firebird-qa/tests/bugs/core_5861_test.py

#coding:utf-8
#
# id:           bugs.core_5861
# title:        GRANT OPTION is not checked for new object
# decription:   
#                  Checked on 4.0.0.1172: OK, 4.485s.
#                
# tracker_id:   CORE-5861
# min_versions: ['4.0']
# versions:     4.0
# qmid:         None

import pytest
from firebird.qa import db_factory, isql_act, Action

# version: 4.0
# resources: None

substitutions_1 = []

init_script_1 = """"""

db_1 = db_factory(sql_dialect=3, init=init_script_1)

test_script_1 = """
    set bail on;
    set list on;

    create or alter user tmp$c5861_u1 password 'pass'; 
    create or alter user tmp$c5861_u2 password 'pass'; 
    create or alter user tmp$c5861_u3 password 'pass'; 

    create role role1; -- Has privileges with grant option 
    create role role2; -- Has privileges without errors and without grant option 
    create role role3; -- Must get errors in granting privileges from role2 

    grant role1 to tmp$c5861_u1; 
    grant role2 to tmp$c5861_u2; 
    grant role3 to tmp$c5861_u3; 

    create procedure p as begin end; 
    create function f returns int as begin end; 
    create generator g; 
    create exception e 'ex'; 
    create table tab(id int); 
    create package pak as begin end; 

    grant create table to role1 with grant option; 
    grant create procedure to role1 with grant option; 
    grant execute on procedure p to role1 with grant option; 
    grant execute on function f to role1 with grant option; 
    grant usage on generator g to role1 with grant option; 
    grant usage on exception e to role1 with grant option; 
    grant select on tab to role1 with grant option; 
    grant update(id) on tab to role1 with grant option; 
    grant execute on package pak to role1 with grant option; 

    commit; 

    connect '$(DSN)' user 'tmp$c5861_u1' password 'pass' role 'role1';

    select rdb$role_name from rdb$roles where rdb$role_in_use(rdb$role_name); 

    grant create table to role2; 
    grant execute on procedure p to role2; 
    grant execute on function f to role2; 
    grant usage on generator g to role2; 
    grant usage on exception e to role2; 
    grant select on tab to role2; 
    grant update(id) on tab to role2; 
    grant execute on package pak to role2; 

    commit; 

    -- create own objects 
    create table tab_of_tmp$c5861_u1(i int); 
    create procedure proc_of_tmp$c5861_u1 as begin end; 

    commit; 

    -- try to grant privileges for owned objects 
    grant select on table tab_of_tmp$c5861_u1 to role2; 
    grant execute on procedure proc_of_tmp$c5861_u1 to role2; 

    commit; 

    connect '$(DSN)' user 'tmp$c5861_u2' password 'pass' role 'role2';

    -- check every privilege 
    create table t(i integer); 
    execute procedure p; 
    select f() from rdb$database; 
    select gen_id(g, 1) from rdb$database; 
    select * from tab; 

    -- try to grant every privilege to role3 and sure this causes an error 
    set bail off;

    ------------------------------------------------ 
    grant create table to role3; 
    ------------------------------------------------ 
    grant execute on procedure p to role3; 
    ------------------------------------------------ 
    grant execute on function f to role3; 
    ------------------------------------------------ 
    grant usage on generator g to role3; 
    ------------------------------------------------ 
    grant usage on exception e to role3; 
    ------------------------------------------------ 
    grant select on tab to role3; 
    ------------------------------------------------ 
    grant update(id) on tab to role3; 
    ------------------------------------------------ 
    grant execute on package pak to role3; 

    --- cleanup:
    commit;
    
    connect '$(DSN)' user 'SYSDBA' password 'masterkey';

    drop user tmp$c5861_u1;
    drop user tmp$c5861_u2;
    drop user tmp$c5861_u3;
    commit;
"""

act_1 = isql_act('db_1', test_script_1, substitutions=substitutions_1)

expected_stdout_1 = """
    RDB$ROLE_NAME                   ROLE1
    F                               <null>
    GEN_ID                          1
"""
expected_stderr_1 = """
    Statement failed, SQLSTATE = 42000
    unsuccessful metadata update
    -GRANT failed
    -no CREATE privilege with grant option on DDL SQL$TABLES

    Statement failed, SQLSTATE = 42000
    unsuccessful metadata update
    -GRANT failed
    -no EXECUTE privilege with grant option on object P

    Statement failed, SQLSTATE = 42000
    unsuccessful metadata update
    -GRANT failed
    -no EXECUTE privilege with grant option on object F

    Statement failed, SQLSTATE = 42000
    unsuccessful metadata update
    -GRANT failed
    -no USAGE privilege with grant option on object G

    Statement failed, SQLSTATE = 42000
    unsuccessful metadata update
    -GRANT failed
    -no USAGE privilege with grant option on object E

    Statement failed, SQLSTATE = 42000
    unsuccessful metadata update
    -GRANT failed
    -no grant option for privilege SELECT on table/view TAB

    Statement failed, SQLSTATE = 42000
    unsuccessful metadata update
    -GRANT failed
    -no grant option for privilege UPDATE on column ID of table/view TAB

    Statement failed, SQLSTATE = 42000
    unsuccessful metadata update
    -GRANT failed
    -no EXECUTE privilege with grant option on object PAK
"""

@pytest.mark.version('>=4.0')
def test_1(act_1: Action):
    act_1.expected_stdout = expected_stdout_1
    act_1.expected_stderr = expected_stderr_1
    act_1.execute()
    assert act_1.clean_stderr == act_1.clean_expected_stderr
    assert act_1.clean_stdout == act_1.clean_expected_stdout