CHANGELOG.md: add release notes, Cargo.toml: bump version number

This is not a good thing to do now that we have published a stable
version.

.gitea/workflows/publish-deb.yml

@@ -31,7 +31,13 @@ jobs:
   build-deb:
     strategy:
       matrix:
-        os: [debian-trixie, debian-bookworm, ubuntu-noble, ubuntu-jammy]
+        os: [
+          debian-trixie,
+          debian-bookworm,
+          # ubuntu-resolute,
+          ubuntu-noble,
+          ubuntu-jammy,
+        ]
     name: Build and publish for ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     steps:
@@ -63,7 +69,7 @@ jobs:
       - name: Upload deb package artifact
         uses: actions/upload-artifact@v3
         with:
-          name: muscl-deb-${{ matrix.os }}-${{ gitea.sha }}.zip
+          name: muscl-deb-${{ matrix.os }}-${{ gitea.sha }}
           path: target/debian/*.deb
           if-no-files-found: error
           retention-days: 30

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v1.0.1
+
+Patch release with some important bug fixes
+
+### Notable changes
+
+- `mysql.db.Host` would usually be unset when creating privileges for users, this should be fixed now.
+  - You might have to manually set this field for rows created with the previous version of muscl to have those privileges work properly.
+- Fixed an issue where a few select server responses would refuse to serialize properly, leading to an error message: "No response from server"
+- The output of various commands is now being sorted.
+- Bump dependencies
+
 ## v1.0.0 - Initial Release
 
 This is the initial release of `muscl`.

Cargo.toml

@@ -1,12 +1,11 @@
 [package]
 name = "muscl"
-version = "0.1.0"
+version = "1.0.1"
 edition = "2024"
 resolver = "2"
 license = "BSD-3-Clause"
 authors = [
-  "oysteikt@pvv.ntnu.no",
-  "felixalb@pvv.ntnu.no",
+  "Programvareverkstedet <projects@pvv.ntnu.no>",
 ]
 homepage = "https://git.pvv.ntnu.no/Projects/muscl"
 repository = "https://git.pvv.ntnu.no/Projects/muscl"
@@ -19,50 +18,50 @@ autobins = false
 autolib = false
 
 [dependencies]
-anyhow = "1.0.100"
+anyhow = "1.0.102"
 async-bincode = "0.8.0"
 bincode = "2.0.1"
-clap = { version = "4.5.53", features = ["cargo", "derive"] }
+clap = { version = "4.6.1", features = ["cargo", "derive"] }
 clap-verbosity-flag = { version = "3.0.4", features = [ "tracing" ] }
-clap_complete = { version = "4.5.62", features = ["unstable-dynamic"] }
+clap_complete = { version = "4.6.3", features = ["unstable-dynamic"] }
 color-print = "0.3.7"
-const_format = "0.2.35"
+const_format = "0.2.36"
 derive_more = { version = "2.1.1", features = ["display", "error"] }
 dialoguer = "0.12.0"
-futures-util = "0.3.31"
+futures-util = "0.3.32"
 humansize = "2.1.3"
 indoc = "2.0.7"
 itertools = "0.14.0"
-nix = { version = "0.30.1", features = ["fs", "process", "socket", "user"] }
+nix = { version = "0.31.2", features = ["fs", "process", "socket", "user"] }
 num_cpus = "1.17.0"
 prettytable = "0.10.0"
-rand = "0.9.2"
+rand = "0.10.1"
 serde = "1.0.228"
-serde_json = { version = "1.0.146", features = ["preserve_order"] }
+serde_json = { version = "1.0.149", features = ["preserve_order"] }
 sqlx = { version = "0.8.6", features = ["runtime-tokio", "mysql", "tls-rustls"] }
-thiserror = "2.0.17"
-tokio = { version = "1.48.0", features = ["rt-multi-thread", "macros", "signal"] }
+thiserror = "2.0.18"
+tokio = { version = "1.52.1", features = ["rt-multi-thread", "macros", "signal"] }
 tokio-serde = { version = "0.9.0", features = ["bincode"] }
-tokio-stream = "0.1.17"
-tokio-util = { version = "0.7.17", features = ["codec", "rt"] }
-toml = "0.9.10"
+tokio-stream = "0.1.18"
+tokio-util = { version = "0.7.18", features = ["codec", "rt"] }
+toml = "1.1.2"
 tracing = { version = "0.1.44", features = ["log"] }
-tracing-subscriber = "0.3.22"
-uuid = { version = "1.19.0", features = ["v4"] }
+tracing-subscriber = "0.3.23"
+uuid = { version = "1.23.1", features = ["v4"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 landlock = "0.4.4"
-sd-notify = "0.4.5"
+sd-notify = "0.5.0"
 tracing-journald = "0.3.2"
 
 [build-dependencies]
-anyhow = "1.0.100"
-build-info-build = "0.0.42"
-git2 = { version = "0.20.3", default-features = false }
+anyhow = "1.0.102"
+build-info-build = "0.0.44"
+git2 = { version = "0.20.4", default-features = false }
 
 [dev-dependencies]
 pretty_assertions = "1.4.1"
-regex = "1.12.2"
+regex = "1.12.3"
 
 [features]
 default = ["mysql-admutils-compatibility"]
@@ -76,12 +75,12 @@ path = "src/lib.rs"
 [[bin]]
 name = "muscl"
 bench = false
-path = "src/entrypoints/muscl.rs"
+path = "src/bin/muscl.rs"
 
 [[bin]]
 name = "muscl-server"
 bench = false
-path = "src/entrypoints/muscl_server.rs"
+path = "src/bin/muscl_server.rs"
 
 [profile.release-lto]
 inherits = "release"

README.md

@@ -7,7 +7,7 @@ Dropping DBs (dumbbells) and having MySQL spasms since 2024
 
 ## What is this?
 
-`muscl is a secure MySQL administration tool for multi-user systems.
+`muscl` is a secure MySQL administration tool for multi-user systems.
 It allows unprivileged users to manage their own databases and database users without granting them direct access to the MySQL server.
 Authorization is handled by a prefix-based model tied to Unix users and groups, making it ideal for shared hosting environments, like university servers, tilde servers, or similar.
 
@@ -47,9 +47,19 @@ over a IPC, which then performs the requested operations on behalf of the client
 
 ## Documentation
 
-- [Installation and configuration](docs/installation.md)
+- [Installation and initial configuration](docs/installation.md)
+- [Administration and further configuration](docs/administration.md)
 - [Development and testing](docs/development.md)
 - [Compiling and packaging](docs/compiling.md)
 - [Compatibility mode with mysql-admutils](docs/mysql-admutils-compatibility.md)
 - [Use with NixOS](docs/nixos.md)
 - [SUID/SGID mode](docs/suid-sgid-mode.md)
+
+## History
+
+This is a rewrite of an older piece of software called [mysql-admutils](https://git.pvv.ntnu.no/Projects/mysql-admutils).
+Programvareverkstedet used this a lot back in the day, and it was great.
+But it had some security issues inherent to the software design, particularly related to the use of SUID/SGID.
+We tried patching it multiple times, but the issue kept popping up again in different ways.
+The rewrite was intended to iron this issue out completely by splitting the software into two pieces - a client and a server.
+As far as we know, this was successful, and it is unlikely for similar issues to resurface in the future.

assets/debian/group_denylist.txt

@@ -1,6 +1,7 @@
 # These are the default system groups on debian.
-# You can alos add groups by gid by prefixing the line with 'gid:'.
+# You can also add groups by gid by prefixing the line with 'gid:'.
 
+group:_ssh
 group:adm
 group:audio
 group:avahi
@@ -12,6 +13,7 @@ group:daemon
 group:dialout
 group:dip
 group:disk
+group:docker
 group:fax
 group:floppy
 group:games
@@ -22,9 +24,12 @@ group:kmem
 group:kvm
 group:list
 group:lp
+group:lxd
 group:mail
 group:man
+group:messagebus
 group:mlocate
+group:mysql
 group:netdev
 group:news
 group:nogroup
@@ -42,15 +47,18 @@ group:src
 group:staff
 group:sudo
 group:sys
+group:syslog
 group:systemd-journal
 group:systemd-network
 group:systemd-resolve
 group:systemd-timesync
 group:tape
+group:tcpdump
 group:tty
 group:users
 group:utmp
 group:uucp
+group:uuidd
 group:video
 group:voice
 group:www-data

assets/systemd/muscl.service

@@ -8,7 +8,9 @@ Type=notify
 ExecStart=/usr/bin/muscl-server --systemd --disable-landlock socket-activate
 ExecReload=/usr/bin/kill -HUP $MAINPID
 
-WatchdogSec=15
+WatchdogSec=3min
+Restart=always
+RestartSec=10s
 
 # Although this is a multi-instance unit, the constant `User` field is needed
 # for authentication via mysql's auth_socket plugin to work.
@@ -61,3 +63,7 @@ SystemCallFilter=@system-service
 SystemCallFilter=~@privileged @resources
 
 UMask=0777
+
+[Install]
+Also=muscl.socket
+WantedBy=multi-user.target

assets/systemd/muscl.socket

@@ -3,6 +3,7 @@ Description=Muscl MySQL admin tool
 
 [Socket]
 ListenStream=/run/muscl/muscl.sock
+RemoveOnStop=true
 Accept=no
 PassCredentials=true
 

docs/administration.md

@@ -0,0 +1,90 @@
+# Administration and further configuration
+
+This page describes some additional configuration options and administration tasks for muscl.
+
+## Configuring group denylists
+
+In `/etc/muscl/muscl.conf`, you will find an option below `[authorization]` named `group_denylist_file`,
+which points to `/etc/muscl/group_denylist.txt` by default.
+
+In this file, you can add unix group names or GIDs to disallow the groups from being used as prefixes.
+
+The deb package comes with a default denylist that disallows some common system groups.
+
+The format of the file is one group name or GID per line. Lines starting with `#` and empty lines are ignored.
+
+```
+# Disallow using the 'root' group as a prefix
+gid:0
+
+# Disallow using the 'adm' group as a prefix
+group:adm
+```
+
+> [!NOTE]
+> If a user is named the same as a disallowed group, that user will still be able to use their username as a prefix.
+
+## Configuring logging
+
+By default, muscl logs to the systemd journal when run as a systemd service,
+and also limits the log level to `info`. You can request more verbose logging
+by appending `-v` flags to the `ExecStart=` line in the systemd service file.
+
+To do this on a system where muscl was installed using a package, you can override
+the service like this:
+
+```bash
+sudo systemctl edit muscl.service
+```
+
+This will open an editor where you can add the following lines:
+
+```ini
+[Service]
+ExecStart=
+ExecStart=/usr/bin/muscl-server -v ...
+```
+
+> [!NOTE]
+> The first `ExecStart=` line is necessary to clear the previous value, as systemd
+> interprets multiple `ExecStart=` lines as a list of commands to run in sequence.
+
+You set either `-v` or `-vv` for `debug` and `trace` logging, respectively.
+
+> [!WARNING]
+> Be careful when enabling trace logging on production systems, as it might log
+> passwords and credentials in plaintext.
+
+## Querying logs in the systemd journal
+
+Although invisible if you just run `journalctl -u muscl.service`, muscl adds a set of so-called
+"fields" to its log entries to make it easier to filter and search them.
+
+Here are some examples of how you can filter logs using `journalctl`:
+
+```bash
+# Show only logs related to a specific user
+journalctl -eu muscl F_USER="<username>"
+journalctl -eu muscl F_USER=johndoe
+
+# Show only logs for a specific command types
+journalctl -eu muscl F_COMMAND="<operation>"
+journalctl -eu muscl F_COMMAND=create-db
+
+# Show logs emitted for a specific session id
+journalctl -eu muscl F_SESSION_ID="<session-id>"
+journalctl -eu muscl F_SESSION_ID=123
+
+# Show all of these fields together with the log message in a json format
+journalctl --output json-pretty --output-fields MESSAGE,F_USER,F_COMMAND,F_SESSION_ID -eu muscl
+```
+
+See [`journalctl(1)`][journalctl_1] and [`systemd.journal-fields(7)`][systemd_journal-fields_7] for more information.
+
+> [!NOTE]
+> Please note that the commands are not 1-1 mapped to muscl subcommands.
+> Rather, they are the available requests in the protocol used between the muscl client and server.
+> These requests will often have the same name as the subcommands, but this is not always the case.
+
+[journalctl_1]: https://man7.org/linux/man-pages/man1/journalctl.1.html
+[systemd_journal-fields_7]: https://man7.org/linux/man-pages/man7/systemd.journal-fields.7.html

docs/development.md

@@ -39,7 +39,12 @@ docker stop mariadb
 
 ## Development using Nix
 
-If you have nix installed, you can easily test your changes in a NixOS vm by running:
+> [!NOTE]
+> We have created some nix code to generate a QEMU VM with a setup similar to a production deployment
+> There is not necessarily any VMs running in a production setup, and if so then at least not this VM.
+> It is mainly there for easy access to interactive testing, as well as for testing the NixOS module.
+
+If you have nix installed, you can easily test your changes in a NixOS test VM by running:
 
 ```bash
 nix run .#vm # Start a NixOS VM in QEMU with muscl and MariaDB installed
@@ -47,11 +52,3 @@ nix run .#vm-mysql # Start a NixOS VM in QEMU with muscl and MySQL installed
 ```
 
 You can configure the vm in `flake.nix`
-
-## Filter logs by user with journalctl
-
-If you want to filter the server logs by user, you can use journalctl's built-in filtering capabilities.
-
-```bash
-journalctl -eu muscl F_USER=<username>
-```

docs/installation.md

@@ -1,9 +1,11 @@
-# Installation and configuration
+# Installation and initial configuration
 
 This document contains instructions for the recommended way of installing and configuring muscl.
 
