[stable-2] Backport stable 2 4 (#219)

* Fix wrong impl for mysql (#210) If 'mariadb' in version info, the db instance should be mariadb(reverse in code) rather than mysql. (cherry picked from commit 6635906) * Update README.md (#216) (cherry picked from commit 4de0e25) * mysql_user: replace VALID_PRIVS by get_valid_privs() function (#217) * mysql_user: replace VALID_PRIVS by get_valid_privs() function * Add EXTRA_PRIVS in case we need to add more privs in the future * Add changelog fragment (cherry picked from commit 0ce1fa1) Co-authored-by: int32bit <[email protected]> Co-authored-by: R.Sicart <[email protected]>
ansible-collections · Sep 23, 2021 · c5676ff · c5676ff
1 parent 0c462c8
commit c5676ff
Show file tree

Hide file tree

Showing 5 changed files with 30 additions and 44 deletions.
diff --git a/README.md b/README.md
@@ -25,6 +25,13 @@ The current maintainers (contributors with `write` or higher access) are listed
 
 To learn how to maintain / become a maintainer of this collection, refer to the [Maintainer guidelines](https://github.com/ansible-collections/community.mysql/blob/main/MAINTAINING.md).
 
+It is necessary for maintainers of this collection to be subscribed to:
+
+* The collection itself (the `Watch` button -> `All Activity` in the upper right corner of the repository's homepage).
+* The "Changes Impacting Collection Contributors and Maintainers" [issue](https://github.com/ansible-collections/overview/issues/45).
+
+They also should be subscribed to Ansible's [The Bullhorn newsletter](https://docs.ansible.com/ansible/devel/community/communication.html#the-bullhorn).
+
 ## Communication
 
 We announce releases and important changes through Ansible's [The Bullhorn newsletter](https://eepurl.com/gZmiEP). Be sure you are subscribed.

diff --git a/changelogs/fragments/217-mysql-user-replace-get-valid-privs-from-show-privilegees.yml b/changelogs/fragments/217-mysql-user-replace-get-valid-privs-from-show-privilegees.yml
@@ -0,0 +1,2 @@
+minor_changes:
+  - mysql_user - replace VALID_PRIVS constant by get_valid_privs() function (https://github.com/ansible-collections/community.mysql/pull/217).
diff --git a/plugins/module_utils/user.py b/plugins/module_utils/user.py
@@ -19,41 +19,7 @@
 )
 
 
-VALID_PRIVS = frozenset(('CREATE', 'DROP', 'GRANT', 'GRANT OPTION',
-                         'LOCK TABLES', 'REFERENCES', 'EVENT', 'ALTER',
-                         'DELETE', 'INDEX', 'INSERT', 'SELECT', 'UPDATE',
-                         'CREATE TEMPORARY TABLES', 'TRIGGER', 'CREATE VIEW',
-                         'SHOW VIEW', 'ALTER ROUTINE', 'CREATE ROUTINE',
-                         'EXECUTE', 'FILE', 'CREATE TABLESPACE', 'CREATE USER',
-                         'PROCESS', 'PROXY', 'RELOAD', 'REPLICATION CLIENT',
-                         'REPLICATION SLAVE', 'SHOW DATABASES', 'SHUTDOWN',
-                         'SUPER', 'ALL', 'ALL PRIVILEGES', 'USAGE',
-                         'REQUIRESSL',  # Deprecated, to be removed in version 3.0.0
-                         'CREATE ROLE', 'DROP ROLE', 'APPLICATION_PASSWORD_ADMIN',
-                         'AUDIT_ADMIN', 'BACKUP_ADMIN', 'BINLOG_ADMIN',
-                         'BINLOG_ENCRYPTION_ADMIN', 'CLONE_ADMIN', 'CONNECTION_ADMIN',
-                         'ENCRYPTION_KEY_ADMIN', 'FIREWALL_ADMIN', 'FIREWALL_USER',
-                         'GROUP_REPLICATION_ADMIN', 'INNODB_REDO_LOG_ARCHIVE',
-                         'NDB_STORED_USER', 'PERSIST_RO_VARIABLES_ADMIN',
-                         'REPLICATION_APPLIER', 'REPLICATION_SLAVE_ADMIN',
-                         'RESOURCE_GROUP_ADMIN', 'RESOURCE_GROUP_USER',
-                         'ROLE_ADMIN', 'SESSION_VARIABLES_ADMIN', 'SET_USER_ID',
-                         'SYSTEM_USER', 'SYSTEM_VARIABLES_ADMIN', 'SYSTEM_USER',
-                         'TABLE_ENCRYPTION_ADMIN', 'VERSION_TOKEN_ADMIN',
-                         'XA_RECOVER_ADMIN', 'LOAD FROM S3', 'SELECT INTO S3',
-                         'INVOKE LAMBDA',
-                         'ALTER ROUTINE',
-                         'BINLOG ADMIN',
-                         'BINLOG MONITOR',
-                         'BINLOG REPLAY',
-                         'CONNECTION ADMIN',
-                         'READ_ONLY ADMIN',
-                         'REPLICATION MASTER ADMIN',
-                         'REPLICATION SLAVE ADMIN',
-                         'SET USER',
-                         'SHOW_ROUTINE',
-                         'SLAVE MONITOR',
-                         'REPLICA MONITOR',))
+EXTRA_PRIVS = ['ALL', 'ALL PRIVILEGES', 'GRANT', 'REQUIRESSL']
 
