dolt icon indicating copy to clipboard operation
dolt copied to clipboard

GRANT/REVOKE operation doesn't check for existence of table

Open macneale4 opened this issue 1 year ago • 1 comments

Granting access to a table in MySQL will fail if you attempt grant the permission to a non-existent table:

mysql> GRANT UPDATE ON mysql.tbl to testuser@localhost;
ERROR 1146 (42S02): Table 'mysql.tbl' doesn't exist

In dolt, we will complete this command successfully. There are reasons for this, the first being that different branches may have different tables in them. Permissions are already global to the server, so it's not clear which branch we would look at to determine the valid set of tables.

Similarly, REVOKE is noisy when used against resources which don't exist. For example, in MySQL:

mysql> revoke UPDATE ON foooobar.asdfasdf FROM testuser@localhost;
ERROR 1147 (42000): There is no such grant defined for user 'testuser' on host 'localhost' on table 'asdfasdf'

In dolt, that command will complete successfully.

Arguments for changing dolts behavior:

  • Guiding principle of least surprise - Behave like MySQL when in doubt
  • Preventing users from making typo mistakes and not realizing that there operation had not effect.

Arguments to keep this difference in behavior:

  • More flexible permissions policy, esp if you want to encode all permissions before the creation of the entity.
  • It's how it works now, and no one has complained about it.

macneale4 avatar Oct 10 '23 23:10 macneale4

We are going to follow this pattern with Routine grants as well. MySQL checks for their existence before creating the GRANTs, and Dolt will not check for them.

macneale4 avatar Oct 10 '23 23:10 macneale4