 Note that there are separate instructions for [installing on NixOS](nixos.md) and [installing with SUID/SGID mode](suid-sgid-mode.md).
 
+After installation, you might want to look at the [Administration and further configuration](administration.md) page.
+
 ## Installing with deb on Debian
 
 You can install muscl by adding the [PVV apt repository][pvv-apt-repository] and installing the package:
@@ -103,28 +105,6 @@ If you are using systemd, you should also create an override to unset the `Impor
 ImportCredential=
 ```
 
-## Configuring group denylists
-
-In `/etc/muscl/muscl.conf`, you will find an option below `[authorization]` named `group_denylist_file`,
-which points to `/etc/muscl/group_denylist.txt` by default.
-
-In this file, you can add unix group names or GIDs to disallow the groups from being used as prefixes.
-
-The deb package comes with a default denylist that disallows some common system groups.
-
-The format of the file is one group name or GID per line. Lines starting with `#` and empty lines are ignored.
-
-```
-# Disallow using the 'root' group as a prefix
-gid:0
-
-# Disallow using the 'adm' group as a prefix
-group:adm
-```
-
-> [!NOTE]
-> If a user is named the same as a disallowed group, that user will still be able to use their username as a prefix.
-
 ## A note on minimum version requirements
 
 The muscl server will work with older versions of systemd, but the recommended version is 254 or newer.

docs/suid-sgid-mode.md

@@ -4,8 +4,8 @@
 > This will be deprecated in a future release, see https://git.pvv.ntnu.no/Projects/muscl/issues/101
 >
 > We do not recommend you use this mode unless you absolutely have to. The biggest reason why `muscl` was rewritten from scratch
-> was to fix an architectural issue that easily caused vulnerabilites due to reliance on SUID/SGID. Althought the architecture now
-> is more resistant against such vulnerabilites, it is not failsafe.
+> was to fix an architectural issue that easily caused vulnerabilities due to reliance on SUID/SGID. Although the architecture now
+> is more resistant against such vulnerabilities, it is not failsafe.
 
 For backwards compatibility reasons, it is possible to run the program without a daemon by utilizing SUID/SGID.
 

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1766194365,
-        "narHash": "sha256-4AFsUZ0kl6MXSm4BaQgItD0VGlEKR3iq7gIaL7TjBvc=",
+        "lastModified": 1774313767,
+        "narHash": "sha256-hy0XTQND6avzGEUFrJtYBBpFa/POiiaGBr2vpU6Y9tY=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "7d8ec2c71771937ab99790b45e6d9b93d15d9379",
+        "rev": "3d9df76e29656c679c744968b17fbaf28f0e923d",
         "type": "github"
       },
       "original": {
@@ -17,11 +17,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766309749,
-        "narHash": "sha256-3xY8CZ4rSnQ0NqGhMKAy5vgC+2IVK0NoVEzDoOh4DA4=",
+        "lastModified": 1775036866,
+        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a6531044f6d0bef691ea18d4d4ce44d0daa6e816",
+        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
         "type": "github"
       },
       "original": {
@@ -45,11 +45,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766457837,
-        "narHash": "sha256-aeBbkQ0HPFNOIsUeEsXmZHXbYq4bG8ipT9JRlCcKHgU=",
+        "lastModified": 1775099554,
+        "narHash": "sha256-3xBsGnGDLOFtnPZ1D3j2LU19wpAlYefRKTlkv648rU0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "2c7510a559416d07242621d036847152d970612b",
+        "rev": "8d6387ed6d8e6e6672fd3ed4b61b59d44b124d99",
         "type": "github"
       },
       "original": {

nix/default.nix

@@ -88,7 +88,7 @@ buildFunction ({
   '';
 
   meta = with lib; {
-    license = licenses.mit;
+    license = licenses.bsd3;
     platforms = platforms.linux ++ platforms.darwin;
     inherit mainProgram;
   };

nix/module.nix

@@ -42,9 +42,9 @@ in
 
           authorization = {
              group_denylist = lib.mkOption {
-               type = with lib.types; nullOr (listOf str);
+               type = with lib.types; nullOr (listOf (either str ints.unsigned));
                default = [ "wheel" ];
-               description = "List of groups that are denied access";
+               description = "List of groups/GIDs that can not be used as prefixes for databases/database users";
              };
           };
 
@@ -110,7 +110,32 @@ in
     ];
 
     environment.etc."muscl/group-denylist" = lib.mkIf (cfg.settings.authorization.group_denylist != [ ]) {
-      text = lib.concatMapStringsSep "\n" (group: "group:${group}") cfg.settings.authorization.group_denylist;
+      text = let
+        nameToGidMapping = lib.pipe config.users.groups [
+          (lib.filterAttrs (_: group: group.gid != null))
+          (lib.mapAttrsToList (name: group: { name = name; value = group.gid; }))
+          lib.listToAttrs
+        ];
+
+        gidToNameMapping = lib.pipe config.users.groups [
+          (lib.filterAttrs (_: group: group.gid != null))
+          (lib.mapAttrsToList (name: group: { name = toString group.gid; value = name; }))
+          lib.listToAttrs
+        ];
+      in lib.pipe cfg.settings.authorization.group_denylist [
+        # Prefer GIDs for groups we know the GID
+        (map (group: if builtins.isString group
+          then (nameToGidMapping.${group} or group)
+          else group))
+
+        # Then render back to strings
+        (map (group:
+           if builtins.isString group
+             then "group:${group}"
+             else "gid:${toString group} # ${gidToNameMapping.${toString group} or "unknown"}"))
+
+        (lib.concatStringsSep "\n")
+      ];
     };
 
     services.mysql.ensureUsers = lib.mkIf cfg.createLocalDatabaseUser [
@@ -130,15 +155,14 @@ in
     systemd.services."muscl" = {
       reloadTriggers = [ config.environment.etc."muscl/config.toml".source ];
       serviceConfig = {
+        Type = "notify-reload";
         ExecStart = [
           ""
           "${lib.getExe' cfg.package "muscl-server"} ${cfg.logLevel} --systemd --disable-landlock socket-activate"
         ];
 
-        ExecReload = [
-           ""
-           "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID"
-        ];
+        ExecReload = "";
+        ReloadSignal = "SIGHUP";
 
         RuntimeDirectory = "muscl/root-mnt";
         RuntimeDirectoryMode = "0700";

scripts/download-and-upload-debs.sh

@@ -42,7 +42,15 @@ declare -r GIT_SHA="$2"
 
 TMPDIR="$(mktemp -d)"
 
-for variant in debian-bookworm debian-trixie ubuntu-jammy ubuntu-noble; do
+declare -a OS_VARIANTS=(
+  "debian-bookworm"
+  "debian-trixie"
+  "ubuntu-jammy"
+  "ubuntu-noble"
+  # "ubuntu-resolute"
+)
+
+for variant in "${OS_VARIANTS[@]}"; do
     echo "Downloading and uploading debs for variant: $variant"
     curl "https://git.pvv.ntnu.no/Projects/muscl/actions/runs/$RUN_NUMBER/artifacts/muscl-deb-$variant-$GIT_SHA.zip" --output "$TMPDIR/muscl-deb-$variant-$GIT_SHA.zip"
 
@@ -54,11 +62,13 @@ for variant in debian-bookworm debian-trixie ubuntu-jammy ubuntu-noble; do
     DEB_VERSION=$(find "$TMPDIR/muscl-deb-$variant-$GIT_SHA"/*.deb -print0 | xargs -0 -n1 basename | cut -d'_' -f2 | head -n1)
     DEB_ARCH=$(find "$TMPDIR/muscl-deb-$variant-$GIT_SHA"/*.deb -print0 | xargs -0 -n1 basename | cut -d'_' -f3 | cut -d'.' -f1 | head -n1)
 
-    curl \
-      -X DELETE \
-      --user "$GITEA_USER:$GITEA_TOKEN" \
-      "https://git.pvv.ntnu.no/api/packages/Projects/debian/pool/$DISTRO_VERSION_NAME/main/$DEB_NAME/$DEB_VERSION/$DEB_ARCH"
+    # echo "[DELETE] https://git.pvv.ntnu.no/api/packages/Projects/debian/pool/$DISTRO_VERSION_NAME/main/$DEB_NAME/$DEB_VERSION/$DEB_ARCH"
+    # curl \
+    #   -X DELETE \
+    #   --user "$GITEA_USER:$GITEA_TOKEN" \
+    #   "https://git.pvv.ntnu.no/api/packages/Projects/debian/pool/$DISTRO_VERSION_NAME/main/$DEB_NAME/$DEB_VERSION/$DEB_ARCH"
 
+    echo "[PUT] https://git.pvv.ntnu.no/api/packages/Projects/debian/pool/$DISTRO_VERSION_NAME/main/upload"
     curl \
       -X PUT \
       --user "$GITEA_USER:$GITEA_TOKEN" \

src/bin/muscl.rs

@@ -82,9 +82,11 @@ const EXAMPLES: &str = const_format::concatcp!(
 
   # Show all databases
   muscl show-db
+  muscl sd
 
   # Show which users have privileges on which databases
   muscl show-privs
+  muscl sp
 "#,
 );
 
@@ -169,22 +171,27 @@ const EDIT_PRIVS_EXAMPLES: &str = color_print::cstr!(
 #[command(subcommand_required = true)]
 pub enum ClientCommand {
     /// Check whether you are authorized to manage the specified databases or users.
+    #[command(alias = "ca")]
     CheckAuth(CheckAuthArgs),
 
     /// Create one or more databases
+    #[command(alias = "cd")]
     CreateDb(CreateDbArgs),
 
     /// Delete one or more databases
+    #[command(alias = "dd")]
     DropDb(DropDbArgs),
 
     /// Print information about one or more databases
     ///
     /// If no database name is provided, all databases you have access will be shown.
+    #[command(alias = "sd")]
     ShowDb(ShowDbArgs),
 
     /// Print user privileges for one or more databases
     ///
     /// If no database names are provided, all databases you have access to will be shown.
+    #[command(alias = "sp")]
     ShowPrivs(ShowPrivsArgs),
 
     /// Change user privileges for one or more databases. See `edit-privs --help` for details.
@@ -239,27 +246,34 @@ pub enum ClientCommand {
         verbatim_doc_comment,
         override_usage = "muscl edit-privs [OPTIONS] [ -p <DB_NAME:USER_NAME:[+-]PRIVILEGES>... | <DB_NAME> <USER_NAME> <[+-]PRIVILEGES> ]",
         after_long_help = EDIT_PRIVS_EXAMPLES,
+        alias = "ep",
     )]
     EditPrivs(EditPrivsArgs),
 
     /// Create one or more users
+    #[command(alias = "cu")]
     CreateUser(CreateUserArgs),
 
     /// Delete one or more users
+    #[command(alias = "du")]
     DropUser(DropUserArgs),
 
     /// Change the MySQL password for a user
+    #[command(alias = "pu")]
     PasswdUser(PasswdUserArgs),
 
     /// Print information about one or more users
     ///
     /// If no username is provided, all users you have access will be shown.
+    #[command(alias = "su")]
     ShowUser(ShowUserArgs),
 
     /// Lock account for one or more users
+    #[command(alias = "lu")]
     LockUser(LockUserArgs),
 
     /// Unlock account for one or more users
+    #[command(alias = "uu")]
     UnlockUser(UnlockUserArgs),
 }
 
@@ -305,7 +319,8 @@ fn main() -> anyhow::Result<()> {
         #[cfg(not(feature = "suid-sgid-mode"))]
         None,
         args.verbose,
-    )?;
+    )
+    .context("Failed to connect to the server")?;
 
     tokio_run_command(args.command, connection)?;
 
@@ -362,7 +377,7 @@ fn handle_mysql_admutils_command() -> anyhow::Result<Option<()>> {
     }
 }
 
-/// Run the given commmand (from the client side) using Tokio.
+/// Run the given command (from the client side) using Tokio.
 fn tokio_run_command(
     command: ClientCommand,
     server_connection: StdUnixStream,

src/client/commands/create_user.rs

@@ -1,3 +1,5 @@
+use std::io::IsTerminal;
+
 use clap::Parser;
 use clap_complete::ArgValueCompleter;
 use dialoguer::Confirm;
@@ -78,6 +80,15 @@ pub async fn create_users(
             .filter_map(|(username, result)| result.as_ref().ok().map(|()| username))
             .collect::<Vec<_>>();
 
+        if !std::io::stdin().is_terminal()
+            && !args.no_password
+            && !successfully_created_users.is_empty()
+        {
+            anyhow::bail!(
+                "Cannot prompt for passwords in non-interactive mode. Use --no-password to skip setting passwords."
+            );
+        }
+
         for username in successfully_created_users {
             if !args.no_password
                 && Confirm::new()

src/client/commands/drop_db.rs

@@ -1,3 +1,5 @@
+use std::io::IsTerminal;
+
 use clap::Parser;
 use clap_complete::ArgValueCompleter;
 use dialoguer::Confirm;
@@ -41,6 +43,12 @@ pub async fn drop_databases(
         anyhow::bail!("No database names provided");
     }
 
+    if !std::io::stdin().is_terminal() && !args.yes {
+        anyhow::bail!(
+            "Cannot prompt for confirmation in non-interactive mode. Use --yes to automatically confirm."
+        );
+    }
+
     if !args.yes {
         let confirmation = Confirm::new()
             .with_prompt(format!(
@@ -53,7 +61,6 @@ pub async fn drop_databases(
             ))
             .interact()?;
 
-        //
         if !confirmation {
             // TODO: should we return with an error code here?
             println!("Aborting drop operation.");

src/client/commands/drop_user.rs

@@ -1,3 +1,5 @@
+use std::io::IsTerminal;
+
 use clap::Parser;
 use clap_complete::ArgValueCompleter;
 use dialoguer::Confirm;
@@ -41,6 +43,12 @@ pub async fn drop_users(
