security, sql: Add User IDs in system tables and User Info struct

Previously we used usernames to access user information and privileges. We will transition to using IDs by first adding user ids and updating the code to use IDs where possible. Release justification: Justified in RFC cockroachdb#77453 Release note: None
Fenil-P · Mar 28, 2022 · 3d2c91c · 3d2c91c
1 parent a1c1879
commit 3d2c91c
Show file tree

Hide file tree

Showing 55 changed files with 798 additions and 380 deletions.
diff --git a/pkg/bench/rttanalysis/testdata/benchmark_expectations b/pkg/bench/rttanalysis/testdata/benchmark_expectations
@@ -1,7 +1,7 @@
 exp,benchmark
-11,AlterRole/alter_role_with_1_option
-12,AlterRole/alter_role_with_2_options
-16,AlterRole/alter_role_with_3_options
+13,AlterRole/alter_role_with_1_option
+14,AlterRole/alter_role_with_2_options
+18,AlterRole/alter_role_with_3_options
 13,AlterTableAddCheckConstraint/alter_table_add_1_check_constraint
 13,AlterTableAddCheckConstraint/alter_table_add_2_check_constraints
 13,AlterTableAddCheckConstraint/alter_table_add_3_check_constraints
@@ -36,8 +36,8 @@ exp,benchmark
 16,DropDatabase/drop_database_2_tables
 17,DropDatabase/drop_database_3_tables
 20,DropRole/drop_1_role
-27,DropRole/drop_2_roles
-34,DropRole/drop_3_roles
+29,DropRole/drop_2_roles
+37,DropRole/drop_3_roles
 14,DropSequence/drop_1_sequence
 16,DropSequence/drop_2_sequences
 18,DropSequence/drop_3_sequences
@@ -47,11 +47,11 @@ exp,benchmark
 16,DropView/drop_1_view
 18,DropView/drop_2_views
 20,DropView/drop_3_views
-14,Grant/grant_all_on_1_table
-14,Grant/grant_all_on_2_tables
-14,Grant/grant_all_on_3_tables
-10,GrantRole/grant_1_role
-12,GrantRole/grant_2_roles
+16,Grant/grant_all_on_1_table
+16,Grant/grant_all_on_2_tables
+16,Grant/grant_all_on_3_tables
+14,GrantRole/grant_1_role
+18,GrantRole/grant_2_roles
 2,ORMQueries/activerecord_type_introspection_query
 2,ORMQueries/django_table_introspection_1_table
 2,ORMQueries/django_table_introspection_4_tables
@@ -76,11 +76,11 @@ exp,benchmark
 4,ORMQueries/pg_my_temp_schema_multiple_times
 4,ORMQueries/pg_namespace
 2,ORMQueries/pg_type
-14,Revoke/revoke_all_on_1_table
-14,Revoke/revoke_all_on_2_tables
-14,Revoke/revoke_all_on_3_tables
-10,RevokeRole/revoke_1_role
-12,RevokeRole/revoke_2_roles
+16,Revoke/revoke_all_on_1_table
+16,Revoke/revoke_all_on_2_tables
+16,Revoke/revoke_all_on_3_tables
+13,RevokeRole/revoke_1_role
+16,RevokeRole/revoke_2_roles
 1,SystemDatabaseQueries/select_system.users_with_empty_database_Name
 1,SystemDatabaseQueries/select_system.users_with_schema_Name
 2,SystemDatabaseQueries/select_system.users_without_schema_Name

diff --git a/pkg/ccl/backupccl/backup_test.go b/pkg/ccl/backupccl/backup_test.go
@@ -9881,7 +9881,7 @@ func TestBackupRestoreSystemUsers(t *testing.T) {
 
