Skip to content

Commit e936087

Browse files
denikdenik
authored
direct: grants: Fix "Duplicate privileges" error and drift on duplicates (#4801)
## Changes - Fix grants implementation to correctly handle the case when ALL_PRIVILEGES is passed. Previously it would send ALL_PRIVILEGES both in Add and Remove sections and that would result in 400 / INVALID_PARAMETER_VALUE/ Duplicate privileges to add and delete for principal. - Deduplicate privileges and principals in general. Previously we would send it as is, the backend will deduplicate, causing drift in the plan. ## Tests New acceptance (cloud+local) tests for the above cases. Updated testservers to error like the cloud.
1 parent 2beb9a7 commit e936087

30 files changed

Lines changed: 463 additions & 8 deletions

‎NEXT_CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@
88

99
### Bundles
1010
* engine/direct: Fix drift in grants resource due to privilege reordering ([#4794](https://github.com/databricks/cli/pull/4794))
11+
* engine/direct: Fix 400 error when deploying grants with ALL_PRIVILEGES ([#4801](https://github.com/databricks/cli/pull/4801))
12+
* Deduplicate grant entries with duplicate principals or privileges during initialization ([#4801](https://github.com/databricks/cli/pull/4801))
1113

1214
### Dependency updates
1315

‎acceptance/bundle/resources/grants/schemas/all_privileges/databricks.yml.tmpl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
bundle:
2+
name: schema-dup-grants-$UNIQUE_NAME
3+
4+
resources:
5+
schemas:
6+
apps_schema:
7+
name: schema_dup_grants_$UNIQUE_NAME
8+
catalog_name: main
9+
grants:
10+
- principal: deco-test-user@databricks.com
11+
privileges:
12+
- ALL_PRIVILEGES

‎acceptance/bundle/resources/grants/schemas/all_privileges/out.requests.direct.txt‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"method": "PATCH",
3+
"path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]",
4+
"body": {
5+
"changes": [
6+
{
7+
"add": [
8+
"ALL_PRIVILEGES"
9+
],
10+
"principal": "deco-test-user@databricks.com"
11+
}
12+
]
13+
}
14+
}

‎acceptance/bundle/resources/grants/schemas/all_privileges/out.requests.terraform.txt‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"method": "GET",
3+
"path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
4+
}
5+
{
6+
"method": "PATCH",
7+
"path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]",
8+
"body": {
9+
"changes": [
10+
{
11+
"add": [
12+
"ALL_PRIVILEGES"
13+
],
14+
"principal": "deco-test-user@databricks.com"
15+
}
16+
]
17+
}
18+
}
19+
{
20+
"method": "GET",
21+
"path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
22+
}
23+
{
24+
"method": "GET",
25+
"path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
26+
}

‎acceptance/bundle/resources/grants/schemas/all_privileges/out.test.toml‎

Lines changed: 6 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎acceptance/bundle/resources/grants/schemas/all_privileges/output.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-dup-grants-[UNIQUE_NAME]/default/files...
2+
Deploying resources...
3+
Updating deployment state...
4+
Deployment complete!
5+
6+
>>> [CLI] bundle destroy --auto-approve
7+
The following resources will be deleted:
8+
delete resources.schemas.apps_schema
9+
10+
This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
11+
delete resources.schemas.apps_schema
12+
13+
All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-dup-grants-[UNIQUE_NAME]/default
14+
15+
Deleting files...
16+
Destroy complete!

‎acceptance/bundle/resources/grants/schemas/all_privileges/script‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
envsubst < databricks.yml.tmpl > databricks.yml
2+
3+
cleanup() {
4+
trace $CLI bundle destroy --auto-approve
5+
rm -f out.requests.txt
6+
}
7+
trap cleanup EXIT
8+
9+
# The direct engine puts ALL_PRIVILEGES in both the Add and Remove lists in the PATCH request,
10+
# which the backend rejects with "Duplicate privileges to add and delete".
11+
$CLI bundle deploy
12+
print_requests.py --get //permissions --keep > out.requests.$DATABRICKS_BUNDLE_ENGINE.txt

‎acceptance/bundle/resources/grants/schemas/all_privileges/test.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
RecordRequests = true

‎acceptance/bundle/resources/grants/schemas/duplicate_principals/databricks.yml.tmpl‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
bundle:
2+
name: schema-dup-grants-$UNIQUE_NAME
3+
4+
resources:
5+
schemas:
6+
apps_schema:
7+
name: schema_dup_grants_$UNIQUE_NAME
8+
catalog_name: main
9+
grants:
10+
- principal: deco-test-user@databricks.com
11+
privileges:
12+
- CREATE_TABLE
13+
- principal: deco-test-user@databricks.com
14+
privileges:
15+
- CREATE_TABLE

‎acceptance/bundle/resources/grants/schemas/duplicate_principals/out.plan.direct.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"plan_version": 2,
3+
"cli_version": "[DEV_VERSION]",
4+
"lineage": "[UUID]",
5+
"serial": 1,
6+
"plan": {
7+
"resources.schemas.apps_schema": {
8+
"action": "skip",
9+
"remote_state": {
10+
"browse_only": false,
11+
"catalog_name": "main",
12+
"catalog_type": "MANAGED_CATALOG",
13+
"created_at": [UNIX_TIME_MILLIS][0],
14+
"created_by": "[USERNAME]",
15+
"full_name": "main.schema_dup_grants_[UNIQUE_NAME]",
16+
"name": "schema_dup_grants_[UNIQUE_NAME]",
17+
"owner": "[USERNAME]",
18+
"updated_at": [UNIX_TIME_MILLIS][0],
19+
"updated_by": "[USERNAME]"
20+
}
21+
},
22+
"resources.schemas.apps_schema.grants": {
23+
"depends_on": [
24+
{
25+
"node": "resources.schemas.apps_schema",
26+
"label": "${resources.schemas.apps_schema.id}"
27+
}
28+
],
29+
"action": "skip",
30+
"remote_state": {
31+
"securable_type": "schema",
32+
"full_name": "main.schema_dup_grants_[UNIQUE_NAME]",
33+
"__embed__": [
34+
{
35+
"principal": "deco-test-user@databricks.com",
36+
"privileges": [
37+
"CREATE_TABLE"
38+
]
39+
}
40+
]
41+
}
42+
}
43+
}
44+
}

0 commit comments

Comments
 (0)