TestAuthDoltProcedures tests that Dolt procedure functions apply permission checks for SUPERUSERs and basic users in SELECT statements. We test both CALL and SELECT to avoid regressions in [node.Call], where previous Doltgres' versions fell back to the node runner (on CALL an error is returned to us
(t *testing.T)
| 1153 | // Each time a new Dolt procedure is introduced in a ScriptTest, it's grouped into a set of related procedures. Each set |
| 1154 | // is separated by a new line. |
| 1155 | func TestAuthDoltProcedures(t *testing.T) { |
| 1156 | tempDir, err := os.MkdirTemp("", t.Name()) |
| 1157 | if err != nil { |
| 1158 | t.Fatal(err) |
| 1159 | } |
| 1160 | t.Cleanup(func() { _ = os.RemoveAll(tempDir) }) |
| 1161 | authTestFireUrl := func(path string) string { |
| 1162 | return "file://" + filepath.ToSlash(filepath.Join(tempDir, path)) |
| 1163 | } |
| 1164 | RunScripts(t, []ScriptTest{ |
| 1165 | { |
| 1166 | UseLocalFileSystem: true, |
| 1167 | Name: "SUPERUSER authorization for CALL executing Dolt stored procedures", |
| 1168 | SetUpScript: []string{ |
| 1169 | authTestCreateSuperUser, |
| 1170 | "create table test_table (v int);", |
| 1171 | "insert into test_table values (1);", |
| 1172 | "select dolt_add('test_table');", |
| 1173 | "select dolt_commit('-m', 'add test table');", |
| 1174 | }, |
| 1175 | Assertions: []ScriptTestAssertion{ |
| 1176 | authTestAssertAsSuper(fmt.Sprintf("call dolt_backup('sync-url', '%s');", authTestFireUrl("bak1")), nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1177 | authTestAssertAsSuper(fmt.Sprintf("call dolt_backup('add', 'bak1', '%s');", authTestFireUrl("bak1")), nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1178 | |
| 1179 | authTestAssertAsSuper("call dolt_checkout('-b', 'test');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1180 | |
| 1181 | authTestAssertAsSuper("call dolt_branch('new_branch');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1182 | |
| 1183 | authTestAssertAsSuper("insert into test_table values (2);", []sql.Row{}, ""), |
| 1184 | authTestAssertAsSuper("call dolt_add('.');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1185 | authTestAssertAsSuper("call dolt_commit('-m', 'amend test table');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1186 | |
| 1187 | authTestAssertAsSuper("call dolt_checkout('main');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1188 | authTestAssertAsSuper("call dolt_cherry_pick('test');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1189 | |
| 1190 | authTestAssertAsSuper("call dolt_clean('--dry-run');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1191 | |
| 1192 | authTestAssertAsSuper(fmt.Sprintf("call dolt_clone('%s', 'cloned_bak1');", authTestFireUrl("bak1")), nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1193 | |
| 1194 | authTestAssertAsSuper("set authtest.hash = ''", []sql.Row{}, ""), |
| 1195 | authTestAssertAsSuper("call dolt_commit_hash_out('authtest.hash', '-am', 'add val 3 to test table')", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1196 | |
| 1197 | authTestAssertAsSuper("call dolt_checkout('-b', 'conflict');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1198 | authTestAssertAsSuper("update test_table set v = -1 where v = 1;", []sql.Row{}, ""), |
| 1199 | authTestAssertAsSuper("call dolt_commit('-am', 'amend 1 to -1');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1200 | authTestAssertAsSuper("call dolt_checkout('main');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1201 | authTestAssertAsSuper("update test_table set v = -2 where v = 1;", []sql.Row{}, ""), |
| 1202 | authTestAssertAsSuper("call dolt_commit('-am', 'amend 2 to -2');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1203 | authTestAssertAsSuper("set dolt_allow_commit_conflicts to 1;", []sql.Row{}, ""), |
| 1204 | authTestAssertAsSuper("call dolt_merge('conflict');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1205 | |
| 1206 | authTestAssertAsSuper("call dolt_conflicts_resolve('--theirs', 'test_table');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1207 | |
| 1208 | authTestAssertAsSuper("call dolt_count_commits('--from=main', '--to=test');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1209 | |
| 1210 | authTestAssertAsSuper("call dolt_backup('remove', 'bak1');", nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1211 | authTestAssertAsSuper(fmt.Sprintf("call dolt_remote('add', 'origin', '%s');", authTestFireUrl("bak1")), nil, functions.ErrDoltProcedureSelectOnly.Error()), |
| 1212 |
nothing calls this directly
no test coverage detected