         anyhow::bail!("No usernames provided");
     }
 
+    if !std::io::stdin().is_terminal() && !args.yes {
+        anyhow::bail!(
+            "Cannot prompt for confirmation in non-interactive mode. Use --yes to automatically confirm."
+        );
+    }
+
     if !args.yes {
         let confirmation = Confirm::new()
             .with_prompt(format!(

src/client/commands/edit_privs.rs

@@ -1,10 +1,14 @@
-use std::collections::{BTreeMap, BTreeSet};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    io::IsTerminal,
+};
 
 use anyhow::Context;
 use clap::{Args, Parser};
 use clap_complete::ArgValueCompleter;
 use dialoguer::{Confirm, Editor};
 use futures_util::SinkExt;
+use itertools::Itertools;
 use nix::unistd::{User, getuid};
 use tokio_stream::StreamExt;
 
@@ -200,9 +204,13 @@ pub async fn edit_database_privileges(
                 }
             })
             .flatten()
+            .sorted_by_key(|row| (row.db.clone(), row.user.clone()))
             .collect::<Vec<_>>(),
         Some(Ok(Response::ListAllPrivileges(privilege_rows))) => match privilege_rows {
-            Ok(list) => list,
+            Ok(list) => list
+                .into_iter()
+                .sorted_by_key(|row| (row.db.clone(), row.user.clone()))
+                .collect(),
             Err(err) => {
                 server_connection.send(Request::Exit).await?;
                 return Err(anyhow::anyhow!(err.to_error_message())
@@ -213,6 +221,11 @@ pub async fn edit_database_privileges(
     };
 
     let diffs: BTreeSet<DatabasePrivilegesDiff> = if privs.is_empty() {
+        if !std::io::stdin().is_terminal() {
+            anyhow::bail!(
+                "Cannot launch editor in non-interactive mode. Please provide privileges via command line arguments."
+            );
+        }
         let privileges_to_change =
             edit_privileges_with_editor(&existing_privilege_rows, use_database.as_ref())?;
         diff_privileges(&existing_privilege_rows, &privileges_to_change)
@@ -275,7 +288,8 @@ pub async fn edit_database_privileges(
     println!("The following changes will be made:\n");
     println!("{}", display_privilege_diffs(&diffs));
 
-    if !args.yes
+    if std::io::stdin().is_terminal()
+        && !args.yes
         && !Confirm::new()
             .with_prompt("Do you want to apply these changes?")
             .default(false)
@@ -296,7 +310,7 @@ pub async fn edit_database_privileges(
 
     print_modify_database_privileges_output_status(&result);
 
-    if result.iter().any(|(_, res)| {
+    if result.values().flatten().any(|(_, res)| {
         matches!(
             res,
             Err(ModifyDatabasePrivilegesError::UserValidationError(
@@ -311,7 +325,7 @@ pub async fn edit_database_privileges(
 
     server_connection.send(Request::Exit).await?;
 
-    if result.values().any(std::result::Result::is_err) {
+    if result.values().flatten().any(|(_, res)| res.is_err()) {
         std::process::exit(1);
     }
 

src/client/commands/passwd_user.rs

@@ -1,4 +1,4 @@
-use std::path::PathBuf;
+use std::{io::IsTerminal, path::PathBuf};
 
 use anyhow::Context;
 use clap::Parser;
@@ -88,6 +88,11 @@ pub async fn passwd_user(
             .context("Failed to read password from stdin")?;
         buffer.trim().to_string()
     } else {
+        if !std::io::stdin().is_terminal() {
+            anyhow::bail!(
+                "Cannot prompt for password in non-interactive mode. Use --stdin or --password-file to provide the password."
+            );
+        }
         read_password_from_stdin_with_double_check(&args.username)?
     };
 

src/client/mysql_admutils_compatibility/mysql_dbadm.rs

@@ -35,7 +35,7 @@ spawn the editor stored in the $EDITOR environment variable.
 (pico will be used if the variable is unset)
 
 The file should contain one line per user, starting with the
-username and followed by ten Y/N-values seperated by whitespace.
+username and followed by ten Y/N-values separated by whitespace.
 Lines starting with # are ignored.
 
 The Y/N-values corresponds to the following mysql privileges:

src/core/bootstrap.rs

@@ -1,5 +1,6 @@
 use std::{
     fs,
+    os::unix::fs::FileTypeExt,
     path::{Path, PathBuf},
     sync::Arc,
     time::Duration,
@@ -7,7 +8,10 @@ use std::{
 
 use anyhow::{Context, anyhow};
 use clap_verbosity_flag::{InfoLevel, Verbosity};
-use nix::libc::{EXIT_SUCCESS, exit};
+use nix::{
+    libc::{EXIT_SUCCESS, exit},
+    unistd::{AccessFlags, access},
+};
 use sqlx::mysql::MySqlPoolOptions;
 use std::os::unix::net::UnixStream as StdUnixStream;
 use tokio::{net::UnixStream as TokioUnixStream, sync::RwLock};
@@ -22,7 +26,7 @@ use crate::{
         authorization::read_and_parse_group_denylist,
         config::{MysqlConfig, ServerConfig},
         landlock::landlock_restrict_server,
-        session_handler,
+        session_handler::{self, SessionId},
     },
 };
 
@@ -130,11 +134,28 @@ pub fn bootstrap_server_connection_and_drop_privileges(
     }
 }
 
+fn socket_path_is_ok(path: &Path) -> anyhow::Result<()> {
+    fs::metadata(path)
+        .context(format!("Failed to get metadata for {:?}", path))
+        .and_then(|meta| {
+            if !meta.file_type().is_socket() {
+                anyhow::bail!("{:?} is not a unix socket", path);
+            }
+
+            access(path, AccessFlags::R_OK | AccessFlags::W_OK)
+                .with_context(|| format!("Socket at {:?} is not readable/writable", path))?;
+
+            Ok(())
+        })
+}
+
 fn connect_to_external_server(
     server_socket_path: Option<PathBuf>,
 ) -> anyhow::Result<StdUnixStream> {
-    // TODO: ensure this is both readable and writable
     if let Some(socket_path) = server_socket_path {
+        tracing::trace!("Checking socket at {:?}", socket_path);
+        socket_path_is_ok(&socket_path)?;
+
         tracing::debug!("Connecting to socket at {:?}", socket_path);
         return match StdUnixStream::connect(socket_path) {
             Ok(socket) => Ok(socket),
@@ -147,6 +168,9 @@ fn connect_to_external_server(
     }
 
     if fs::metadata(DEFAULT_SOCKET_PATH).is_ok() {
+        tracing::trace!("Checking socket at {:?}", DEFAULT_SOCKET_PATH);
+        socket_path_is_ok(Path::new(DEFAULT_SOCKET_PATH))?;
+
         tracing::debug!("Connecting to default socket at {:?}", DEFAULT_SOCKET_PATH);
         return match StdUnixStream::connect(DEFAULT_SOCKET_PATH) {
             Ok(socket) => Ok(socket),
@@ -158,7 +182,9 @@ fn connect_to_external_server(
         };
     }
 
-    anyhow::bail!("No socket path provided, and no default socket found");
+    anyhow::bail!(
+        "No socket path provided, and no socket found found at default location {DEFAULT_SOCKET_PATH}"
+    );
 }
 
 // TODO: this function is security critical, it should be integration tested
@@ -308,9 +334,11 @@ fn run_forked_server(
                 version_row.to_lowercase().contains("mariadb")
             };
 
+            let session_id = SessionId::new(0);
             let db_pool = Arc::new(RwLock::new(db_pool));
             session_handler::session_handler_with_unix_user(
                 socket,
+                session_id,
                 unix_user,
                 db_pool,
                 db_is_mariadb,

src/core/common.rs

@@ -24,6 +24,7 @@ pub const KIND_REGARDS: &str = concat!(
     "If you experience any bugs or turbulence, please give us a heads up :)",
 );
 
+/// TODO: store and display UID
 #[derive(Debug, Clone)]
 pub struct UnixUser {
     pub username: String,
@@ -99,7 +100,7 @@ impl UnixUser {
         })
     }
 
-    // pub fn from_enviroment() -> anyhow::Result<Self> {
+    // pub fn from_environment() -> anyhow::Result<Self> {
     //     let libc_uid = nix::unistd::getuid();
     //     UnixUser::from_uid(libc_uid.as_raw())
     // }

src/core/database_privileges/base.rs

@@ -29,7 +29,7 @@ pub const DATABASE_PRIVILEGE_FIELDS: [&str; 13] = [
 //       doesn't have any natural implementation semantics.
 
 /// Representation of the set of privileges for a single user on a single database.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, PartialOrd, Ord)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, PartialOrd, Ord, Default)]
 pub struct DatabasePrivilegeRow {
     // TODO: don't store the db and user here, let the type be stored in a mapping
     pub db: MySQLDatabase,

src/core/protocol/commands.rs

@@ -36,11 +36,16 @@ pub use modify_privileges::*;
 pub use passwd_user::*;
 pub use unlock_users::*;
 
+use std::collections::BTreeSet;
+use std::fmt;
+
 use serde::{Deserialize, Serialize};
 use tokio::net::UnixStream;
 use tokio_serde::{Framed as SerdeFramed, formats::Bincode};
 use tokio_util::codec::{Framed, LengthDelimitedCodec};
 
+use crate::core::types::{MySQLDatabase, MySQLUser};
+
 pub type ServerToClientMessageStream = SerdeFramed<
     Framed<UnixStream, LengthDelimitedCodec>,
     Request,
@@ -104,6 +109,124 @@ pub enum Request {
     Exit,
 }
 
+impl Request {
+    /// Get the command name associated with this request.
+    pub fn command_name(&self) -> &str {
+        match self {
+            Request::CheckAuthorization(_) => "check-authorization",
+            Request::ListValidNamePrefixes => "list-valid-name-prefixes",
+            Request::CompleteDatabaseName(_) => "complete-database-name",
+            Request::CompleteUserName(_) => "complete-user-name",
+            Request::CreateDatabases(_) => "create-databases",
+            Request::DropDatabases(_) => "drop-databases",
+            Request::ListDatabases(_) => "list-databases",
+            Request::ListPrivileges(_) => "list-privileges",
+            Request::ModifyPrivileges(_) => "modify-privileges",
+            Request::CreateUsers(_) => "create-users",
+            Request::DropUsers(_) => "drop-users",
+            Request::PasswdUser(_) => "passwd-user",
+            Request::ListUsers(_) => "list-users",
+            Request::LockUsers(_) => "lock-users",
+            Request::UnlockUsers(_) => "unlock-users",
+            Request::Exit => "exit",
+        }
+    }
+
+    /// Generate a short summary string representing this request for logging purposes.
+    pub fn log_summary(&self) -> String {
+        match self {
+            Request::CheckAuthorization(req) => format!("{}({})", self.command_name(), req.len()),
+
+            Request::CreateDatabases(req) => format!("{}({})", self.command_name(), req.len()),
+            Request::DropDatabases(req) => format!("{}({})", self.command_name(), req.len()),
+            Request::ListDatabases(req) => format!(
+                "{}{}",
+                self.command_name(),
+                req.as_ref()
+                    .map_or("".to_string(), |r| format!("({})", r.len()))
+            ),
+            Request::ListPrivileges(req) => format!(
+                "{}{}",
+                self.command_name(),
+                req.as_ref()
+                    .map_or("".to_string(), |r| format!("({})", r.len()))
+            ),
+            Request::ModifyPrivileges(req) => format!("{}({})", self.command_name(), req.len()),
+
+            Request::CreateUsers(req) => format!("{}({})", self.command_name(), req.len()),
+            Request::DropUsers(req) => format!("{}({})", self.command_name(), req.len()),
+            Request::ListUsers(req) => format!(
+                "{}{}",
+                self.command_name(),
+                req.as_ref()
+                    .map_or("".to_string(), |r| format!("({})", r.len()))
+            ),
+            Request::LockUsers(req) => format!("{}({})", self.command_name(), req.len()),
+            Request::UnlockUsers(req) => format!("{}({})", self.command_name(), req.len()),
+
+            _ => self.command_name().to_string(),
+        }
+    }
+
+    /// Get the set of users affected by this request.
+    pub fn affected_users(&self) -> BTreeSet<MySQLUser> {
+        match self {
+            Request::CheckAuthorization(_) => Default::default(),
+            Request::ListValidNamePrefixes => Default::default(),
+            Request::CompleteDatabaseName(_) => Default::default(),
+            Request::CompleteUserName(_) => Default::default(),
+            Request::CreateDatabases(_) => Default::default(),
+            Request::DropDatabases(_) => Default::default(),
+            Request::ListDatabases(_) => Default::default(),
+            Request::ListPrivileges(_) => Default::default(),
+            Request::ModifyPrivileges(priv_diffs) => priv_diffs
+                .iter()
+                .map(|priv_diff| priv_diff.get_user_name().clone())
+                .collect(),
+            Request::CreateUsers(users) => users.iter().cloned().collect(),
+            Request::DropUsers(users) => users.iter().cloned().collect(),
