You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-dev@db.apache.org by "Mamta A. Satoor (JIRA)" <de...@db.apache.org> on 2006/08/04 04:52:13 UTC
[jira] Created: (DERBY-1643) As per the functional spec attached to
DERBY-1330, a "revoke execute ... restrict" should fail if there are
dependent objects on the execute privilege
As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
------------------------------------------------------------------------------------------------------------------------------------------------------
Key: DERBY-1643
URL: http://issues.apache.org/jira/browse/DERBY-1643
Project: Derby
Issue Type: New Feature
Components: SQL
Affects Versions: 10.2.0.0
Reporter: Mamta A. Satoor
Assigned To: Mamta A. Satoor
As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-1643) As per the functional spec attached to
DERBY-1330, a "revoke execute ... restrict" should fail if there are
dependent objects on the execute privilege
Posted by "Mamta A. Satoor (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-1643?page=all ]
Mamta A. Satoor updated DERBY-1643:
-----------------------------------
Attachment: DERBY1643_diff_V2_RevokeExecutePrivilege.txt
DERBY1643_stat_V2_RevokeExecutePrivilege.txt
Dan, I have attached a patch (DERBY1643_diff_V2_RevokeExecutePrivilege.txt) which renames the constant for revoke restrict invalidation action. The svn stat -q o/p is attached as DERBY1643_stat_V2_RevokeExecutePrivilege.txt.
I only ran the 2 grant revoke tests since nothing else should get impacted by this change (or so I think:)
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> ------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-1643
> URL: http://issues.apache.org/jira/browse/DERBY-1643
> Project: Derby
> Issue Type: New Feature
> Components: SQL
> Affects Versions: 10.2.0.0
> Reporter: Mamta A. Satoor
> Assigned To: Mamta A. Satoor
> Attachments: DERBY1643_diff_V1_RevokeExecutePrivilege.txt, DERBY1643_diff_V2_RevokeExecutePrivilege.txt, DERBY1643_stat_V1_RevokeExecutePrivilege.txt, DERBY1643_stat_V2_RevokeExecutePrivilege.txt
>
>
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
> I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-1643) As per the functional spec attached to
DERBY-1330, a "revoke execute ... restrict" should fail if there are
dependent objects on the execute privilege
Posted by "Mamta A. Satoor (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-1643?page=all ]
Mamta A. Satoor updated DERBY-1643:
-----------------------------------
Attachment: DERBY1643_diff_V1_RevokeExecutePrivilege.txt
DERBY1643_stat_V1_RevokeExecutePrivilege.txt
Here is the next incremental patch(DERBY1643_diff_V1_RevokeExecutePrivilege.txt) for revoke privileges related to routines. The o/p of svn stat -q is attached as DERBY1643_stat_V1_RevokeExecutePrivilege.txt. Also, derbyall ran fine with Sun's jdk 1.4 on Windows XP platform.
In Derby, the execute permission on a routine can't be revoked as long as there are dependent objects relying on that permissions. This patch implements that behavior by adding a new revoke invalidation action REVOKE_EXECUTE_PRIVILEGE, just for routine revoke. This invalidation gets sent when a revoke execute is issued. When dependents, a ViewDescriptor and/or a TriggerDescriptor, get this invalidation action, they will raise error that revoke execute can't be performed because there is a dependent object on that permission.
In general, there can be 3 kind of persistent dependents on a permission. They are namely, a ViewDescriptor, a TriggerDescriptor, and a ConstraintDescriptor. But in Derby, a constraint can't use a routine and hence a constraint can't possibly depend on execute privilege. If ever, for some unknown reason(bug), a ConstraintDescriptor will receive REVOKE_EXECUTE_PRIVILEGE, Derby will end up throwing an exception saying that revoke execute can't be performed because there is a dependent object on it.
Test changes
1)Have a view depend on the execute routine privilege. "Revoke execute ... restrict" will fail as long as the view exists. Once the view is dropped, since there are no more dependents on execute routine privilege, "Revoke execute ... restrict" will pass.
2)Similar test for trigger. If trigger is relying on a execute routine privilege, then that privilege can't be revoked as long as trigger is still around. After the trigger is dropped, execute routine privilege can be revoked.
3)In addition, I added a test which is not directly related to revoke routine work. Just an additional test for grant revoke. In this test, I have couple triggers on a single table depend on different privileges. When a privilege is revoked, only the
affected triggers get dropped, the rest of the triggers should remain still active.
