diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c index 61e70d99ff0..427213ecf1f 100644 --- a/src/backend/catalog/aclchk.c +++ b/src/backend/catalog/aclchk.c @@ -1784,7 +1784,7 @@ ExecGrant_Attribute(InternalGrant *istmt, Oid relOid, const char *relname, } /* - * This processes both sequences and non-sequences. + * This processes all pg_class entries including sequences and property graphs. */ static void ExecGrant_Relation(InternalGrant *istmt) @@ -1891,6 +1891,18 @@ ExecGrant_Relation(InternalGrant *istmt) this_privileges &= (AclMode) ACL_ALL_RIGHTS_SEQUENCE; } } + else if (pg_class_tuple->relkind == RELKIND_PROPGRAPH) + { + /* + * Do not allow GRANT ... TABLE on property graph. We allowed + * it on sequences for backward compatibility but there is no + * reason to continue that further. + */ + ereport(ERROR, + errcode(ERRCODE_WRONG_OBJECT_TYPE), + errmsg("\"%s\" is a property graph", NameStr(pg_class_tuple->relname)), + errhint("Use GRANT ... ON PROPERTY GRAPH instead.")); + } else { if (this_privileges & ~((AclMode) ACL_ALL_RIGHTS_RELATION)) @@ -1996,6 +2008,9 @@ ExecGrant_Relation(InternalGrant *istmt) case RELKIND_SEQUENCE: objtype = OBJECT_SEQUENCE; break; + case RELKIND_PROPGRAPH: + objtype = OBJECT_PROPGRAPH; + break; default: objtype = OBJECT_TABLE; break; @@ -3389,6 +3404,9 @@ pg_class_aclmask_ext(Oid table_oid, Oid roleid, AclMode mask, case RELKIND_SEQUENCE: acl = acldefault(OBJECT_SEQUENCE, ownerId); break; + case RELKIND_PROPGRAPH: + acl = acldefault(OBJECT_PROPGRAPH, ownerId); + break; default: acl = acldefault(OBJECT_TABLE, ownerId); break; diff --git a/src/test/regress/expected/create_property_graph.out b/src/test/regress/expected/create_property_graph.out index 7387751eac2..9a3cc6c13b2 100644 --- a/src/test/regress/expected/create_property_graph.out +++ b/src/test/regress/expected/create_property_graph.out @@ -236,6 +236,9 @@ SET ROLE regress_graph_user1; GRANT SELECT ON PROPERTY GRAPH g1 TO regress_graph_user2; GRANT UPDATE ON PROPERTY GRAPH g1 TO regress_graph_user2; -- fail ERROR: invalid privilege type UPDATE for property graph +GRANT UPDATE ON TABLE g1 TO regress_graph_user2; -- fail +ERROR: "g1" is a property graph +HINT: Use GRANT ... ON PROPERTY GRAPH instead. RESET ROLE; -- collation CREATE TABLE tc1 (a int, b text); diff --git a/src/test/regress/expected/graph_table_rls.out b/src/test/regress/expected/graph_table_rls.out index 0e719c7ebd7..230ae4cdb01 100644 --- a/src/test/regress/expected/graph_table_rls.out +++ b/src/test/regress/expected/graph_table_rls.out @@ -74,7 +74,7 @@ CREATE PROPERTY GRAPH cabinet EDGE TABLES (accessed KEY (aid) SOURCE KEY (uid) REFERENCES users (uid) DESTINATION KEY (did) REFERENCES document (did)); -GRANT SELECT ON cabinet TO public; +GRANT SELECT ON PROPERTY GRAPH cabinet TO public; -- -- Basic RLS tests -- @@ -261,7 +261,7 @@ CREATE PROPERTY GRAPH cabinet EDGE TABLES (accessed KEY (aid) SOURCE KEY (uid) REFERENCES users (uid) DESTINATION KEY (did) REFERENCES document (did)); -GRANT SELECT ON cabinet TO public; +GRANT SELECT ON PROPERTY GRAPH cabinet TO public; SET row_security TO ON; -- viewpoint from regress_graph_rls_bob SET SESSION AUTHORIZATION regress_graph_rls_bob; @@ -456,7 +456,7 @@ CREATE PROPERTY GRAPH cabinet EDGE TABLES (accessed KEY (aid) SOURCE KEY (uid) REFERENCES users (uid) DESTINATION KEY (did) REFERENCES document (did)); -GRANT SELECT ON cabinet TO public; +GRANT SELECT ON PROPERTY GRAPH cabinet TO public; SET row_security TO ON; -- viewpoint from regress_graph_rls_bob SET SESSION AUTHORIZATION regress_graph_rls_bob; diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out index f6cc1a1029c..fd18549e84e 100644 --- a/src/test/regress/expected/privileges.out +++ b/src/test/regress/expected/privileges.out @@ -3206,7 +3206,7 @@ select * from graph_table (ptg1 match (is atest5) COLUMNS (1 as value)) limit 0; ------- (0 rows) -grant select on ptg1 to regress_priv_user2; +grant select on property graph ptg1 to regress_priv_user2; set session role regress_priv_user2; select * from graph_table (ptg1 match (is atest1) COLUMNS (1 as value)) limit 0; -- ok value @@ -3232,7 +3232,7 @@ select * from graph_table (ptg1 match (v is lttc) COLUMNS (v.lttck)) limit 0; -- ------- (0 rows) -grant select on ptg1 to regress_priv_user4; +grant select on property graph ptg1 to regress_priv_user4; set session role regress_priv_user4; select * from graph_table (ptg1 match (a is atest5) COLUMNS (a.four)) limit 0; -- ok four diff --git a/src/test/regress/sql/create_property_graph.sql b/src/test/regress/sql/create_property_graph.sql index 3494390b923..1ee223809f3 100644 --- a/src/test/regress/sql/create_property_graph.sql +++ b/src/test/regress/sql/create_property_graph.sql @@ -184,6 +184,7 @@ ALTER PROPERTY GRAPH g1 OWNER TO regress_graph_user1; SET ROLE regress_graph_user1; GRANT SELECT ON PROPERTY GRAPH g1 TO regress_graph_user2; GRANT UPDATE ON PROPERTY GRAPH g1 TO regress_graph_user2; -- fail +GRANT UPDATE ON TABLE g1 TO regress_graph_user2; -- fail RESET ROLE; -- collation diff --git a/src/test/regress/sql/graph_table_rls.sql b/src/test/regress/sql/graph_table_rls.sql index 5837eac402e..5c79ade68d4 100644 --- a/src/test/regress/sql/graph_table_rls.sql +++ b/src/test/regress/sql/graph_table_rls.sql @@ -87,7 +87,7 @@ CREATE PROPERTY GRAPH cabinet EDGE TABLES (accessed KEY (aid) SOURCE KEY (uid) REFERENCES users (uid) DESTINATION KEY (did) REFERENCES document (did)); -GRANT SELECT ON cabinet TO public; +GRANT SELECT ON PROPERTY GRAPH cabinet TO public; -- -- Basic RLS tests @@ -198,7 +198,7 @@ CREATE PROPERTY GRAPH cabinet EDGE TABLES (accessed KEY (aid) SOURCE KEY (uid) REFERENCES users (uid) DESTINATION KEY (did) REFERENCES document (did)); -GRANT SELECT ON cabinet TO public; +GRANT SELECT ON PROPERTY GRAPH cabinet TO public; SET row_security TO ON; @@ -267,7 +267,7 @@ CREATE PROPERTY GRAPH cabinet EDGE TABLES (accessed KEY (aid) SOURCE KEY (uid) REFERENCES users (uid) DESTINATION KEY (did) REFERENCES document (did)); -GRANT SELECT ON cabinet TO public; +GRANT SELECT ON PROPERTY GRAPH cabinet TO public; SET row_security TO ON; -- viewpoint from regress_graph_rls_bob diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql index 6cd9bb840ff..6e0686da131 100644 --- a/src/test/regress/sql/privileges.sql +++ b/src/test/regress/sql/privileges.sql @@ -1890,7 +1890,7 @@ create property graph ptg1 label ltv properties (col1 as ltvk)); -- select privileges on property graph as well as table select * from graph_table (ptg1 match (is atest5) COLUMNS (1 as value)) limit 0; -- ok -grant select on ptg1 to regress_priv_user2; +grant select on property graph ptg1 to regress_priv_user2; set session role regress_priv_user2; select * from graph_table (ptg1 match (is atest1) COLUMNS (1 as value)) limit 0; -- ok -- select privileges on property graph but not table @@ -1904,7 +1904,7 @@ select * from graph_table (ptg1 match (is atest5) COLUMNS (1 as value)) limit 0; -- column privileges set session role regress_priv_user1; select * from graph_table (ptg1 match (v is lttc) COLUMNS (v.lttck)) limit 0; -- ok -grant select on ptg1 to regress_priv_user4; +grant select on property graph ptg1 to regress_priv_user4; set session role regress_priv_user4; select * from graph_table (ptg1 match (a is atest5) COLUMNS (a.four)) limit 0; -- ok select * from graph_table (ptg1 match (v is lttc) COLUMNS (v.lttck)) limit 0; -- fail