Function ValidateAndGrantInheritedRoles

pg_documentdb/src/commands/roles.c:1716–1778

* ValidateAndGrantInheritedRoles validates all parent roles and grants them. * Enforces that readWriteAnyDatabase and clusterAdmin must be specified together. */

 * Enforces that readWriteAnyDatabase and clusterAdmin must be specified together.
 */
static void
ValidateAndGrantInheritedRoles(const CreateRoleSpec *createRoleSpec)
{
	HASH_SEQ_STATUS status;
	char *entry;
	bool hasReadWrite = false;
	bool hasClusterAdmin = false;

	hash_seq_init(&status, createRoleSpec->parentRoles);
	while ((entry = hash_seq_search(&status)) != NULL)
	{
		const char *roleName = entry;

		if (strcmp(roleName, "readWriteAnyDatabase") == 0)
		{
			hasReadWrite = true;
		}
		else if (strcmp(roleName, "clusterAdmin") == 0)
		{
			hasClusterAdmin = true;
		}
	}

	if (hasReadWrite != hasClusterAdmin)
	{
		ereport(ERROR, (errcode(ERRCODE_DOCUMENTDB_BADVALUE),
						errmsg(
							"Roles specified are invalid. 'readWriteAnyDatabase' and 'clusterAdmin' must be specified together."),
						errdetail_log(
							"Roles specified are invalid. 'readWriteAnyDatabase' and 'clusterAdmin' must be specified together.")));
	}

	/*
	 * If both readWriteAnyDatabase and clusterAdmin are specified, grant
	 * ApiAdminRoleV2 once (which provides both capabilities).
	 */
	bool grantedApiAdminRole = false;
	if (hasReadWrite && hasClusterAdmin)
	{
		grantedApiAdminRole = true;
		GrantRoleInheritance(ApiAdminRoleV2, createRoleSpec->roleName);
	}

	hash_seq_init(&status, createRoleSpec->parentRoles);
	while ((entry = hash_seq_search(&status)) != NULL)
	{
		const char *nativeRoleName = entry;
		const char *internalRoleName = GetInternalRoleName(nativeRoleName);

		/*
		 * Skip readWriteAnyDatabase and clusterAdmin if we already granted
		 * ApiAdminRoleV2, which provides both capabilities.
		 */
		if (grantedApiAdminRole &&
			(strcmp(internalRoleName, ApiReadWriteRole) == 0 ||
			 strcmp(internalRoleName, ApiClusterAdminRole) == 0))
		{
			continue;