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> ------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-1643
> URL: http://issues.apache.org/jira/browse/DERBY-1643
> Project: Derby
> Issue Type: New Feature
> Components: SQL
> Affects Versions: 10.2.0.0
> Reporter: Mamta A. Satoor
> Assigned To: Mamta A. Satoor
> Attachments: DERBY1643_diff_V1_RevokeExecutePrivilege.txt, DERBY1643_stat_V1_RevokeExecutePrivilege.txt
>
>
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
> I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Commented: (DERBY-1643) As per the functional spec attached
to DERBY-1330, a "revoke execute ... restrict" should fail if there are
dependent objects on the execute privilege
Posted by "Daniel John Debrunner (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-1643?page=comments#action_12425913 ]
Daniel John Debrunner commented on DERBY-1643:
----------------------------------------------
I committed the patch but believe there should be a follow up. The new constant defined for the revoke invalidation is REVOKE_EXECUTE_PRIVILEGE, but I think it's factored in the wrong dimension. I think the behaviour being implemented is revoke restrict, and thus the constant should be: REVOKE_PRIVILEGE_RESTRICT.
Probably good to change this early rather than having some REVOKE constants meaning cascade and some restrict but no consistent naming.
I would have made a simple name change in Eclipse, but the comments around REVOKE_EXECUTE_PRIVILEGE wouldn't apply to the new name so it's a little more involved. Also with the REVOKE_PRIVILEGE_RESTRICT the descriptors could be modified to throw the exception even if today they don't support routines (eg. constraints) would make the code "self-healing" when check constraints support function calls.
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> ------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-1643
> URL: http://issues.apache.org/jira/browse/DERBY-1643
> Project: Derby
> Issue Type: New Feature
> Components: SQL
> Affects Versions: 10.2.0.0
> Reporter: Mamta A. Satoor
> Assigned To: Mamta A. Satoor
> Attachments: DERBY1643_diff_V1_RevokeExecutePrivilege.txt, DERBY1643_stat_V1_RevokeExecutePrivilege.txt
>
>
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
> I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-1643) As per the functional spec attached to
DERBY-1330, a "revoke execute ... restrict" should fail if there are
dependent objects on the execute privilege
Posted by "Mamta A. Satoor (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-1643?page=all ]
Mamta A. Satoor updated DERBY-1643:
-----------------------------------
Derby Info: [Patch Available]
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> ------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-1643
> URL: http://issues.apache.org/jira/browse/DERBY-1643
> Project: Derby
> Issue Type: New Feature
> Components: SQL
> Affects Versions: 10.2.0.0
> Reporter: Mamta A. Satoor
> Assigned To: Mamta A. Satoor
> Attachments: DERBY1643_diff_V1_RevokeExecutePrivilege.txt, DERBY1643_diff_V2_RevokeExecutePrivilege.txt, DERBY1643_stat_V1_RevokeExecutePrivilege.txt, DERBY1643_stat_V2_RevokeExecutePrivilege.txt
>
>
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
> I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-1643) As per the functional spec attached to
DERBY-1330, a "revoke execute ... restrict" should fail if there are
dependent objects on the execute privilege
Posted by "Daniel John Debrunner (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-1643?page=all ]
Daniel John Debrunner updated DERBY-1643:
-----------------------------------------
Derby Info: (was: [Patch Available])
Patch committed revision 428930. Thanks Mamta
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> ------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-1643
> URL: http://issues.apache.org/jira/browse/DERBY-1643
> Project: Derby
> Issue Type: New Feature
> Components: SQL
> Affects Versions: 10.2.0.0
> Reporter: Mamta A. Satoor
> Assigned To: Mamta A. Satoor
> Attachments: DERBY1643_diff_V1_RevokeExecutePrivilege.txt, DERBY1643_stat_V1_RevokeExecutePrivilege.txt
>
>
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
> I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-1643) A "revoke execute ... restrict"
should fail if there are dependent objects on the execute privilege
Posted by "Daniel John Debrunner (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-1643?page=all ]
Daniel John Debrunner updated DERBY-1643:
-----------------------------------------
Derby Info: (was: [Patch Available])
DERBY1643_diff_V2_RevokeExecutePrivilege.txt patch was applied on 8/9 - thanks Mamta
> A "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> ----------------------------------------------------------------------------------------------------
>
> Key: DERBY-1643
> URL: http://issues.apache.org/jira/browse/DERBY-1643
> Project: Derby
> Issue Type: New Feature
> Components: SQL
> Affects Versions: 10.2.1.0
> Reporter: Mamta A. Satoor
> Assigned To: Mamta A. Satoor
> Attachments: DERBY1643_diff_V1_RevokeExecutePrivilege.txt, DERBY1643_diff_V2_RevokeExecutePrivilege.txt, DERBY1643_stat_V1_RevokeExecutePrivilege.txt, DERBY1643_stat_V2_RevokeExecutePrivilege.txt
>
>
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
> I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
> See the functional spec attached to DERBY-1330
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Closed: (DERBY-1643) A "revoke execute ... restrict" should
fail if there are dependent objects on the execute privilege
Posted by "Mamta A. Satoor (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-1643?page=all ]
Mamta A. Satoor closed DERBY-1643.