+            Request::PasswdUser(user_passwd_req) => {
+                let mut result = BTreeSet::new();
+                result.insert(user_passwd_req.0.clone());
+                result
+            }
+            Request::ListUsers(users) => users.clone().unwrap_or_default().into_iter().collect(),
+            Request::LockUsers(users) => users.iter().cloned().collect(),
+            Request::UnlockUsers(users) => users.iter().cloned().collect(),
+            Request::Exit => Default::default(),
+        }
+    }
+
+    /// Get the set of databases affected by this request.
+    pub fn affected_databases(&self) -> BTreeSet<MySQLDatabase> {
+        match self {
+            Request::CheckAuthorization(_) => Default::default(),
+            Request::ListValidNamePrefixes => Default::default(),
+            Request::CompleteDatabaseName(_) => Default::default(),
+            Request::CompleteUserName(_) => Default::default(),
+            Request::CreateDatabases(databases) => databases.iter().cloned().collect(),
+            Request::DropDatabases(databases) => databases.iter().cloned().collect(),
+            Request::ListDatabases(databases) => {
+                databases.clone().unwrap_or_default().into_iter().collect()
+            }
+            Request::ListPrivileges(databases) => {
+                databases.clone().unwrap_or_default().into_iter().collect()
+            }
+            Request::ModifyPrivileges(priv_diffs) => priv_diffs
+                .iter()
+                .map(|priv_diff| priv_diff.get_database_name().clone())
+                .collect(),
+            Request::CreateUsers(_) => Default::default(),
+            Request::DropUsers(_) => Default::default(),
+            Request::PasswdUser(_) => Default::default(),
+            Request::ListUsers(_) => Default::default(),
+            Request::LockUsers(_) => Default::default(),
+            Request::UnlockUsers(_) => Default::default(),
+            Request::Exit => Default::default(),
+        }
+    }
+}
+
 // TODO: include a generic "message" that will display a message to the user?
 
 #[non_exhaustive]
@@ -136,3 +259,98 @@ pub enum Response {
     Ready,
     Error(String),
 }
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub enum ResponseOkStatus {
+    Success,
+    PartialSuccess(usize, usize), // succeeded, total
+    Error,
+}
+
+impl ResponseOkStatus {
+    pub fn from_counts(total: usize, succeeded: usize) -> Self {
+        if succeeded == total {
+            ResponseOkStatus::Success
+        } else if succeeded == 0 {
+            ResponseOkStatus::Error
+        } else {
+            ResponseOkStatus::PartialSuccess(succeeded, total)
+        }
+    }
+
+    pub fn from_bool(is_ok: bool) -> Self {
+        if is_ok {
+            ResponseOkStatus::Success
+        } else {
+            ResponseOkStatus::Error
+        }
+    }
+}
+
+impl fmt::Display for ResponseOkStatus {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            ResponseOkStatus::Success => write!(f, "OK"),
+            ResponseOkStatus::PartialSuccess(succeeded, total) => {
+                write!(f, "PARTIAL_OK({}/{})", succeeded, total)
+            }
+            ResponseOkStatus::Error => write!(f, "ERR"),
+        }
+    }
+}
+
+impl Response {
+    pub fn ok_status(&self) -> ResponseOkStatus {
+        match self {
+            Response::CheckAuthorization(res) => {
+                ResponseOkStatus::from_counts(res.len(), res.values().filter(|v| v.is_ok()).count())
+            }
+
+            Response::ListValidNamePrefixes(_) => ResponseOkStatus::Success,
+            Response::CompleteDatabaseName(_) => ResponseOkStatus::Success,
+            Response::CompleteUserName(_) => ResponseOkStatus::Success,
+
+            Response::CreateDatabases(res) => {
+                ResponseOkStatus::from_counts(res.len(), res.values().filter(|v| v.is_ok()).count())
+            }
+            Response::DropDatabases(res) => {
+                ResponseOkStatus::from_counts(res.len(), res.values().filter(|v| v.is_ok()).count())
+            }
+            Response::ListDatabases(res) => {
+                ResponseOkStatus::from_counts(res.len(), res.values().filter(|v| v.is_ok()).count())
+            }
+            Response::ListAllDatabases(res) => ResponseOkStatus::from_bool(res.is_ok()),
+            Response::ListPrivileges(res) => {
+                ResponseOkStatus::from_counts(res.len(), res.values().filter(|v| v.is_ok()).count())
+            }
+            Response::ListAllPrivileges(res) => ResponseOkStatus::from_bool(res.is_ok()),
+            Response::ModifyPrivileges(res) => ResponseOkStatus::from_counts(
+                res.len(),
+                res.values()
+                    .map(|user_map| user_map.values().filter(|v| v.is_ok()).count())
+                    .sum(),
+            ),
+
+            Response::CreateUsers(res) => {
+                ResponseOkStatus::from_counts(res.len(), res.values().filter(|v| v.is_ok()).count())
+            }
+            Response::DropUsers(res) => {
+                ResponseOkStatus::from_counts(res.len(), res.values().filter(|v| v.is_ok()).count())
+            }
+            Response::SetUserPassword(res) => ResponseOkStatus::from_bool(res.is_ok()),
+            Response::ListUsers(res) => {
+                ResponseOkStatus::from_counts(res.len(), res.values().filter(|v| v.is_ok()).count())
+            }
+            Response::ListAllUsers(res) => ResponseOkStatus::from_bool(res.is_ok()),
+            Response::LockUsers(res) => {
+                ResponseOkStatus::from_counts(res.len(), res.values().filter(|v| v.is_ok()).count())
+            }
+            Response::UnlockUsers(res) => {
+                ResponseOkStatus::from_counts(res.len(), res.values().filter(|v| v.is_ok()).count())
+            }
+
+            Response::Ready => ResponseOkStatus::Success,
+            Response::Error(_) => ResponseOkStatus::Error,
+        }
+    }
+}

src/core/protocol/commands/check_authorization.rs

@@ -67,3 +67,43 @@ impl CheckAuthorizationError {
         self.0.error_type()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::core::protocol::request_validation::NameValidationError;
+
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request: CheckAuthorizationRequest = vec![
+            DbOrUser::Database("test_db".into()),
+            DbOrUser::User("test_user".into()),
+        ];
+
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: CheckAuthorizationRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: CheckAuthorizationResponse = BTreeMap::from([
+            (DbOrUser::Database("test_db".into()), Ok(())),
+            (
+                DbOrUser::User("test_user".into()),
+                Err(CheckAuthorizationError(
+                    ValidationError::NameValidationError(NameValidationError::TooLong),
+                )),
+            ),
+        ]);
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: CheckAuthorizationResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/create_databases.rs

@@ -87,3 +87,41 @@ impl CreateDatabaseError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request: CreateDatabasesRequest =
+            vec!["test_db1".into(), "test_db2".into(), "test_db3".into()];
+
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: CreateDatabasesRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: CreateDatabasesResponse = BTreeMap::from([
+            ("test_db1".into(), Ok(())),
+            (
+                "test_db2".into(),
+                Err(CreateDatabaseError::DatabaseAlreadyExists),
+            ),
+            (
+                "test_db3".into(),
+                Err(CreateDatabaseError::MySqlError("Some MySQL error".into())),
+            ),
+        ]);
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: CreateDatabasesResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/create_users.rs

@@ -87,3 +87,37 @@ impl CreateUserError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request: CreateUsersRequest = vec!["alice".into(), "bob".into(), "charlie".into()];
+
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: CreateUsersRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: CreateUsersResponse = BTreeMap::from([
+            ("alice".into(), Ok(())),
+            ("bob".into(), Err(CreateUserError::UserAlreadyExists)),
+            (
+                "charlie".into(),
+                Err(CreateUserError::MySqlError("Some MySQL error".into())),
+            ),
+        ]);
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: CreateUsersResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/drop_databases.rs

@@ -90,3 +90,37 @@ impl DropDatabaseError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request: DropDatabasesRequest = vec!["db1".into(), "db2".into(), "db3".into()];
+
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: DropDatabasesRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: DropDatabasesResponse = BTreeMap::from([
+            ("db1".into(), Ok(())),
+            ("db2".into(), Err(DropDatabaseError::DatabaseDoesNotExist)),
+            (
+                "db3".into(),
+                Err(DropDatabaseError::MySqlError("Some MySQL error".into())),
+            ),
+        ]);
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: DropDatabasesResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/drop_users.rs

@@ -87,3 +87,37 @@ impl DropUserError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request: DropUsersRequest = vec!["alice".into(), "bob".into(), "charlie".into()];
+
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: DropUsersRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: DropUsersResponse = BTreeMap::from([
+            ("alice".into(), Ok(())),
+            ("bob".into(), Err(DropUserError::UserDoesNotExist)),
+            (
+                "charlie".into(),
+                Err(DropUserError::MySqlError("Some MySQL error".into())),
+            ),
+        ]);
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: DropUsersResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/list_all_databases.rs

@@ -27,3 +27,36 @@ impl ListAllDatabasesError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: ListAllDatabasesResponse = Ok(vec![
+            DatabaseRow {
+                database: "db1".into(),
+                tables: vec!["table1".into(), "table2".into()],
+                users: vec!["user1".into(), "user2".into()],
+                collation: Some("utf8mb4_general_ci".into()),
+                character_set: Some("utf8mb4".into()),
+                size_bytes: 1024,
+            },
+            DatabaseRow {
+                database: "db2".into(),
+                tables: vec!["table3".into(), "table4".into()],
+                users: vec!["user3".into(), "user4".into()],
+                collation: Some("utf8mb4_general_ci".into()),
+                character_set: Some("utf8mb4".into()),
+                size_bytes: 2048,
+            },
+        ]);
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: ListAllDatabasesResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/list_all_privileges.rs

@@ -27,3 +27,34 @@ impl ListAllPrivilegesError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: ListAllPrivilegesResponse = Ok(vec![
+            DatabasePrivilegeRow {
+                user: "user1".into(),
+                db: "db1".into(),
+                select_priv: true,
+                insert_priv: false,
+                ..Default::default()
+            },
+            DatabasePrivilegeRow {
+                user: "user2".into(),
+                db: "db2".into(),
+                select_priv: false,
+                insert_priv: true,
+                ..Default::default()
+            },
+        ]);
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: ListAllPrivilegesResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/list_all_users.rs

@@ -27,3 +27,37 @@ impl ListAllUsersError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: ListAllUsersResponse = Ok(vec![
+            DatabaseUser {
+                user: "user1".into(),
+                host: "%".into(),
+                has_password: true,
+                is_locked: false,
+                databases: vec!["db1".into(), "db2".into()],
+            },
+            DatabaseUser {
+                user: "user2".into(),
+                host: "%".into(),
+                has_password: false,
+                is_locked: true,
+                databases: vec!["db3".into()],
+            },
+        ]);
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let mut deserialized: ListAllUsersResponse = serde_json::from_str(&json).unwrap();
