fix: sequence table next value acl permission to writer role (#16509)

Signed-off-by: Harshit Gangal <[email protected]>
vitessio · Aug 1, 2024 · 33030b7 · 33030b7
1 parent d122ac6
commit 33030b7
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 5 deletions.
diff --git a/go/vt/vttablet/tabletserver/planbuilder/permission.go b/go/vt/vttablet/tabletserver/planbuilder/permission.go
@@ -36,7 +36,13 @@ func BuildPermissions(stmt sqlparser.Statement) []Permission {
 	var permissions []Permission
 	// All Statement types myst be covered here.
 	switch node := stmt.(type) {
-	case *sqlparser.Union, *sqlparser.Select:
+	case *sqlparser.Select:
+		role := tableacl.READER
+		if _, ok := node.SelectExprs[0].(*sqlparser.Nextval); ok {
+			role = tableacl.WRITER
+		}
+		permissions = buildSubqueryPermissions(node, role, permissions)
+	case *sqlparser.Union:
 		permissions = buildSubqueryPermissions(node, tableacl.READER, permissions)
 	case *sqlparser.Insert:
 		permissions = buildTableExprPermissions(node.Table, tableacl.WRITER, permissions)

diff --git a/go/vt/vttablet/tabletserver/planbuilder/permission_test.go b/go/vt/vttablet/tabletserver/planbuilder/permission_test.go
@@ -174,6 +174,12 @@ func TestBuildPermissions(t *testing.T) {
 		}, {
 			TableName: "t1", // derived table in update or delete needs reader permission as they cannot be modified.
 		}},
+	}, {
+		input: "select next 10 values from seq",
+		output: []Permission{{
+			TableName: "seq",
+			Role:      tableacl.WRITER,
+		}},
 	}}
 
 	for _, tcase := range tcases {

diff --git a/go/vt/vttablet/tabletserver/planbuilder/testdata/exec_cases.txt b/go/vt/vttablet/tabletserver/planbuilder/testdata/exec_cases.txt
@@ -140,7 +140,7 @@
   "Permissions": [
     {
       "TableName": "seq",
-      "Role": 0
+      "Role": 1
     }
   ],
   "NextCount": "1"
@@ -154,7 +154,7 @@
   "Permissions": [
     {
       "TableName": "seq",
-      "Role": 0
+      "Role": 1
     }
   ],
   "NextCount": "10"
@@ -169,7 +169,7 @@
   "Permissions": [
     {
       "TableName": "seq",
-      "Role": 0
+      "Role": 1
     }
   ],
   "NextCount": ":a"
@@ -183,7 +183,7 @@
   "Permissions": [
     {
       "TableName": "seq",
-      "Role": 0
+      "Role": 1
     }
   ],
   "NextCount": "12345667852342342342323423423"