Fix ALTER TABLE/VIEW/SEQUENCE privilege and rename documentation#23441
Closed
rafiss wants to merge 4 commits into
Closed
Fix ALTER TABLE/VIEW/SEQUENCE privilege and rename documentation#23441rafiss wants to merge 4 commits into
rafiss wants to merge 4 commits into
Conversation
rafiss
force-pushed
the
rafiss/fix-alter-sequence-privileges
branch
2 times, most recently
from
9edfdf7 to
e2e047a
Compare
Verified against running v24.3 and v26.3-dev servers and the CockroachDB
source:
- A base `ALTER SEQUENCE` (for example, changing `INCREMENT`) requires the
user to be the owner of the sequence. The pages previously claimed `CREATE`
on the parent database, which is neither sufficient nor grantable on a
sequence ("some privileges have no effect on sequences: [CREATE]").
- `ALTER SEQUENCE ... RENAME TO` requires `DROP` on the sequence and `CREATE`
on the sequence's database. `ALTER SEQUENCE ... SET SCHEMA` requires `DROP`
on the sequence and `CREATE` on the new schema. The pages previously omitted
`DROP` and pointed `SET SCHEMA` at the parent database instead of the new
schema.
Co-Authored-By: roachdev-claude <roachdev-claude-bot@cockroachlabs.com>
…EQUENCE `ALTER TABLE/VIEW/SEQUENCE ... RENAME TO` cannot move a relation to a different database; doing so errors with "cannot change database of table using alter table rename to". This has been the behavior since the `PublicSchemasWithDescriptors` migration (v22.1), confirmed on both v24.3 and v26.3-dev, so the claims were incorrect for every documented release. - ALTER SEQUENCE: removed the "Change the database of a sequence" example and reworded the `RENAME TO` parameter note. - ALTER VIEW: reworded the note that claimed rename can move a view to another database. - ALTER TABLE: removed the sentence stating the user needs `CREATE` on both source and target databases when "moving a table from one database to another". `RENAME TO` only changes the name of the relation; use `SET SCHEMA` to change the schema. Co-Authored-By: roachdev-claude <roachdev-claude-bot@cockroachlabs.com>
…chema Starting in v26.3, `ALTER TABLE/VIEW/SEQUENCE ... RENAME TO` requires the `CREATE` privilege on the relation's schema instead of on its database, matching PostgreSQL. `DROP` on the relation is still required. Mark the change with a "New in v26.3" tag on the affected pages. Refs: cockroachdb/cockroach#171478 Co-Authored-By: roachdev-claude <roachdev-claude-bot@cockroachlabs.com>
The ALTER VIEW pages stated that altering a view requires `CREATE` on the parent database, and that `SET SCHEMA` and `RENAME TO` additionally require `DROP` on the view. Verified against a running v24.3 server: - `SET SCHEMA` requires `DROP` on the view and `CREATE` on the new schema, not `CREATE` on the parent database. - `RENAME TO` requires `DROP` on the view and `CREATE` on the view's database. - The standalone "must have `CREATE` on the parent database" bullet described no single operation on its own, so it is removed. This brings the ALTER VIEW privilege model in line with ALTER TABLE and the corrected ALTER SEQUENCE pages. The v26.3 page documents the schema-scoped rename privilege separately. Co-Authored-By: roachdev-claude <roachdev-claude-bot@cockroachlabs.com>
rafiss
force-pushed
the
rafiss/fix-alter-sequence-privileges
branch
from
8b198c4 to
f3193d2
Compare
rafiss
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Corrects the required-privilege documentation for
ALTER SEQUENCE,ALTER VIEW, andALTER TABLE, and removes incorrect cross-database rename claims. All behavior verified against running v24.3 and v26.3-dev servers and the CockroachDB source.Commits
Fix ALTER SEQUENCE required privileges — A base
ALTER SEQUENCErequires the user to be the owner (notCREATEon the parent database, which is not grantable on a sequence).RENAME TOrequiresDROPon the sequence +CREATEon the database;SET SCHEMArequiresDROPon the sequence +CREATEon the new schema. Previously theDROPrequirement was omitted andSET SCHEMApointed at the parent database.Remove incorrect cross-database rename claims from ALTER TABLE/VIEW/SEQUENCE —
RENAME TOcannot move a relation to a different database (errors withcannot change database of table using alter table rename to); this has held since thePublicSchemasWithDescriptorsmigration (v22.1), so the claims were wrong in every documented release. Removes the "Change the database of a sequence" example, the view note, and the table sentence about needingCREATEon both source and target databases.v26.3: ALTER TABLE/VIEW/SEQUENCE ... RENAME TO checks CREATE on the schema — In v26.3,
RENAME TOchecksCREATEon the relation's schema instead of its database, matching PostgreSQL (DROPstill required). Tagged "New in v26.3". Refs sql: ALTER ... RENAME TO checks CREATE on the database instead of the schema cockroach#171478.Fix ALTER VIEW required privileges for v23.1 through v26.2 —
SET SCHEMArequiresDROPon the view +CREATEon the new schema (not the parent database);RENAME TOrequiresDROPon the view +CREATEon the view's database. Removes the misleading standalone "CREATEon the parent database" bullet, aligning the view model with ALTER TABLE and the corrected ALTER SEQUENCE pages.