 		// Role 'app_role' and user 'app' will be added, and 'app' is granted with 'app_role'
 		// User test will remain untouched with no role granted
-		sqlDBRestore.CheckQueryResults(t, "SELECT * FROM system.users", [][]string{
+		sqlDBRestore.CheckQueryResults(t, "SELECT username, \"hashedPassword\", \"isRole\" FROM system.users", [][]string{
 			{"admin", "", "true"},
 			{"app", "NULL", "false"},
 			{"app_role", "NULL", "true"},
@@ -9915,15 +9915,15 @@ func TestBackupRestoreSystemUsers(t *testing.T) {
 	t.Run("restore-from-backup-with-no-system-role-members", func(t *testing.T) {
 		sqlDBRestore1.Exec(t, "RESTORE SYSTEM USERS FROM $1", localFoo+"/3")
 
-		sqlDBRestore1.CheckQueryResults(t, "SELECT * FROM system.users", [][]string{
+		sqlDBRestore1.CheckQueryResults(t, "SELECT username, \"hashedPassword\", \"isRole\" FROM system.users", [][]string{
 			{"admin", "", "true"},
 			{"app", "NULL", "false"},
 			{"app_role", "NULL", "true"},
 			{"root", "", "false"},
 			{"test", "NULL", "false"},
 			{"test_role", "NULL", "true"},
 		})
-		sqlDBRestore1.CheckQueryResults(t, "SELECT * FROM system.role_members", [][]string{
+		sqlDBRestore1.CheckQueryResults(t, "SELECT \"role\", \"member\", \"isAdmin\" FROM system.role_members", [][]string{
 			{"admin", "root", "true"},
 		})
 		sqlDBRestore1.CheckQueryResults(t, "SHOW USERS", [][]string{

diff --git a/pkg/ccl/logictestccl/testdata/logic_test/crdb_internal_tenant b/pkg/ccl/logictestccl/testdata/logic_test/crdb_internal_tenant
@@ -19,6 +19,7 @@ SELECT node_id, name FROM crdb_internal.leases ORDER BY name
 0  settings
 0  statement_diagnostics_requests
 0  test
+0  user_id_seq
 0  users
 
 query error database "crdb_internal" does not exist

diff --git a/pkg/ccl/spanconfigccl/spanconfigcomparedccl/testdata/multitenant b/pkg/ccl/spanconfigccl/spanconfigcomparedccl/testdata/multitenant
@@ -62,10 +62,10 @@ diff offset=48 limit=10
 +/Tenant/11/Table/5                         database system (tenant)
 +/Tenant/11/Table/6                         database system (tenant)
 +/Tenant/11/Table/7                         database system (tenant)
++/Tenant/11/Table/9                         database system (tenant)
 +/Tenant/11/Table/11                        database system (tenant)
 +/Tenant/11/Table/12                        database system (tenant)
 +/Tenant/11/Table/13                        database system (tenant)
-+/Tenant/11/Table/14                        database system (tenant)
  ...
 
 # Sanity check that new tenant tables show up correctly.
@@ -88,6 +88,7 @@ diff offset=48
 +/Tenant/11/Table/5                         database system (tenant)
 +/Tenant/11/Table/6                         database system (tenant)
 +/Tenant/11/Table/7                         database system (tenant)
++/Tenant/11/Table/9                         database system (tenant)
 +/Tenant/11/Table/11                        database system (tenant)
 +/Tenant/11/Table/12                        database system (tenant)
 +/Tenant/11/Table/13                        database system (tenant)

diff --git a/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/basic b/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/basic
@@ -17,6 +17,7 @@ upsert /Table/{4-5}                        database system (host)
 upsert /Table/{5-6}                        database system (host)
 upsert /Table/{6-7}                        database system (host)
 upsert /Table/{8-9}                        database system (host)
+upsert /Table/{9-10}                       database system (host)
 upsert /Table/1{1-2}                       database system (host)
 upsert /Table/1{2-3}                       database system (host)
 upsert /Table/1{3-4}                       database system (host)
@@ -91,6 +92,7 @@ upsert /Table/11{2-3}                      num_replicas=7
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/10{6-7}                             num_replicas=7 num_voters=5
 /Table/10{7-8}                             num_replicas=7
@@ -113,6 +115,8 @@ delete /Table/{6-7}
 upsert /Table/{6-7}                        ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 delete /Table/{8-9}
 upsert /Table/{8-9}                        ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
+delete /Table/{9-10}
+upsert /Table/{9-10}                       ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 delete /Table/1{1-2}
 upsert /Table/1{1-2}                       ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 delete /Table/1{2-3}
@@ -192,6 +196,7 @@ state offset=5 limit=42
 /Table/{5-6}                               ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 /Table/{6-7}                               ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 /Table/{8-9}                               ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
+/Table/{9-10}                              ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 /Table/1{1-2}                              ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 /Table/1{2-3}                              ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 /Table/1{3-4}                              ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
@@ -228,5 +233,4 @@ state offset=5 limit=42
 /Table/4{4-5}                              ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 /Table/4{5-6}                              ttl_seconds=7200 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 /Table/4{6-7}                              ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
-/Table/4{7-8}                              ttl_seconds=100 ignore_strict_gc=true num_replicas=5 rangefeed_enabled=true
 ...
diff --git a/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/indexes b/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/indexes
@@ -21,6 +21,7 @@ upsert /Table/10{6-7}                      range default
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/10{6-7}                             range default
 
@@ -43,6 +44,7 @@ upsert /Table/10{6/3-7}                    num_replicas=7
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/106{-/2}                            num_replicas=7
 /Table/106/{2-3}                           num_replicas=7 num_voters=5
@@ -67,6 +69,7 @@ upsert /Table/10{6/3-7}                    ttl_seconds=3600 num_replicas=7
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/106{-/2}                            ttl_seconds=3600 num_replicas=7
 /Table/106/{2-3}                           ttl_seconds=25 num_replicas=7 num_voters=5
@@ -81,6 +84,7 @@ ALTER TABLE db.t CONFIGURE ZONE USING num_replicas = 9
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/106{-/2}                            ttl_seconds=3600 num_replicas=9
 /Table/106/{2-3}                           ttl_seconds=25 num_replicas=9 num_voters=5
@@ -108,5 +112,6 @@ delete /Table/10{6/3-7}
 state offset=46
 ----
 ...
+/Table/4{6-7}                              database system (host)
 /Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
diff --git a/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/multitenant/basic b/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/multitenant/basic
@@ -22,6 +22,7 @@ mutations
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Tenant/10{-"\x00"}                        database system (tenant)
 /Tenant/11{-"\x00"}                        database system (tenant)
@@ -38,6 +39,7 @@ upsert /Tenant/10/Table/{4-5}              database system (tenant)
 upsert /Tenant/10/Table/{5-6}              database system (tenant)
 upsert /Tenant/10/Table/{6-7}              database system (tenant)
 upsert /Tenant/10/Table/{7-8}              database system (tenant)
+upsert /Tenant/10/Table/{9-10}             database system (tenant)
 upsert /Tenant/10/Table/1{1-2}             database system (tenant)
 upsert /Tenant/10/Table/1{2-3}             database system (tenant)
 upsert /Tenant/10/Table/1{3-4}             database system (tenant)
@@ -71,12 +73,14 @@ upsert /Tenant/10/Table/4{6-7}             database system (tenant)
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Tenant/10{-/Table/4}                      database system (tenant)
 /Tenant/10/Table/{4-5}                     database system (tenant)
 /Tenant/10/Table/{5-6}                     database system (tenant)
 /Tenant/10/Table/{6-7}                     database system (tenant)
 /Tenant/10/Table/{7-8}                     database system (tenant)
+/Tenant/10/Table/{9-10}                    database system (tenant)
 /Tenant/10/Table/1{1-2}                    database system (tenant)
 /Tenant/10/Table/1{2-3}                    database system (tenant)
 /Tenant/10/Table/1{3-4}                    database system (tenant)
@@ -129,6 +133,8 @@ upsert /Tenant/10/Table/11{3-4}            range default
 state offset=81
 ----
 ...
+/Tenant/10/Table/4{3-4}                    database system (tenant)
+/Tenant/10/Table/4{4-5}                    database system (tenant)
 /Tenant/10/Table/4{6-7}                    database system (tenant)
 /Tenant/10/Table/10{6-7}                   range default
 /Tenant/10/Table/10{7-8}                   range default

diff --git a/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/multitenant/protectedts b/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/multitenant/protectedts
@@ -19,6 +19,7 @@ mutations
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Tenant/10{-"\x00"}                        database system (tenant)
 
@@ -54,6 +55,7 @@ upsert /Tenant/10/Table/{4-5}              database system (tenant)
 upsert /Tenant/10/Table/{5-6}              database system (tenant)
 upsert /Tenant/10/Table/{6-7}              database system (tenant)
 upsert /Tenant/10/Table/{7-8}              database system (tenant)
+upsert /Tenant/10/Table/{9-10}             database system (tenant)
 upsert /Tenant/10/Table/1{1-2}             database system (tenant)
 upsert /Tenant/10/Table/1{2-3}             database system (tenant)
 upsert /Tenant/10/Table/1{3-4}             database system (tenant)

diff --git a/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/named_zones b/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/named_zones
@@ -123,6 +123,7 @@ state limit=5
 state offset=46
 ----
 ...
+/Table/4{6-7}                              database system (host)
 /Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/10{6-7}                             ttl_seconds=50
@@ -139,6 +140,7 @@ upsert /Table/10{7-8}                      ttl_seconds=50
 state offset=46
 ----
 ...
+/Table/4{6-7}                              database system (host)
 /Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/10{6-7}                             ttl_seconds=50

diff --git a/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/partitions b/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/partitions
@@ -13,6 +13,7 @@ mutations discard
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 
 exec-sql
@@ -33,6 +34,7 @@ upsert /Table/10{6-7}                      range default
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/10{6-7}                             range default
 
@@ -50,6 +52,7 @@ upsert /Table/10{6-7}                      num_replicas=7 num_voters=5
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/10{6-7}                             num_replicas=7 num_voters=5
 
@@ -72,6 +75,7 @@ upsert /Table/10{6/1/3-7}                  num_replicas=7 num_voters=5
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/106{-/1/1}                          num_replicas=7 num_voters=5
 /Table/106/1/{1-2}                         global_reads=true num_replicas=7 num_voters=5
@@ -94,6 +98,7 @@ upsert /Table/10{6/1/5-7}                  num_replicas=7 num_voters=5
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/106{-/1/1}                          num_replicas=7 num_voters=5
 /Table/106/1/{1-2}                         global_reads=true num_replicas=7 num_voters=5
@@ -130,6 +135,7 @@ upsert /Table/10{6/2-7}                    num_replicas=7 num_voters=5
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/106{-/1}                            num_replicas=7 num_voters=5
 /Table/106/1{-/1}                          num_replicas=7 num_voters=6
@@ -164,6 +170,7 @@ upsert /Table/10{6/2-7}                    num_replicas=7
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
 /Table/106{-/1}                            num_replicas=7
 /Table/106/1{-/1}                          num_replicas=7 num_voters=6
@@ -192,4 +199,5 @@ delete /Table/10{6/2-7}
 state offset=47
 ----
 ...
+/Table/4{7-8}                              database system (host)
 /Table/5{0-1}                              database system (host)
diff --git a/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/protectedts b/pkg/ccl/spanconfigccl/spanconfigreconcilerccl/testdata/protectedts
@@ -77,6 +77,7 @@ state limit=3
 state offset=51
 ----
 ...
+/Table/5{0-1}                              database system (host)
 /Table/10{6-7}                             protection_policies=[{ts: 3} {ts: 4}]
 /Table/10{7-8}                             protection_policies=[{ts: 3} {ts: 4}]
 

