From c23b9bbdb555e7b881871e0c02c425a97ac72376 Mon Sep 17 00:00:00 2001 From: LucaCappelletti94 Date: Wed, 28 Oct 2026 12:55:44 +0100 Subject: [PATCH] Drop GRANT role TO role with the access-control warning --- src/impls/translator_impls/statement.rs | 4 +++- tests/test_no_statement_is_silently_dropped.rs | 5 +++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/impls/translator_impls/statement.rs b/src/impls/translator_impls/statement.rs index daceab884..b93c77734 100644 --- a/src/impls/translator_impls/statement.rs +++ b/src/impls/translator_impls/statement.rs @@ -1949,7 +1949,9 @@ impl crate::traits::translator::TranslatorWithContext for Statement { Self::CreateUser(_) => drop_with_warning("CREATE USER", REASON_ACCESS_CONTROL, emit), Self::AlterRole { .. } => drop_with_warning("ALTER ROLE", REASON_ACCESS_CONTROL, emit), Self::AlterUser(_) => drop_with_warning("ALTER USER", REASON_ACCESS_CONTROL, emit), - Self::Grant(_) => drop_with_warning("GRANT", REASON_ACCESS_CONTROL, emit), + Self::Grant(_) | Self::GrantRole(_) => { + drop_with_warning("GRANT", REASON_ACCESS_CONTROL, emit) + } Self::Revoke(_) => drop_with_warning("REVOKE", REASON_ACCESS_CONTROL, emit), Self::Deny { .. } => drop_with_warning("DENY", REASON_ACCESS_CONTROL, emit), Self::CreateType { .. } => { diff --git a/tests/test_no_statement_is_silently_dropped.rs b/tests/test_no_statement_is_silently_dropped.rs index 0753400a9..c4b95ceaf 100644 --- a/tests/test_no_statement_is_silently_dropped.rs +++ b/tests/test_no_statement_is_silently_dropped.rs @@ -76,6 +76,10 @@ const TABLE_AND_ROLE: &str = "CREATE TABLE t (id INTEGER PRIMARY KEY, a TEXT); C const TABLE_ROLE_AND_GRANT: &str = "CREATE TABLE t (id INTEGER PRIMARY KEY, a TEXT); CREATE ROLE r; GRANT SELECT ON t TO r;"; +/// A membership `GRANT` names a role on each side, so both have to exist. +const TWO_ROLES: &str = + "CREATE TABLE t (id INTEGER PRIMARY KEY, a TEXT); CREATE ROLE r; CREATE ROLE u;"; + const fn emitted(sql: &'static str) -> Case { Case { setup: TABLE, sql, outcome: Outcome::Emitted } } @@ -167,6 +171,7 @@ const CASES: &[Case] = &[ sql: "REVOKE SELECT ON t FROM r", outcome: Outcome::Warned, }, + Case { setup: TWO_ROLES, sql: "GRANT r TO u", outcome: Outcome::Warned }, warned("DENY SELECT ON t TO r"), warned("DROP ROLE r"), warned("DROP USER r"),