+        deserialized.as_mut().unwrap()[0].host = "%".into();
+        deserialized.as_mut().unwrap()[1].host = "%".into();
+
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/list_databases.rs

@@ -61,7 +61,7 @@ pub fn print_list_databases_output_status(
                 "Size"
             }
         ]);
-        for db in final_database_list {
+        for db in final_database_list.iter().sorted_by_key(|db| &db.database) {
             table.add_row(row![
                 db.database,
                 db.tables.join("\n"),
@@ -137,3 +137,44 @@ impl ListDatabasesError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request = Some(vec!["db1".into(), "db2".into()]);
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: ListDatabasesRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: ListDatabasesResponse = vec![
+            (
+                "db1".into(),
+                Ok(DatabaseRow {
+                    database: "db1".into(),
+                    tables: vec!["table1".to_string(), "table2".to_string()],
+                    users: vec!["user1".into(), "user2".into()],
+                    collation: Some("utf8mb4_general_ci".to_string()),
+                    character_set: Some("utf8mb4".to_string()),
+                    size_bytes: 1024,
+                }),
+            ),
+            ("db2".into(), Err(ListDatabasesError::DatabaseDoesNotExist)),
+        ]
+        .into_iter()
+        .collect();
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: ListDatabasesResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/list_privileges.rs

@@ -64,25 +64,28 @@ pub fn print_list_privileges_output_status(output: &ListPrivilegesResponse, long
                 .collect(),
         ));
 
-        for (_database, rows) in final_privs_map {
-            for row in &rows {
-                table.add_row(row![
-                    row.db,
-                    row.user,
-                    c->yn(row.select_priv),
-                    c->yn(row.insert_priv),
-                    c->yn(row.update_priv),
-                    c->yn(row.delete_priv),
-                    c->yn(row.create_priv),
-                    c->yn(row.drop_priv),
-                    c->yn(row.alter_priv),
-                    c->yn(row.index_priv),
-                    c->yn(row.create_tmp_table_priv),
-                    c->yn(row.lock_tables_priv),
-                    c->yn(row.references_priv),
-                ]);
-            }
+        for row in final_privs_map
+            .values()
+            .flatten()
+            .sorted_by_key(|row| (&row.db, &row.user))
+        {
+            table.add_row(row![
+                row.db,
+                row.user,
+                c->yn(row.select_priv),
+                c->yn(row.insert_priv),
+                c->yn(row.update_priv),
+                c->yn(row.delete_priv),
+                c->yn(row.create_priv),
+                c->yn(row.drop_priv),
+                c->yn(row.alter_priv),
+                c->yn(row.index_priv),
+                c->yn(row.create_tmp_table_priv),
+                c->yn(row.lock_tables_priv),
+                c->yn(row.references_priv),
+            ]);
         }
+        // }
 
         table.printstd();
     }
@@ -153,3 +156,44 @@ impl ListPrivilegesError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request: ListPrivilegesRequest = Some(vec!["test_db1".into(), "test_db2".into()]);
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: ListPrivilegesRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: ListPrivilegesResponse = BTreeMap::from([
+            (
+                "test_db1".into(),
+                Ok(vec![DatabasePrivilegeRow {
+                    db: "test_db1".into(),
+                    user: "user1".into(),
+                    select_priv: true,
+                    insert_priv: false,
+                    ..Default::default()
+                }]),
+            ),
+            (
+                "test_db2".into(),
+                Err(ListPrivilegesError::DatabaseDoesNotExist),
+            ),
+        ]);
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: ListPrivilegesResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/list_users.rs

@@ -1,5 +1,6 @@
 use std::collections::BTreeMap;
 
+use itertools::Itertools;
 use prettytable::Table;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
@@ -51,7 +52,7 @@ pub fn print_list_users_output_status(output: &ListUsersResponse) {
             "Locked",
             "Databases where user has privileges"
         ]);
-        for user in final_user_list {
+        for user in final_user_list.iter().sorted_by_key(|user| &user.user) {
             table.add_row(row![
                 user.user,
                 user.has_password,
@@ -121,3 +122,48 @@ impl ListUsersError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request: ListUsersRequest = Some(vec!["test_user1".into(), "test_user2".into()]);
+
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: ListUsersRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response_ok: ListUsersResponse = BTreeMap::from([
+            (
+                "test_user1".into(),
+                Ok(DatabaseUser {
+                    user: "test_user1".into(),
+                    host: "%".into(),
+                    has_password: true,
+                    is_locked: false,
+                    databases: vec!["db1".into(), "db2".into()],
+                }),
+            ),
+            ("test_user2".into(), Err(ListUsersError::UserDoesNotExist)),
+        ]);
+
+        let json = serde_json::to_string_pretty(&response_ok).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let mut deserialized: ListUsersResponse = serde_json::from_str(&json).unwrap();
+        deserialized
+            .get_mut(&"test_user1".into())
+            .unwrap()
+            .as_mut()
+            .unwrap()
+            .host = "%".into();
+        assert_eq!(response_ok, deserialized);
+    }
+}

src/core/protocol/commands/lock_users.rs

@@ -94,3 +94,33 @@ impl LockUserError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request: LockUsersRequest = vec!["test_user1".into(), "test_user2".into()];
+
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: LockUsersRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response_ok: LockUsersResponse = BTreeMap::from([
+            ("test_user1".into(), Ok(())),
+            ("test_user2".into(), Err(LockUserError::UserDoesNotExist)),
+        ]);
+
+        let json = serde_json::to_string_pretty(&response_ok).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: LockUsersResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response_ok, deserialized);
+    }
+}

src/core/protocol/commands/modify_privileges.rs

@@ -12,7 +12,7 @@ use crate::core::{
 pub type ModifyPrivilegesRequest = BTreeSet<DatabasePrivilegesDiff>;
 
 pub type ModifyPrivilegesResponse =
-    BTreeMap<(MySQLDatabase, MySQLUser), Result<(), ModifyDatabasePrivilegesError>>;
+    BTreeMap<MySQLDatabase, BTreeMap<MySQLUser, Result<(), ModifyDatabasePrivilegesError>>>;
 
 #[derive(Error, Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub enum ModifyDatabasePrivilegesError {
@@ -49,7 +49,11 @@ pub enum DiffDoesNotApplyError {
 }
 
 pub fn print_modify_database_privileges_output_status(output: &ModifyPrivilegesResponse) {
-    for ((database_name, username), result) in output {
+    for ((database_name, username), result) in output.iter().flat_map(|(db, user_map)| {
+        user_map
+            .iter()
+            .map(move |(user, result)| ((db, user), result))
+    }) {
         match result {
             Ok(()) => {
                 println!(
@@ -144,3 +148,46 @@ impl DiffDoesNotApplyError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::core::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request =
+            BTreeSet::from([DatabasePrivilegesDiff::Modified(DatabasePrivilegeRowDiff {
+                db: "test_db".into(),
+                user: "test_user".into(),
+                select_priv: Some(database_privileges::DatabasePrivilegeChange::NoToYes),
+                ..Default::default()
+            })]);
+
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: ModifyPrivilegesRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response: ModifyPrivilegesResponse = BTreeMap::from([(
+            "test_db".into(),
+            BTreeMap::from([
+                ("test_user".into(), Ok(())),
+                (
+                    "invalid_user".into(),
+                    Err(ModifyDatabasePrivilegesError::UserDoesNotExist),
+                ),
+            ]),
+        )]);
+
+        let json = serde_json::to_string_pretty(&response).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: ModifyPrivilegesResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response, deserialized);
+    }
+}

src/core/protocol/commands/passwd_user.rs

@@ -60,3 +60,35 @@ impl SetPasswordError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request: SetUserPasswordRequest = ("test_user".into(), "new_password".into());
+
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: SetUserPasswordRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response_ok: SetUserPasswordResponse = Ok(());
+        let response_err: SetUserPasswordResponse = Err(SetPasswordError::UserDoesNotExist);
+
+        let json_ok = serde_json::to_string_pretty(&response_ok).unwrap();
+        let json_err = serde_json::to_string_pretty(&response_err).unwrap();
+        println!("Serialized OK response:\n{}", json_ok);
+        println!("Serialized Error response:\n{}", json_err);
+
+        let deserialized_ok: SetUserPasswordResponse = serde_json::from_str(&json_ok).unwrap();
+        let deserialized_err: SetUserPasswordResponse = serde_json::from_str(&json_err).unwrap();
+        assert_eq!(response_ok, deserialized_ok);
+        assert_eq!(response_err, deserialized_err);
+    }
+}

src/core/protocol/commands/unlock_users.rs

@@ -94,3 +94,33 @@ impl UnlockUserError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_serialize_deserialize_request() {
+        let request: UnlockUsersRequest = vec!["test_user1".into(), "test_user2".into()];
+
+        let json = serde_json::to_string_pretty(&request).unwrap();
+        println!("Serialized request:\n{}", json);
+
+        let deserialized: UnlockUsersRequest = serde_json::from_str(&json).unwrap();
+        assert_eq!(request, deserialized);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_response() {
+        let response_ok: UnlockUsersResponse = BTreeMap::from([
+            ("test_user1".into(), Ok(())),
+            ("test_user2".into(), Err(UnlockUserError::UserDoesNotExist)),
+        ]);
+
+        let json = serde_json::to_string_pretty(&response_ok).unwrap();
+        println!("Serialized response:\n{}", json);
+
+        let deserialized: UnlockUsersResponse = serde_json::from_str(&json).unwrap();
+        assert_eq!(response_ok, deserialized);
+    }
+}

src/core/types.rs

@@ -34,7 +34,7 @@ impl DerefMut for MySQLUser {
 
 impl fmt::Display for MySQLUser {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{:<width$}", self.0, width = f.width().unwrap_or(0))
+        self.0.fmt(f)
     }
 }
 
@@ -83,7 +83,7 @@ impl DerefMut for MySQLDatabase {
 
 impl fmt::Display for MySQLDatabase {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{:<width$}", self.0, width = f.width().unwrap_or(0))
+        self.0.fmt(f)
     }
 }
 
@@ -105,12 +105,43 @@ impl From<MySQLDatabase> for OsString {
     }
 }
 
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub enum DbOrUser {
     Database(MySQLDatabase),
     User(MySQLUser),
 }
 
+impl Serialize for DbOrUser {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        match self {
+            DbOrUser::Database(db) => ("d:".to_string() + &db.to_string()).serialize(serializer),
+            DbOrUser::User(user) => ("u:".to_string() + &user.to_string()).serialize(serializer),
+        }
+    }
+}
+
+impl<'de> Deserialize<'de> for DbOrUser {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let s = String::deserialize(deserializer)?;
+        if let Some(rest) = s.strip_prefix("d:") {
+            Ok(DbOrUser::Database(MySQLDatabase(rest.to_string())))
+        } else if let Some(rest) = s.strip_prefix("u:") {
+            Ok(DbOrUser::User(MySQLUser(rest.to_string())))
+        } else {
+            Err(serde::de::Error::custom(format!(
+                "Invalid DbOrUser format: {}",
+                s
+            )))
+        }
+    }
+}
+
 impl DbOrUser {
     #[must_use]
     pub fn lowercased_noun(&self) -> &'static str {

src/server/authorization.rs