diff --git a/pkg/ccl/spanconfigccl/spanconfigsqltranslatorccl/testdata/full_translate b/pkg/ccl/spanconfigccl/spanconfigsqltranslatorccl/testdata/full_translate
@@ -33,6 +33,7 @@ full-translate
 /Table/{5-6}                               database system (host)
 /Table/{6-7}                               database system (host)
 /Table/{8-9}                               database system (host)
+/Table/{9-10}                              database system (host)
 /Table/1{1-2}                              database system (host)
 /Table/1{2-3}                              database system (host)
 /Table/1{3-4}                              database system (host)

diff --git a/pkg/ccl/spanconfigccl/spanconfigsqltranslatorccl/testdata/full_translate_named_zones_deleted b/pkg/ccl/spanconfigccl/spanconfigsqltranslatorccl/testdata/full_translate_named_zones_deleted
@@ -46,6 +46,7 @@ full-translate
 /Table/{5-6}                               database system (host)
 /Table/{6-7}                               database system (host)
 /Table/{8-9}                               database system (host)
+/Table/{9-10}                              database system (host)
 /Table/1{1-2}                              database system (host)
 /Table/1{2-3}                              database system (host)
 /Table/1{3-4}                              database system (host)

diff --git a/pkg/ccl/spanconfigccl/spanconfigsqltranslatorccl/testdata/system_database b/pkg/ccl/spanconfigccl/spanconfigsqltranslatorccl/testdata/system_database
@@ -9,6 +9,7 @@ translate database=system
 /Table/{5-6}                               database system (host)
 /Table/{6-7}                               database system (host)
 /Table/{8-9}                               database system (host)
+/Table/{9-10}                              database system (host)
 /Table/1{1-2}                              database system (host)
 /Table/1{2-3}                              database system (host)
 /Table/1{3-4}                              database system (host)
@@ -60,6 +61,7 @@ translate database=system
 /Table/{5-6}                               ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
 /Table/{6-7}                               ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
 /Table/{8-9}                               ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
+/Table/{9-10}                              ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
 /Table/1{1-2}                              ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
 /Table/1{2-3}                              ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
 /Table/1{3-4}                              ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
@@ -117,6 +119,7 @@ full-translate
 /Table/{5-6}                               ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
 /Table/{6-7}                               ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
 /Table/{8-9}                               ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
+/Table/{9-10}                              ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
 /Table/1{1-2}                              ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
 /Table/1{2-3}                              ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true
 /Table/1{3-4}                              ignore_strict_gc=true num_replicas=7 rangefeed_enabled=true

diff --git a/pkg/ccl/spanconfigccl/spanconfigsqltranslatorccl/testdata/tenant/full_translate b/pkg/ccl/spanconfigccl/spanconfigsqltranslatorccl/testdata/tenant/full_translate
@@ -22,6 +22,7 @@ full-translate
 /Tenant/10/Table/{5-6}                     database system (tenant)
 /Tenant/10/Table/{6-7}                     database system (tenant)
 /Tenant/10/Table/{7-8}                     database system (tenant)
+/Tenant/10/Table/{9-10}                    database system (tenant)
 /Tenant/10/Table/1{1-2}                    database system (tenant)
 /Tenant/10/Table/1{2-3}                    database system (tenant)
 /Tenant/10/Table/1{3-4}                    database system (tenant)
@@ -63,6 +64,7 @@ translate named-zone=default
 /Tenant/10/Table/{5-6}                     database system (tenant)
 /Tenant/10/Table/{6-7}                     database system (tenant)
 /Tenant/10/Table/{7-8}                     database system (tenant)
+/Tenant/10/Table/{9-10}                    database system (tenant)
 /Tenant/10/Table/1{1-2}                    database system (tenant)
 /Tenant/10/Table/1{2-3}                    database system (tenant)
 /Tenant/10/Table/1{3-4}                    database system (tenant)