global,
+ UserPrivilegeSet::all_privileges(),
+ );
+ let user_mgr = ctx.get_user_manager();
+ assert!(role_info
+ .grants
+ .verify_privilege(&GrantObject::Global, UserPrivilegeType::Create));
+ user_mgr.add_role(&tenant, role_info).await?;
+
+ let query = format!("REVOKE ALL ON *.* FROM ROLE 'role1'");
+ let plan = PlanParser::parse(ctx.clone(), &query).await?;
+ let executor = InterpreterFactory::get(ctx, plan.clone())?;
+ assert_eq!(executor.name(), "RevokePrivilegeInterpreter");
+ let mut stream = executor.execute(None).await?;
+ while let Some(_block) = stream.next().await {}
+
+ let role = user_mgr
+ .get_role(&tenant, &RoleIdentity::parse("role1"))
+ .await?;
+ assert!(!role
+ .grants
+ .verify_privilege(&GrantObject::Global, UserPrivilegeType::Create));
+
+ Ok(())
+}