@@ -1,4 +1,4 @@
-use std::{collections::HashSet, path::Path};
+use std::{collections::HashSet, path::Path, str::Lines};
 
 use anyhow::Context;
 use nix::unistd::Group;
@@ -13,23 +13,19 @@ use crate::core::{
 };
 
 pub async fn check_authorization(
-    dbs_or_users: Vec<DbOrUser>,
+    dbs_or_users: &[DbOrUser],
     unix_user: &UnixUser,
     group_denylist: &GroupDenylist,
 ) -> std::collections::BTreeMap<DbOrUser, Result<(), CheckAuthorizationError>> {
-    let mut results = std::collections::BTreeMap::new();
-
-    for db_or_user in dbs_or_users {
-        if let Err(err) = validate_db_or_user_request(&db_or_user, unix_user, group_denylist)
-            .map_err(CheckAuthorizationError)
-        {
-            results.insert(db_or_user.clone(), Err(err));
-            continue;
-        }
-        results.insert(db_or_user.clone(), Ok(()));
-    }
-
-    results
+    dbs_or_users
+        .iter()
+        .cloned()
+        .map(|db_or_user| {
+            let result = validate_db_or_user_request(&db_or_user, unix_user, group_denylist)
+                .map_err(CheckAuthorizationError);
+            (db_or_user, result)
+        })
+        .collect()
 }
 
 /// Reads and parses a group denylist file, returning a set of GUIDs
@@ -45,12 +41,25 @@ pub fn read_and_parse_group_denylist(denylist_path: &Path) -> anyhow::Result<Gro
     let content = std::fs::read_to_string(denylist_path)
         .context(format!("Failed to read denylist file at {denylist_path:?}"))?;
 
-    let mut groups = HashSet::with_capacity(content.lines().count());
+    let lines = content.lines();
 
-    for (line_number, line) in content.lines().enumerate() {
-        let trimmed_line = line.trim();
+    let groups = parse_group_denylist(denylist_path, lines);
 
-        if trimmed_line.is_empty() || trimmed_line.starts_with('#') {
+    Ok(groups)
+}
+
+fn parse_group_denylist(denylist_path: &Path, lines: Lines) -> GroupDenylist {
+    let mut groups = HashSet::<u32>::new();
+
+    for (line_number, line) in lines.enumerate() {
+        let trimmed_line = if let Some(comment_start) = line.find('#') {
+            &line[..comment_start]
+        } else {
+            line
+        }
+        .trim();
+
+        if trimmed_line.is_empty() {
             continue;
         }
 
@@ -141,5 +150,32 @@ pub fn read_and_parse_group_denylist(denylist_path: &Path) -> anyhow::Result<Gro
         }
     }
 
-    Ok(groups)
+    groups
+}
+
+#[cfg(test)]
+mod tests {
+    use indoc::indoc;
+
+    use super::*;
+
+    #[test]
+    fn test_parse_group_denylist() {
+        let denylist_content = indoc! {"
+            # Valid entries
+            gid:0 # This is usually the 'root' group
+            group:root # This is also the 'root' group, should deduplicate
+
+            # Invalid entries
+            invalid_line
+            gid:not_a_number
+            group:nonexistent_group
+        "};
+
+        let lines = denylist_content.lines();
+        let group_denylist = parse_group_denylist(Path::new("test_denylist"), lines);
+
+        assert_eq!(group_denylist.len(), 1);
+        assert!(group_denylist.contains(&0));
+    }
 }

src/server/session_handler.rs

@@ -1,7 +1,8 @@
-use std::{collections::BTreeSet, sync::Arc};
+use std::sync::Arc;
 
 use futures_util::{SinkExt, StreamExt};
 use indoc::concatdoc;
+use itertools::Itertools;
 use sqlx::{MySqlConnection, MySqlPool};
 use tokio::{net::UnixStream, sync::RwLock};
 use tracing::Instrument;
@@ -34,10 +35,24 @@ use crate::{
     },
 };
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct SessionId(u64);
+
+impl SessionId {
+    pub fn new(id: u64) -> Self {
+        SessionId(id)
+    }
+
+    pub fn inner(&self) -> u64 {
+        self.0
+    }
+}
+
 // TODO: don't use database connection unless necessary.
 
 pub async fn session_handler(
     socket: UnixStream,
+    session_id: SessionId,
     db_pool: Arc<RwLock<MySqlPool>>,
     db_is_mariadb: bool,
     group_denylist: &GroupDenylist,
@@ -61,7 +76,7 @@ pub async fn session_handler(
         }
     };
 
-    tracing::debug!("Validated peer UID: {}", uid);
+    tracing::trace!("Validated peer UID: {}", uid);
 
     let unix_user = match UnixUser::from_uid(uid) {
         Ok(user) => user,
@@ -82,13 +97,18 @@ pub async fn session_handler(
         }
     };
 
-    let span = tracing::info_span!("user_session", user = %unix_user);
+    let span = tracing::info_span!(
+        "user_session",
+        session_id = session_id.inner(),
+        user = %unix_user,
+    );
 
     (async move {
-        tracing::info!("Accepted connection from user: {}", unix_user);
+        tracing::debug!("Accepted connection from user: {}", unix_user);
 
         let result = session_handler_with_unix_user(
             socket,
+            session_id,
             &unix_user,
             db_pool,
             db_is_mariadb,
@@ -96,7 +116,7 @@ pub async fn session_handler(
         )
         .await;
 
-        tracing::info!(
+        tracing::debug!(
             "Finished handling requests for connection from user: {}",
             unix_user,
         );
@@ -109,6 +129,7 @@ pub async fn session_handler(
 
 pub async fn session_handler_with_unix_user(
     socket: UnixStream,
+    session_id: SessionId,
     unix_user: &UnixUser,
     db_pool: Arc<RwLock<MySqlPool>>,
     db_is_mariadb: bool,
@@ -116,7 +137,7 @@ pub async fn session_handler_with_unix_user(
 ) -> anyhow::Result<()> {
     let mut message_stream = create_server_to_client_message_stream(socket);
 
-    tracing::debug!("Requesting database connection from pool");
+    tracing::trace!("Requesting database connection from pool");
     let mut db_connection = match db_pool.read().await.acquire().await {
         Ok(connection) => connection,
         Err(err) => {
@@ -133,10 +154,11 @@ pub async fn session_handler_with_unix_user(
             return Err(err.into());
         }
     };
-    tracing::debug!("Successfully acquired database connection from pool");
+    tracing::trace!("Successfully acquired database connection from pool");
 
     let result = session_handler_with_db_connection(
         message_stream,
+        session_id,
         unix_user,
         &mut db_connection,
         db_is_mariadb,
@@ -144,7 +166,7 @@ pub async fn session_handler_with_unix_user(
     )
     .await;
 
-    tracing::debug!("Releasing database connection back to pool");
+    tracing::trace!("Releasing database connection back to pool");
 
     result
 }
@@ -154,6 +176,7 @@ pub async fn session_handler_with_unix_user(
 
 async fn session_handler_with_db_connection(
     mut stream: ServerToClientMessageStream,
+    session_id: SessionId,
     unix_user: &UnixUser,
     db_connection: &mut MySqlConnection,
     db_is_mariadb: bool,
@@ -173,247 +196,311 @@ async fn session_handler_with_db_connection(
             }
         };
 
-        // TODO: don't clone the request
-        let request_to_display = match &request {
-            Request::PasswdUser((db_user, _)) => {
-                Request::PasswdUser((db_user.to_owned(), "<REDACTED>".to_string()))
-            }
-            request => request.to_owned(),
-        };
+        let request_span = tracing::info_span!("request", command = request.command_name());
 
-        if request_to_display == Request::Exit {
-            tracing::debug!("Received request: {:#?}", request_to_display);
-        } else {
-            tracing::info!("Received request: {:#?}", request_to_display);
+        if !handle_request(
+            request,
+            session_id,
+            unix_user,
+            db_connection,
+            db_is_mariadb,
+            group_denylist,
+            &mut stream,
+        )
+        .instrument(request_span)
+        .await?
+        {
+            break;
         }
-
-        let response = match request {
-            Request::CheckAuthorization(dbs_or_users) => {
-                let result = check_authorization(dbs_or_users, unix_user, group_denylist).await;
-                Response::CheckAuthorization(result)
-            }
-            Request::ListValidNamePrefixes => {
-                let mut result = Vec::with_capacity(unix_user.groups.len() + 1);
-                result.push(unix_user.username.clone());
-
-                for group in get_user_filtered_groups(unix_user, group_denylist) {
-                    result.push(group.clone());
-                }
-
-                Response::ListValidNamePrefixes(result)
-            }
-            Request::CompleteDatabaseName(partial_database_name) => {
-                // TODO: more correct validation here
-                if partial_database_name
-                    .chars()
-                    .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
-                {
-                    let result = complete_database_name(
-                        partial_database_name,
-                        unix_user,
-                        db_connection,
-                        db_is_mariadb,
-                        group_denylist,
-                    )
-                    .await;
-                    Response::CompleteDatabaseName(result)
-                } else {
-                    Response::CompleteDatabaseName(vec![])
-                }
-            }
-            Request::CompleteUserName(partial_user_name) => {
-                // TODO: more correct validation here
-                if partial_user_name
-                    .chars()
-                    .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
-                {
-                    let result = complete_user_name(
-                        partial_user_name,
-                        unix_user,
-                        db_connection,
-                        db_is_mariadb,
-                        group_denylist,
-                    )
-                    .await;
-                    Response::CompleteUserName(result)
-                } else {
-                    Response::CompleteUserName(vec![])
-                }
-            }
-            Request::CreateDatabases(databases_names) => {
-                let result = create_databases(
-                    databases_names,
-                    unix_user,
-                    db_connection,
-                    db_is_mariadb,
-                    group_denylist,
-                )
-                .await;
-                Response::CreateDatabases(result)
-            }
-            Request::DropDatabases(databases_names) => {
-                let result = drop_databases(
-                    databases_names,
-                    unix_user,
-                    db_connection,
-                    db_is_mariadb,
-                    group_denylist,
-                )
-                .await;
-                Response::DropDatabases(result)
-            }
-            Request::ListDatabases(database_names) => {
-                if let Some(database_names) = database_names {
-                    let result = list_databases(
-                        database_names,
-                        unix_user,
-                        db_connection,
-                        db_is_mariadb,
-                        group_denylist,
-                    )
-                    .await;
-                    Response::ListDatabases(result)
-                } else {
-                    let result = list_all_databases_for_user(
-                        unix_user,
-                        db_connection,
-                        db_is_mariadb,
-                        group_denylist,
-                    )
-                    .await;
-                    Response::ListAllDatabases(result)
-                }
-            }
-            Request::ListPrivileges(database_names) => {
-                if let Some(database_names) = database_names {
-                    let privilege_data = get_databases_privilege_data(
-                        database_names,
-                        unix_user,
-                        db_connection,
-                        db_is_mariadb,
-                        group_denylist,
-                    )
-                    .await;
-                    Response::ListPrivileges(privilege_data)
-                } else {
-                    let privilege_data = get_all_database_privileges(
-                        unix_user,
-                        db_connection,
-                        db_is_mariadb,
-                        group_denylist,
-                    )
-                    .await;
-                    Response::ListAllPrivileges(privilege_data)
-                }
-            }
-            Request::ModifyPrivileges(database_privilege_diffs) => {
-                let result = apply_privilege_diffs(
