Prohibit GRANT ... ON TABLE on a property graph

We allowed GRANT ... ON TABLE on sequences for backward compatibility.
We don't need to consider backward compatibility in case of property
graphs since we will be prohibiting its usage on property graph from
the very release which introduced property graphs.

Change regression tests that used GRANT ... ON [TABLE] on property
graphs to use GRANT ... ON PROPERTY GRAPH instead.

While here, add the missing RELKIND_PROPGRAPH cases in
pg_class_aclmask_ext() and in the object-type switch in
ExecGrant_Relation() so that the default ACL and the objtype passed to
restrict_and_check_grant() are correct.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://www.postgresql.org/message-id/20260630023308.c7.noahmisch@microsoft.com

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 61e70d99ff02d354e359943038c811dc34c715b5..427213ecf1f48a96ae89ba2e121270fd66db5fa0 100644 (file)
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -1784,7 +1784,7 @@ ExecGrant_Attribute(InternalGrant *istmt, Oid relOid, const char *relname,
 }
 
 /*
- *     This processes both sequences and non-sequences.
+ * This processes all pg_class entries including sequences and property graphs.
  */
 static void
 ExecGrant_Relation(InternalGrant *istmt)
@@ -1891,6 +1891,18 @@ ExecGrant_Relation(InternalGrant *istmt)
                                        this_privileges &= (AclMode) ACL_ALL_RIGHTS_SEQUENCE;
                                }
                        }
+                       else if (pg_class_tuple->relkind == RELKIND_PROPGRAPH)
+                       {
+                               /*
+                                * Do not allow GRANT ... TABLE on property graph. We allowed
+                                * it on sequences for backward compatibility but there is no
+                                * reason to continue that further.
+                                */
+                               ereport(ERROR,
+                                               errcode(ERRCODE_WRONG_OBJECT_TYPE),
+                                               errmsg("\"%s\" is a property graph", NameStr(pg_class_tuple->relname)),
+                                               errhint("Use GRANT ... ON PROPERTY GRAPH instead."));
+                       }
                        else
                        {
                                if (this_privileges & ~((AclMode) ACL_ALL_RIGHTS_RELATION))
@@ -1996,6 +2008,9 @@ ExecGrant_Relation(InternalGrant *istmt)
                                case RELKIND_SEQUENCE:
                                        objtype = OBJECT_SEQUENCE;
                                        break;
+                               case RELKIND_PROPGRAPH:
+                                       objtype = OBJECT_PROPGRAPH;
+                                       break;
                                default:
                                        objtype = OBJECT_TABLE;
                                        break;
@@ -3389,6 +3404,9 @@ pg_class_aclmask_ext(Oid table_oid, Oid roleid, AclMode mask,
                        case RELKIND_SEQUENCE:
                                acl = acldefault(OBJECT_SEQUENCE, ownerId);
                                break;
+                       case RELKIND_PROPGRAPH:
+                               acl = acldefault(OBJECT_PROPGRAPH, ownerId);
+                               break;
                        default:
                                acl = acldefault(OBJECT_TABLE, ownerId);
                                break;

diff --git a/src/test/regress/expected/create_property_graph.out b/src/test/regress/expected/create_property_graph.out
index 7387751eac2f15954fd4609a38e52143b4de1216..9a3cc6c13b2cc998a415cc808532d58eb9c60f06 100644 (file)
--- a/src/test/regress/expected/create_property_graph.out
+++ b/src/test/regress/expected/create_property_graph.out
@@ -236,6 +236,9 @@ SET ROLE regress_graph_user1;
 GRANT SELECT ON PROPERTY GRAPH g1 TO regress_graph_user2;
 GRANT UPDATE ON PROPERTY GRAPH g1 TO regress_graph_user2;  -- fail
 ERROR:  invalid privilege type UPDATE for property graph
+GRANT UPDATE ON TABLE g1 TO regress_graph_user2;  -- fail
+ERROR:  "g1" is a property graph
+HINT:  Use GRANT ... ON PROPERTY GRAPH instead.
 RESET ROLE;
 -- collation
 CREATE TABLE tc1 (a int, b text);

diff --git a/src/test/regress/expected/graph_table_rls.out b/src/test/regress/expected/graph_table_rls.out
index 0e719c7ebd7fc7c2a205727c3312f2b0d7d38dee..230ae4cdb013445039ac7df76b8bb56d1e1000f1 100644 (file)
--- a/src/test/regress/expected/graph_table_rls.out
+++ b/src/test/regress/expected/graph_table_rls.out
@@ -74,7 +74,7 @@ CREATE PROPERTY GRAPH cabinet
     EDGE TABLES (accessed KEY (aid)
                  SOURCE KEY (uid) REFERENCES users (uid)
                  DESTINATION KEY (did) REFERENCES document (did));
-GRANT SELECT ON cabinet TO public;
+GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
 --
 -- Basic RLS tests
 --
@@ -261,7 +261,7 @@ CREATE PROPERTY GRAPH cabinet
     EDGE TABLES (accessed KEY (aid)
                  SOURCE KEY (uid) REFERENCES users (uid)
                  DESTINATION KEY (did) REFERENCES document (did));
-GRANT SELECT ON cabinet TO public;
+GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
 SET row_security TO ON;
 -- viewpoint from regress_graph_rls_bob
 SET SESSION AUTHORIZATION regress_graph_rls_bob;
@@ -456,7 +456,7 @@ CREATE PROPERTY GRAPH cabinet
     EDGE TABLES (accessed KEY (aid)
                  SOURCE KEY (uid) REFERENCES users (uid)
                  DESTINATION KEY (did) REFERENCES document (did));
-GRANT SELECT ON cabinet TO public;
+GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
 SET row_security TO ON;
 -- viewpoint from regress_graph_rls_bob
 SET SESSION AUTHORIZATION regress_graph_rls_bob;

diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out
index f6cc1a1029ca8c72584b821f8d87b6840b409e9c..fd18549e84efd2adee10bf1e64c6bb76a5c35aa7 100644 (file)
--- a/src/test/regress/expected/privileges.out
+++ b/src/test/regress/expected/privileges.out
@@ -3206,7 +3206,7 @@ select * from graph_table (ptg1 match (is atest5) COLUMNS (1 as value)) limit 0;
 -------
 (0 rows)
 
