Method parseGrantStmt

database/postgres/parser.go:1648–1750

(stmt *pgquery.GrantStmt)

}

func (p PostgresParser) parseGrantStmt(stmt *pgquery.GrantStmt) (parser.Statement, error) {
	if stmt.Objtype != pgquery.ObjectType_OBJECT_TABLE {
		// For now, only support table grants
		return nil, fmt.Errorf("only table grants are supported")
	}

	if len(stmt.Objects) == 0 {
		return nil, fmt.Errorf("no objects specified in grant statement")
	}

	// Check for unsupported WITH GRANT OPTION
	if stmt.GrantOption {
		return nil, validationError{"WITH GRANT OPTION is not supported yet"}
	}

	// Check for unsupported CASCADE/RESTRICT (for REVOKE)
	// Note: DROP_RESTRICT is the default behavior and is allowed
	if !stmt.IsGrant && stmt.Behavior == pgquery.DropBehavior_DROP_CASCADE {
		return nil, validationError{"CASCADE/RESTRICT options are not supported yet"}
	}

	// Handle multiple tables - return multiple DDL statements
	var statements []parser.Statement

	for _, obj := range stmt.Objects {
		var tableName parser.TableName
		if rangeVar, ok := obj.Node.(*pgquery.Node_RangeVar); ok {
			parsedName, err := p.parseTableName(rangeVar.RangeVar)
			if err != nil {
				return nil, err
			}
			tableName = parsedName
		} else {
			return nil, fmt.Errorf("unexpected object type in grant statement")
		}

		var privileges []string
		if stmt.Privileges == nil {
			// ALL PRIVILEGES case
			privileges = []string{"ALL"}
		} else {
			for _, priv := range stmt.Privileges {
				if accessPriv, ok := priv.Node.(*pgquery.Node_AccessPriv); ok {
					if accessPriv.AccessPriv.Cols == nil {
						privileges = append(privileges, strings.ToUpper(accessPriv.AccessPriv.PrivName))
					}
				}
			}
		}

		if len(stmt.Grantees) == 0 {
			return nil, fmt.Errorf("no grantees specified in grant statement")
		}

		var grantees []string
		for _, granteeNode := range stmt.Grantees {
			if roleSpec, ok := granteeNode.Node.(*pgquery.Node_RoleSpec); ok {
				switch roleSpec.RoleSpec.Roletype {