-                    BTreeSet::from_iter(database_privilege_diffs),
-                    unix_user,
-                    db_connection,
-                    db_is_mariadb,
-                    group_denylist,
-                )
-                .await;
-                Response::ModifyPrivileges(result)
-            }
-            Request::CreateUsers(db_users) => {
-                let result = create_database_users(
-                    db_users,
-                    unix_user,
-                    db_connection,
-                    db_is_mariadb,
-                    group_denylist,
-                )
-                .await;
-                Response::CreateUsers(result)
-            }
-            Request::DropUsers(db_users) => {
-                let result = drop_database_users(
-                    db_users,
-                    unix_user,
-                    db_connection,
-                    db_is_mariadb,
-                    group_denylist,
-                )
-                .await;
-                Response::DropUsers(result)
-            }
-            Request::PasswdUser((db_user, password)) => {
-                let result = set_password_for_database_user(
-                    &db_user,
-                    &password,
-                    unix_user,
-                    db_connection,
-                    db_is_mariadb,
-                    group_denylist,
-                )
-                .await;
-                Response::SetUserPassword(result)
-            }
-            Request::ListUsers(db_users) => {
-                if let Some(db_users) = db_users {
-                    let result = list_database_users(
-                        db_users,
-                        unix_user,
-                        db_connection,
-                        db_is_mariadb,
-                        group_denylist,
-                    )
-                    .await;
-                    Response::ListUsers(result)
-                } else {
-                    let result = list_all_database_users_for_unix_user(
-                        unix_user,
-                        db_connection,
-                        db_is_mariadb,
-                        group_denylist,
-                    )
-                    .await;
-                    Response::ListAllUsers(result)
-                }
-            }
-            Request::LockUsers(db_users) => {
-                let result = lock_database_users(
-                    db_users,
-                    unix_user,
-                    db_connection,
-                    db_is_mariadb,
-                    group_denylist,
-                )
-                .await;
-                Response::LockUsers(result)
-            }
-            Request::UnlockUsers(db_users) => {
-                let result = unlock_database_users(
-                    db_users,
-                    unix_user,
-                    db_connection,
-                    db_is_mariadb,
-                    group_denylist,
-                )
-                .await;
-                Response::UnlockUsers(result)
-            }
-            Request::Exit => {
-                break;
-            }
-        };
-
-        let response_to_display = match &response {
-            Response::SetUserPassword(Err(SetPasswordError::MySqlError(_))) => {
-                &Response::SetUserPassword(Err(SetPasswordError::MySqlError(
-                    "<REDACTED>".to_string(),
-                )))
-            }
-            response => response,
-        };
-        tracing::debug!("Response: {:#?}", response_to_display);
-
-        stream.send(response).await?;
-        stream.flush().await?;
-        tracing::debug!("Successfully processed request");
     }
 
     Ok(())
 }
+
+/// Handle a single request from a client.
+///
+/// If the function returns `true`, the session should continue.
+async fn handle_request(
+    request: Request,
+    session_id: SessionId,
+    unix_user: &UnixUser,
+    db_connection: &mut MySqlConnection,
+    db_is_mariadb: bool,
+    group_denylist: &GroupDenylist,
+    stream: &mut ServerToClientMessageStream,
+) -> anyhow::Result<bool> {
+    match &request {
+        Request::Exit => tracing::debug!("Request: exit"),
+        Request::PasswdUser((db_user, _)) => tracing::debug!(
+            "Request:\n{}",
+            serde_json::to_string_pretty(&Request::PasswdUser((
+                db_user.to_owned(),
+                "<REDACTED>".to_string()
+            )))?
+        ),
+        request => tracing::debug!("Request:\n{}", serde_json::to_string_pretty(request)?),
+    }
+
+    let affected_dbs = request.affected_databases();
+    if !affected_dbs.is_empty() {
+        tracing::trace!(
+            "Affected databases: {}",
+            affected_dbs.into_iter().map(|db| db.to_string()).join(", ")
+        );
+    }
+
+    let affected_users = request.affected_users();
+    if !affected_users.is_empty() {
+        tracing::trace!(
+            "Affected users: {}",
+            affected_users.into_iter().map(|u| u.to_string()).join(", "),
+        );
+    }
+
+    let response = match request {
+        Request::CheckAuthorization(ref dbs_or_users) => {
+            let result = check_authorization(dbs_or_users, unix_user, group_denylist).await;
+            Response::CheckAuthorization(result)
+        }
+        Request::ListValidNamePrefixes => {
+            let mut result = Vec::with_capacity(unix_user.groups.len() + 1);
+            result.push(unix_user.username.clone());
+
+            for group in get_user_filtered_groups(unix_user, group_denylist) {
+                result.push(group.clone());
+            }
+
+            Response::ListValidNamePrefixes(result)
+        }
+        Request::CompleteDatabaseName(ref partial_database_name) => {
+            // TODO: more correct validation here
+            if partial_database_name
+                .chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
+            {
+                let result = complete_database_name(
+                    partial_database_name,
+                    unix_user,
+                    db_connection,
+                    db_is_mariadb,
+                    group_denylist,
+                )
+                .await;
+                Response::CompleteDatabaseName(result)
+            } else {
+                Response::CompleteDatabaseName(vec![])
+            }
+        }
+        Request::CompleteUserName(ref partial_user_name) => {
+            // TODO: more correct validation here
+            if partial_user_name
+                .chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
+            {
+                let result = complete_user_name(
+                    partial_user_name,
+                    unix_user,
+                    db_connection,
+                    db_is_mariadb,
+                    group_denylist,
+                )
+                .await;
+                Response::CompleteUserName(result)
+            } else {
+                Response::CompleteUserName(vec![])
+            }
+        }
+        Request::CreateDatabases(ref databases_names) => {
+            let result = create_databases(
+                databases_names,
+                unix_user,
+                db_connection,
+                db_is_mariadb,
+                group_denylist,
+            )
+            .await;
+            Response::CreateDatabases(result)
+        }
+        Request::DropDatabases(ref databases_names) => {
+            let result = drop_databases(
+                databases_names,
+                unix_user,
+                db_connection,
+                db_is_mariadb,
+                group_denylist,
+            )
+            .await;
+            Response::DropDatabases(result)
+        }
+        Request::ListDatabases(ref database_names) => {
+            if let Some(database_names) = database_names {
+                let result = list_databases(
+                    database_names,
+                    unix_user,
+                    db_connection,
+                    db_is_mariadb,
+                    group_denylist,
+                )
+                .await;
+                Response::ListDatabases(result)
+            } else {
+                let result = list_all_databases_for_user(
+                    unix_user,
+                    db_connection,
+                    db_is_mariadb,
+                    group_denylist,
+                )
+                .await;
+                Response::ListAllDatabases(result)
+            }
+        }
+        Request::ListPrivileges(ref database_names) => {
+            if let Some(database_names) = database_names {
+                let privilege_data = get_databases_privilege_data(
+                    database_names,
+                    unix_user,
+                    db_connection,
+                    db_is_mariadb,
+                    group_denylist,
+                )
+                .await;
+                Response::ListPrivileges(privilege_data)
+            } else {
+                let privilege_data = get_all_database_privileges(
+                    unix_user,
+                    db_connection,
+                    db_is_mariadb,
+                    group_denylist,
+                )
+                .await;
+                Response::ListAllPrivileges(privilege_data)
+            }
+        }
+        Request::ModifyPrivileges(ref database_privilege_diffs) => {
+            let result = apply_privilege_diffs(
+                database_privilege_diffs,
+                unix_user,
+                db_connection,
+                db_is_mariadb,
+                group_denylist,
+            )
+            .await;
+            Response::ModifyPrivileges(result)
+        }
+        Request::CreateUsers(ref db_users) => {
+            let result = create_database_users(
+                db_users,
+                unix_user,
+                db_connection,
+                db_is_mariadb,
+                group_denylist,
+            )
+            .await;
+            Response::CreateUsers(result)
+        }
+        Request::DropUsers(ref db_users) => {
+            let result = drop_database_users(
+                db_users,
+                unix_user,
+                db_connection,
+                db_is_mariadb,
+                group_denylist,
+            )
+            .await;
+            Response::DropUsers(result)
+        }
+        Request::PasswdUser((ref db_user, ref password)) => {
+            let result = set_password_for_database_user(
+                db_user,
+                password,
+                unix_user,
+                db_connection,
+                db_is_mariadb,
+                group_denylist,
+            )
+            .await;
+            Response::SetUserPassword(result)
+        }
+        Request::ListUsers(ref db_users) => {
+            if let Some(db_users) = db_users {
+                let result = list_database_users(
+                    db_users,
+                    unix_user,
+                    db_connection,
+                    db_is_mariadb,
+                    group_denylist,
+                )
+                .await;
+                Response::ListUsers(result)
+            } else {
+                let result = list_all_database_users_for_unix_user(
+                    unix_user,
+                    db_connection,
+                    db_is_mariadb,
+                    group_denylist,
+                )
+                .await;
+                Response::ListAllUsers(result)
+            }
+        }
+        Request::LockUsers(ref db_users) => {
+            let result = lock_database_users(
+                db_users,
+                unix_user,
+                db_connection,
+                db_is_mariadb,
+                group_denylist,
+            )
+            .await;
+            Response::LockUsers(result)
+        }
+        Request::UnlockUsers(ref db_users) => {
+            let result = unlock_database_users(
+                db_users,
+                unix_user,
+                db_connection,
+                db_is_mariadb,
+                group_denylist,
+            )
+            .await;
+            Response::UnlockUsers(result)
+        }
+        Request::Exit => {
+            return Ok(false);
+        }
+    };
+
+    let response_to_display = match &response {
+        Response::SetUserPassword(Err(SetPasswordError::MySqlError(_))) => {
+            &Response::SetUserPassword(Err(SetPasswordError::MySqlError("<REDACTED>".to_string())))
+        }
+        response => response,
+    };
+    tracing::debug!(
+        "Response:\n{}",
+        serde_json::to_string_pretty(&response_to_display)?