-grant select on ptg1 to regress_priv_user2;
+grant select on property graph ptg1 to regress_priv_user2;
 set session role regress_priv_user2;
 select * from graph_table (ptg1 match (is atest1) COLUMNS (1 as value)) limit 0; -- ok
  value 
@@ -3232,7 +3232,7 @@ select * from graph_table (ptg1 match (v is lttc) COLUMNS (v.lttck)) limit 0; --
 -------
 (0 rows)
 
-grant select on ptg1 to regress_priv_user4;
+grant select on property graph ptg1 to regress_priv_user4;
 set session role regress_priv_user4;
 select * from graph_table (ptg1 match (a is atest5) COLUMNS (a.four)) limit 0; -- ok
  four 

diff --git a/src/test/regress/sql/create_property_graph.sql b/src/test/regress/sql/create_property_graph.sql
index 3494390b923bbc0537783eb4b8f0c70f9fb12307..1ee223809f3c42e8a3988b5925d3b8a4811b1757 100644 (file)
--- a/src/test/regress/sql/create_property_graph.sql
+++ b/src/test/regress/sql/create_property_graph.sql
@@ -184,6 +184,7 @@ ALTER PROPERTY GRAPH g1 OWNER TO regress_graph_user1;
 SET ROLE regress_graph_user1;
 GRANT SELECT ON PROPERTY GRAPH g1 TO regress_graph_user2;
 GRANT UPDATE ON PROPERTY GRAPH g1 TO regress_graph_user2;  -- fail
+GRANT UPDATE ON TABLE g1 TO regress_graph_user2;  -- fail
 RESET ROLE;
 
 -- collation

diff --git a/src/test/regress/sql/graph_table_rls.sql b/src/test/regress/sql/graph_table_rls.sql
index 5837eac402e6e73353466ce6dfecfe8a95ad0610..5c79ade68d436ac9f87adc9e10367cd4647b624e 100644 (file)
--- a/src/test/regress/sql/graph_table_rls.sql
+++ b/src/test/regress/sql/graph_table_rls.sql
@@ -87,7 +87,7 @@ CREATE PROPERTY GRAPH cabinet
     EDGE TABLES (accessed KEY (aid)
                  SOURCE KEY (uid) REFERENCES users (uid)
                  DESTINATION KEY (did) REFERENCES document (did));
-GRANT SELECT ON cabinet TO public;
+GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
 
 --
 -- Basic RLS tests
@@ -198,7 +198,7 @@ CREATE PROPERTY GRAPH cabinet
     EDGE TABLES (accessed KEY (aid)
                  SOURCE KEY (uid) REFERENCES users (uid)
                  DESTINATION KEY (did) REFERENCES document (did));
-GRANT SELECT ON cabinet TO public;
+GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
 
 SET row_security TO ON;
 
@@ -267,7 +267,7 @@ CREATE PROPERTY GRAPH cabinet
     EDGE TABLES (accessed KEY (aid)
                  SOURCE KEY (uid) REFERENCES users (uid)
                  DESTINATION KEY (did) REFERENCES document (did));
-GRANT SELECT ON cabinet TO public;
+GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
 SET row_security TO ON;
 
 -- viewpoint from regress_graph_rls_bob

diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql
index 6cd9bb840ff463932d4eeec03f2a8985d76525b1..6e0686da13186a24a511ad6cde2f3f5cffb1e48b 100644 (file)
--- a/src/test/regress/sql/privileges.sql
+++ b/src/test/regress/sql/privileges.sql
@@ -1890,7 +1890,7 @@ create property graph ptg1
                        label ltv properties (col1 as ltvk));
 -- select privileges on property graph as well as table
 select * from graph_table (ptg1 match (is atest5) COLUMNS (1 as value)) limit 0; -- ok
-grant select on ptg1 to regress_priv_user2;
+grant select on property graph ptg1 to regress_priv_user2;
 set session role regress_priv_user2;
 select * from graph_table (ptg1 match (is atest1) COLUMNS (1 as value)) limit 0; -- ok
 -- select privileges on property graph but not table
@@ -1904,7 +1904,7 @@ select * from graph_table (ptg1 match (is atest5) COLUMNS (1 as value)) limit 0;
 -- column privileges
 set session role regress_priv_user1;
 select * from graph_table (ptg1 match (v is lttc) COLUMNS (v.lttck)) limit 0; -- ok
-grant select on ptg1 to regress_priv_user4;
+grant select on property graph ptg1 to regress_priv_user4;
 set session role regress_priv_user4;
 select * from graph_table (ptg1 match (a is atest5) COLUMNS (a.four)) limit 0; -- ok
 select * from graph_table (ptg1 match (v is lttc) COLUMNS (v.lttck)) limit 0; -- fail