 
 class InvalidPrivsError(Exception):
@@ -141,6 +107,13 @@ def get_tls_requires(cursor, user, host):
         return requires or None
 
 
+def get_valid_privs(cursor):
+    cursor.execute("SHOW PRIVILEGES")
+    show_privs = [priv[0].upper() for priv in cursor.fetchall()]
+    all_privs = show_privs + EXTRA_PRIVS
+    return frozenset(all_privs)
+
+
 def get_grants(cursor, user, host):
     cursor.execute("SHOW GRANTS FOR %s@%s", (user, host))
     grants_line = list(filter(lambda x: "ON *.*" in x[0], cursor.fetchall()))[0]
@@ -583,7 +556,7 @@ def sort_column_order(statement):
     return '%s(%s)' % (priv_name, ', '.join(columns))
 
 
-def privileges_unpack(priv, mode):
+def privileges_unpack(priv, mode, valid_privs):
     """ Take a privileges string, typically passed as a parameter, and unserialize
     it into a dictionary, the same format as privileges_get() above. We have this
     custom format to avoid using YAML/JSON strings inside YAML playbooks. Example
@@ -630,8 +603,8 @@ def privileges_unpack(priv, mode):
         output[pieces[0]] = normalize_col_grants(output[pieces[0]])
 
         new_privs = frozenset(privs)
-        if not new_privs.issubset(VALID_PRIVS):
-            raise InvalidPrivsError('Invalid privileges specified: %s' % new_privs.difference(VALID_PRIVS))
+        if not new_privs.issubset(valid_privs):
+            raise InvalidPrivsError('Invalid privileges specified: %s' % new_privs.difference(valid_privs))
 
     if '*.*' not in output:
         output['*.*'] = ['USAGE']
@@ -859,8 +832,8 @@ def get_impl(cursor):
     global impl
     cursor.execute("SELECT VERSION()")
     if 'mariadb' in cursor.fetchone()[0].lower():
-        from ansible_collections.community.mysql.plugins.module_utils.implementations.mariadb import user as mysqluser
-        impl = mysqluser
-    else:
-        from ansible_collections.community.mysql.plugins.module_utils.implementations.mysql import user as mariauser
+        from ansible_collections.community.mysql.plugins.module_utils.implementations.mariadb import user as mariauser
         impl = mariauser
+    else:
+        from ansible_collections.community.mysql.plugins.module_utils.implementations.mysql import user as mysqluser
+        impl = mysqluser
diff --git a/plugins/modules/mysql_role.py b/plugins/modules/mysql_role.py
@@ -250,6 +250,7 @@
     get_mode,
     user_mod,
     privileges_grant,
+    get_valid_privs,
     privileges_unpack,
 )
 from ansible.module_utils._text import to_native
@@ -1013,7 +1014,8 @@ def main():
             module.fail_json(msg=to_native(e))
 
         try:
-            priv = privileges_unpack(priv, mode)
+            valid_privs = get_valid_privs(cursor)
+            priv = privileges_unpack(priv, mode, valid_privs)
         except Exception as e:
             module.fail_json(msg='Invalid privileges string: %s' % to_native(e))
 

diff --git a/plugins/modules/mysql_user.py b/plugins/modules/mysql_user.py
@@ -318,6 +318,7 @@
     handle_requiressl_in_priv_string,
     InvalidPrivsError,
     limit_resources,
+    get_valid_privs,
     privileges_unpack,
     sanitize_requires,
     user_add,
@@ -421,7 +422,8 @@ def main():
         except Exception as e:
             module.fail_json(msg=to_native(e))
         try:
-            priv = privileges_unpack(priv, mode)
+            valid_privs = get_valid_privs(cursor)
+            priv = privileges_unpack(priv, mode, valid_privs)
         except Exception as e:
             module.fail_json(msg="invalid privileges string: %s" % to_native(e))
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		minor_changes:
		- mysql_user - replace VALID_PRIVS constant by get_valid_privs() function (https://github.com/ansible-collections/community.mysql/pull/217).