----------------------------------
Fix Version/s: 10.2.1.0
Resolution: Fixed
Closing this issue since I am finished with the work targeted for 10.2 release. The remaining work for this issue is getting tracked in DERBY-1632. I will link the 2 issues so we can keep track of the correlation between the 2 jira entries.
> A "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> ----------------------------------------------------------------------------------------------------
>
> Key: DERBY-1643
> URL: http://issues.apache.org/jira/browse/DERBY-1643
> Project: Derby
> Issue Type: New Feature
> Components: SQL
> Affects Versions: 10.2.1.0
> Reporter: Mamta A. Satoor
> Assigned To: Mamta A. Satoor
> Fix For: 10.2.1.0
>
> Attachments: DERBY1643_diff_V1_RevokeExecutePrivilege.txt, DERBY1643_diff_V2_RevokeExecutePrivilege.txt, DERBY1643_stat_V1_RevokeExecutePrivilege.txt, DERBY1643_stat_V2_RevokeExecutePrivilege.txt
>
>
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
> I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
> See the functional spec attached to DERBY-1330
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-1643) As per the functional spec attached to
DERBY-1330, a "revoke execute ... restrict" should fail if there are
dependent objects on the execute privilege
Posted by "Mamta A. Satoor (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-1643?page=all ]
Mamta A. Satoor updated DERBY-1643:
-----------------------------------
Derby Info: [Patch Available]
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> ------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-1643
> URL: http://issues.apache.org/jira/browse/DERBY-1643
> Project: Derby
> Issue Type: New Feature
> Components: SQL
> Affects Versions: 10.2.0.0
> Reporter: Mamta A. Satoor
> Assigned To: Mamta A. Satoor
> Attachments: DERBY1643_diff_V1_RevokeExecutePrivilege.txt, DERBY1643_stat_V1_RevokeExecutePrivilege.txt
>
>
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
> I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-1643) A "revoke execute ... restrict"
should fail if there are dependent objects on the execute privilege
Posted by "Daniel John Debrunner (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-1643?page=all ]
Daniel John Debrunner updated DERBY-1643:
-----------------------------------------
Summary: A "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege (was: As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege)
Description:
As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
See the functional spec attached to DERBY-1330
was:
As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
Cleaning the summary
> A "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> ----------------------------------------------------------------------------------------------------
>
> Key: DERBY-1643
> URL: http://issues.apache.org/jira/browse/DERBY-1643
> Project: Derby
> Issue Type: New Feature
> Components: SQL
> Affects Versions: 10.2.0.0
> Reporter: Mamta A. Satoor
> Assigned To: Mamta A. Satoor
> Attachments: DERBY1643_diff_V1_RevokeExecutePrivilege.txt, DERBY1643_diff_V2_RevokeExecutePrivilege.txt, DERBY1643_stat_V1_RevokeExecutePrivilege.txt, DERBY1643_stat_V2_RevokeExecutePrivilege.txt
>
>
> As per the functional spec attached to DERBY-1330, a "revoke execute ... restrict" should fail if there are dependent objects on the execute privilege
> In order to implement this, when revoke execute is executed, a special invalidation action should be sent and dependent objects will need to catch that invalidation and throw an exception. If there are no dependents, then no exception will be thrown and revoke execute will succeed.
> I am just creating a new jira entry here so it is easier to track sub items of DERBY-1330. Will link this Jira entry to DERBY-1330.
> See the functional spec attached to DERBY-1330
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira