转授权

chusql-core/engine/src/ChuSQL/Core/Engine/Semantic.hs

@@ -415,7 +415,7 @@ checkResolvedWith db outer q = case q of
     DropUser name -> checkUserName name
     CreateRole name -> checkRoleName name
     DropRole name -> checkRoleName name
-    GrantPrivileges privs obj role -> do
+    GrantPrivileges privs obj role _ -> do
         mapM_ checkPrivilege privs
         checkGrantObject obj
         checkRoleName role

chusql-core/engine/src/ChuSQL/Core/Engine/Syntax/AST.hs

@@ -41,8 +41,8 @@ data Statement
     | CreateRole String
     -- | 删角色：连同它的授权与成员一起删
     | DropRole String
-    -- | GRANT 权限 ON 表 TO 角色
-    | GrantPrivileges [String] String String
+    -- | GRANT 权限 ON 表 TO 角色，末位表示带 WITH GRANT OPTION
+    | GrantPrivileges [String] String String Bool
     -- | REVOKE 权限 ON 表 FROM 角色
     | RevokePrivileges [String] String String
     -- | GRANT 角色 TO 用户：给用户加角色

chusql-core/engine/src/ChuSQL/Core/Engine/Syntax/Parser.hs

@@ -464,6 +464,10 @@ privilegeName =
 grantObject :: Parser String
 grantObject = ("*" <$ symbol "*") <|> tableName
 
+-- | 可选的 WITH GRANT OPTION
+grantOption :: Parser Bool
+grantOption = (True <$ try (keyword "with" *> keyword "grant" *> keyword "option")) <|> pure False
+
 -- | 读 GRANT：带 ON 的授权限，不带的加角色
 grantStatement :: Parser Statement
 grantStatement = do
@@ -474,7 +478,7 @@ grantStatement = do
             keyword "on"
             obj <- grantObject
             keyword "to"
-            GrantPrivileges privs obj <$> userName
+            GrantPrivileges privs obj <$> userName <*> grantOption
         , GrantRole <$> userName <*> (keyword "to" *> sepBy1 userName (symbol ","))
         ]
 

chusql-core/engine/test/Spec.hs

@@ -683,13 +683,21 @@ main = hspec $ do
 
         it "parses privilege grants on one table, on another database's table or on everything" $ do
             parseStatement "GRANT SELECT ON users TO analyst"
-                `shouldBe` Right (GrantPrivileges ["SELECT"] "users" "analyst")
+                `shouldBe` Right (GrantPrivileges ["SELECT"] "users" "analyst" False)
             parseStatement "grant select, insert on users to analyst"
-                `shouldBe` Right (GrantPrivileges ["SELECT", "INSERT"] "users" "analyst")
+                `shouldBe` Right (GrantPrivileges ["SELECT", "INSERT"] "users" "analyst" False)
             parseStatement "GRANT ALL ON sales.orders TO analyst"
-                `shouldBe` Right (GrantPrivileges ["ALL"] "sales.orders" "analyst")
+                `shouldBe` Right (GrantPrivileges ["ALL"] "sales.orders" "analyst" False)
             parseStatement "GRANT DELETE ON * TO analyst"
-                `shouldBe` Right (GrantPrivileges ["DELETE"] "*" "analyst")
+                `shouldBe` Right (GrantPrivileges ["DELETE"] "*" "analyst" False)
+
+        it "parses WITH GRANT OPTION on a privilege grant" $ do
+            parseStatement "GRANT SELECT ON users TO analyst WITH GRANT OPTION"
+                `shouldBe` Right (GrantPrivileges ["SELECT"] "users" "analyst" True)
+            parseStatement "grant select, insert on * to analyst with grant option"
+                `shouldBe` Right (GrantPrivileges ["SELECT", "INSERT"] "*" "analyst" True)
+            parseStatement "GRANT SELECT ON users TO analyst WITH"
+                `shouldSatisfy` isLeft
 
         it "parses REVOKE symmetrically" $ do
             parseStatement "REVOKE SELECT ON users FROM analyst"
@@ -717,7 +725,9 @@ main = hspec $ do
             (parseStatement "CREATE ROLE select" >>= prepare testDB) `shouldSatisfy` isLeft
             (parseStatement "DROP ROLE insert" >>= prepare testDB) `shouldSatisfy` isLeft
             (parseStatement "GRANT SELECT ON users TO analyst" >>= prepare testDB)
-                `shouldBe` Right (GrantPrivileges ["SELECT"] "users" "analyst")
+                `shouldBe` Right (GrantPrivileges ["SELECT"] "users" "analyst" False)
+            (parseStatement "GRANT SELECT ON users TO analyst WITH GRANT OPTION" >>= prepare testDB)
+                `shouldBe` Right (GrantPrivileges ["SELECT"] "users" "analyst" True)
             (parseStatement "GRANT SELECT ON users TO select" >>= prepare testDB) `shouldSatisfy` isLeft
             (parseStatement "REVOKE SELECT ON users FROM analyst" >>= prepare testDB)
                 `shouldBe` Right (RevokePrivileges ["SELECT"] "users" "analyst")