Access denied for updating a row with a TRIGGER attached
While fiddling with the user grants to make the permissions on my production server as narrow as possible, I found another inconsistency with MySQL: In MySQL, triggers execute with the permissions of the user who created the trigger (or if specified, a different DEFINER). In dolt, it seems to execute with the permissions of the one updating the table (or in other ways triggering the trigger):
$ mysql -u root -D dolt_testing
> CREATE TABLE queue (status TINYINT UNSIGNED);
> CREATE TABLE t (id BINARY(2), status TINYINT UNSIGNED);
> CREATE TRIGGER trig AFTER UPDATE ON t FOR EACH ROW INSERT INTO queue (status) SELECT NEW.status;
> CREATE USER testuser@localhost;
> GRANT SELECT,UPDATE ON dolt_testing.t TO testuser@localhost;
> INSERT INTO t (id, status) VALUES (0x0000, 0);
> UPDATE t SET status = 1 WHERE id = 0x0000;
> SELECT * FROM queue;
+--------+
| status |
+--------+
| 1 |
+--------+
>^Z
Bye
$ mysql -u testuser -D dolt_testing
> UPDATE t SET status = 2 WHERE id = 0x0000;
ERROR 1105 (HY000): Access denied for user 'testuser'@'localhost' to table 'queue'
Might be related to #10190 cause this is also a permission cascade problem.
I've been doing a bit more digging and this just applies to stored programs in general (procedures, functions, triggers, events etc.). I'm working on the plan rn, but this is technically related to #10190.