xuans/Scert
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

提取MySQL对象可见权限检查并保持事件校验行为

Browse Source 
仅提交可独立验证的权限检查重构；其余视图备份与权限矩阵改动尚未完成，留在工作区，不包含于本提交。

在基于3cc6a7a的独立工作区仅应用本文件后验证：MySQL 5.7权限专项23个叶子用例通过，MySQL 8.0权限专项37个叶子用例通过，均无失败或跳过；CLI常规测试、go vet、go mod verify通过。

全量回归未全部通过：未改动的localreset包TestWindowsRejectsNonElevatedPeer在并行全量执行时超时，单独重跑通过。保留该异常，不将本提交视为全量或生产验收通过。
This commit is contained in:
xuans 2026-09-27 23:51:04 +08:00
parent 3cc6a7ac35
commit a8f4a54723
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
backend/internal/cli/mysql_privileges.go
View File

@ -89,6 +89,11 @@ func requireMySQLTableTriggerGrants(ctx context.Context, tx *sql.Tx, name string
}
func requireMySQLEventVisibility(ctx context.Context, tx *sql.Tx) error {
// EVENT 只有全局或库级授权，不能用某一张表的权限证明完整事件列表可见。
return requireMySQLObjectVisibility(ctx, tx, nil, "EVENT", true)
}
func requireMySQLObjectVisibility(ctx context.Context, tx *sql.Tx, objects []string, privilege string, schemaOnly bool) error {
var name, version string
var lowerCaseNames int
if err := tx.QueryRowContext(ctx, "SELECT DATABASE(), VERSION(), @@lower_case_table_names").Scan(&name, &version, &lowerCaseNames); err != nil {
@ -104,8 +109,10 @@ func requireMySQLEventVisibility(ctx context.Context, tx *sql.Tx) error {
}
return value
}
// EVENT 只有全局或库级授权，不能用某一张表的权限证明完整事件列表可见。
return requireMySQLObjectGrants(ctx, tx, normalize(name), []string{name}, grants, normalize, "EVENT", true)
if schemaOnly {
objects = []string{name}
}
return requireMySQLObjectGrants(ctx, tx, normalize(name), objects, grants, normalize, privilege, schemaOnly)
}
func requireMySQLObjectGrants(ctx context.Context, tx *sql.Tx, name string, objects, grants []string, normalize func(string) string, privilege string, schemaOnly bool) error {