+    );
+
+    log_request(session_id, unix_user, &request, &response);
+
+    stream.send(response).await?;
+    stream.flush().await?;
+    tracing::trace!("Successfully processed request");
+
+    Ok(true)
+}
+
+/// Log a summary of the request and its result.
+fn log_request(
+    session_id: SessionId,
+    unix_user: &UnixUser,
+    request: &Request,
+    response: &Response,
+) {
+    tracing::info!(
+        "[{}|session:{}|user:{unix_user}] {}",
+        response.ok_status(),
+        session_id.inner(),
+        request.log_summary(),
+    );
+}

src/server/sql/database_operations.rs

@@ -46,7 +46,7 @@ pub(super) async fn unsafe_database_exists(
 }
 
 pub async fn complete_database_name(
-    database_prefix: String,
+    database_prefix: &str,
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     _db_is_mariadb: bool,
@@ -87,7 +87,7 @@ pub async fn complete_database_name(
 }
 
 pub async fn create_databases(
-    database_names: Vec<MySQLDatabase>,
+    database_names: &[MySQLDatabase],
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     _db_is_mariadb: bool,
@@ -95,7 +95,7 @@ pub async fn create_databases(
 ) -> CreateDatabasesResponse {
     let mut results = BTreeMap::new();
 
-    for database_name in database_names {
+    for database_name in database_names.iter().cloned() {
         if let Err(err) = validate_db_or_user_request(
             &DbOrUser::Database(database_name.clone()),
             unix_user,
@@ -143,7 +143,7 @@ pub async fn create_databases(
 }
 
 pub async fn drop_databases(
-    database_names: Vec<MySQLDatabase>,
+    database_names: &[MySQLDatabase],
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     _db_is_mariadb: bool,
@@ -151,7 +151,7 @@ pub async fn drop_databases(
 ) -> DropDatabasesResponse {
     let mut results = BTreeMap::new();
 
-    for database_name in database_names {
+    for database_name in database_names.iter().cloned() {
         if let Err(err) = validate_db_or_user_request(
             &DbOrUser::Database(database_name.clone()),
             unix_user,
@@ -242,7 +242,7 @@ impl FromRow<'_, sqlx::mysql::MySqlRow> for DatabaseRow {
 }
 
 pub async fn list_databases(
-    database_names: Vec<MySQLDatabase>,
+    database_names: &[MySQLDatabase],
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     _db_is_mariadb: bool,
@@ -250,7 +250,7 @@ pub async fn list_databases(
 ) -> ListDatabasesResponse {
     let mut results = BTreeMap::new();
 
-    for database_name in database_names {
+    for database_name in database_names.iter().cloned() {
         if let Err(err) = validate_db_or_user_request(
             &DbOrUser::Database(database_name.clone()),
             unix_user,

src/server/sql/database_privilege_operations.rs

@@ -114,7 +114,7 @@ pub async fn unsafe_get_database_privileges_for_db_user_pair(
     connection: &mut MySqlConnection,
 ) -> Result<Option<DatabasePrivilegeRow>, sqlx::Error> {
     let result = sqlx::query_as::<_, DatabasePrivilegeRow>(&format!(
-        "SELECT {} FROM `db` WHERE `Db` = ? AND `User` = ?",
+        "SELECT {} FROM `db` WHERE `Db` = ? AND `User` = ? AND `Host` = '%'",
         DATABASE_PRIVILEGE_FIELDS
             .iter()
             .map(|field| quote_identifier(field))
@@ -138,7 +138,7 @@ pub async fn unsafe_get_database_privileges_for_db_user_pair(
 }
 
 pub async fn get_databases_privilege_data(
-    database_names: Vec<MySQLDatabase>,
+    database_names: &[MySQLDatabase],
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     _db_is_mariadb: bool,
@@ -146,19 +146,19 @@ pub async fn get_databases_privilege_data(
 ) -> ListPrivilegesResponse {
     let mut results = BTreeMap::new();
 
-    for database_name in &database_names {
+    for database_name in database_names.iter().cloned() {
         if let Err(err) = validate_db_or_user_request(
-            &DbOrUser::Database(database_name.clone()),
+            &DbOrUser::Database(database_name.to_owned()),
             unix_user,
             group_denylist,
         )
         .map_err(ListPrivilegesError::ValidationError)
         {
-            results.insert(database_name.to_owned(), Err(err));
+            results.insert(database_name, Err(err));
             continue;
         }
 
-        match unsafe_database_exists(database_name, connection).await {
+        match unsafe_database_exists(&database_name, connection).await {
             Ok(false) => {
                 results.insert(
                     database_name.to_owned(),
@@ -176,7 +176,7 @@ pub async fn get_databases_privilege_data(
             Ok(true) => {}
         }
 
-        let result = unsafe_get_database_privileges(database_name, connection)
+        let result = unsafe_get_database_privileges(&database_name, connection)
             .await
             .map_err(|e| ListPrivilegesError::MySqlError(e.to_string()));
 
@@ -234,11 +234,12 @@ async fn unsafe_apply_privilege_diff(
         DatabasePrivilegesDiff::New(p) => {
             let tables = DATABASE_PRIVILEGE_FIELDS
                 .iter()
+                .chain(&["Host"])
                 .map(|field| quote_identifier(field))
                 .join(",");
 
             let question_marks =
-                std::iter::repeat_n("?", DATABASE_PRIVILEGE_FIELDS.len()).join(",");
+                std::iter::repeat_n("?", DATABASE_PRIVILEGE_FIELDS.len() + 1).join(",");
 
             sqlx::query(format!("INSERT INTO `db` ({tables}) VALUES ({question_marks})").as_str())
                 .bind(p.db.to_string())
@@ -254,6 +255,7 @@ async fn unsafe_apply_privilege_diff(
                 .bind(yn(p.create_tmp_table_priv))
                 .bind(yn(p.lock_tables_priv))
                 .bind(yn(p.references_priv))
+                .bind("%")
                 .execute(connection)
                 .await
                 .map(|_| ())
@@ -278,28 +280,33 @@ async fn unsafe_apply_privilege_diff(
                 }
             }
 
-            sqlx::query(format!("UPDATE `db` SET {changes} WHERE `Db` = ? AND `User` = ?").as_str())
-                .bind(p.select_priv.map(change_to_yn))
-                .bind(p.insert_priv.map(change_to_yn))
-                .bind(p.update_priv.map(change_to_yn))
-                .bind(p.delete_priv.map(change_to_yn))
-                .bind(p.create_priv.map(change_to_yn))
-                .bind(p.drop_priv.map(change_to_yn))
-                .bind(p.alter_priv.map(change_to_yn))
-                .bind(p.index_priv.map(change_to_yn))
-                .bind(p.create_tmp_table_priv.map(change_to_yn))
-                .bind(p.lock_tables_priv.map(change_to_yn))
-                .bind(p.references_priv.map(change_to_yn))
-                .bind(p.db.to_string())
-                .bind(p.user.to_string())
-                .execute(connection)
-                .await
-                .map(|_| ())
+            sqlx::query(
+                format!("UPDATE `db` SET {changes} WHERE `Db` = ? AND `User` = ? AND `Host` = ?")
+                    .as_str(),
+            )
+            .bind(p.select_priv.map(change_to_yn))
+            .bind(p.insert_priv.map(change_to_yn))
+            .bind(p.update_priv.map(change_to_yn))
+            .bind(p.delete_priv.map(change_to_yn))
+            .bind(p.create_priv.map(change_to_yn))
+            .bind(p.drop_priv.map(change_to_yn))
+            .bind(p.alter_priv.map(change_to_yn))
+            .bind(p.index_priv.map(change_to_yn))
+            .bind(p.create_tmp_table_priv.map(change_to_yn))
+            .bind(p.lock_tables_priv.map(change_to_yn))
+            .bind(p.references_priv.map(change_to_yn))
+            .bind(p.db.to_string())
+            .bind(p.user.to_string())
+            .bind("%")
+            .execute(connection)
+            .await
+            .map(|_| ())
         }
         DatabasePrivilegesDiff::Deleted(p) => {
-            sqlx::query("DELETE FROM `db` WHERE `Db` = ? AND `User` = ?")
+            sqlx::query("DELETE FROM `db` WHERE `Db` = ? AND `User` = ? AND `Host` = ?")
                 .bind(p.db.to_string())
                 .bind(p.user.to_string())
+                .bind("%")
                 .execute(connection)
                 .await
                 .map(|_| ())
@@ -400,7 +407,7 @@ async fn validate_diff(
 
 /// Uses the result of [`diff_privileges`] to modify privileges in the database.
 pub async fn apply_privilege_diffs(
-    database_privilege_diffs: BTreeSet<DatabasePrivilegesDiff>,
+    database_privilege_diffs: &BTreeSet<DatabasePrivilegesDiff>,
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     _db_is_mariadb: bool,
@@ -468,12 +475,12 @@ pub async fn apply_privilege_diffs(
             Ok(true) => {}
         }
 
-        if let Err(err) = validate_diff(&diff, connection).await {
+        if let Err(err) = validate_diff(diff, connection).await {
             results.insert(key, Err(err));
             continue;
         }
 
-        let result = unsafe_apply_privilege_diff(&diff, connection)
+        let result = unsafe_apply_privilege_diff(diff, connection)
             .await
             .map_err(|e| ModifyDatabasePrivilegesError::MySqlError(e.to_string()));
 
@@ -481,4 +488,13 @@ pub async fn apply_privilege_diffs(
     }
 
     results
+        .into_iter()
+        .map(|((k1, k2), v)| (k1, (k2, v)))
+        .into_group_map()
+        .into_iter()
+        .map(|(k1, pairs)| {
+            let inner = pairs.into_iter().collect::<BTreeMap<_, _>>();
+            (k1, inner)
+        })
+        .collect()
 }

src/server/sql/user_operations.rs

@@ -39,6 +39,7 @@ pub(super) async fn unsafe_user_exists(
             SELECT 1
             FROM `mysql`.`user`
             WHERE `User` = ?
+              AND `Host` = '%'
           )
         ",
     )
@@ -55,7 +56,7 @@ pub(super) async fn unsafe_user_exists(
 }
 
 pub async fn complete_user_name(
-    user_prefix: String,
+    user_prefix: &str,
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     _db_is_mariadb: bool,
@@ -67,6 +68,7 @@ pub async fn complete_user_name(
           FROM `mysql`.`user`
           WHERE `User` REGEXP ?
             AND `User` LIKE ?
+            AND `Host` = '%'
         ",
     )
     .bind(create_user_group_matching_regex(unix_user, group_denylist))
@@ -95,7 +97,7 @@ pub async fn complete_user_name(
 }
 
 pub async fn create_database_users(
-    db_users: Vec<MySQLUser>,
+    db_users: &[MySQLUser],
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     _db_is_mariadb: bool,
@@ -103,7 +105,7 @@ pub async fn create_database_users(
 ) -> CreateUsersResponse {
     let mut results = BTreeMap::new();
 
-    for db_user in db_users {
+    for db_user in db_users.iter().cloned() {
         if let Err(err) =
             validate_db_or_user_request(&DbOrUser::User(db_user.clone()), unix_user, group_denylist)
                 .map_err(CreateUserError::ValidationError)
@@ -141,7 +143,7 @@ pub async fn create_database_users(
 }
 
 pub async fn drop_database_users(
-    db_users: Vec<MySQLUser>,
+    db_users: &[MySQLUser],
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     _db_is_mariadb: bool,
@@ -149,7 +151,7 @@ pub async fn drop_database_users(
 ) -> DropUsersResponse {
     let mut results = BTreeMap::new();
 
-    for db_user in db_users {
+    for db_user in db_users.iter().cloned() {
         if let Err(err) =
             validate_db_or_user_request(&DbOrUser::User(db_user.clone()), unix_user, group_denylist)
                 .map_err(DropUserError::ValidationError)
@@ -272,7 +274,7 @@ async fn database_user_is_locked_unsafe(
 }
 
 pub async fn lock_database_users(
-    db_users: Vec<MySQLUser>,
+    db_users: &[MySQLUser],
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     db_is_mariadb: bool,
@@ -280,7 +282,7 @@ pub async fn lock_database_users(
 ) -> LockUsersResponse {
     let mut results = BTreeMap::new();
 
-    for db_user in db_users {
+    for db_user in db_users.iter().cloned() {
         if let Err(err) =
             validate_db_or_user_request(&DbOrUser::User(db_user.clone()), unix_user, group_denylist)
                 .map_err(LockUserError::ValidationError)
@@ -332,7 +334,7 @@ pub async fn lock_database_users(
 }
 
 pub async fn unlock_database_users(
-    db_users: Vec<MySQLUser>,
+    db_users: &[MySQLUser],
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     db_is_mariadb: bool,
@@ -340,7 +342,7 @@ pub async fn unlock_database_users(
 ) -> UnlockUsersResponse {
     let mut results = BTreeMap::new();
 
-    for db_user in db_users {
+    for db_user in db_users.iter().cloned() {
         if let Err(err) =
             validate_db_or_user_request(&DbOrUser::User(db_user.clone()), unix_user, group_denylist)
                 .map_err(UnlockUserError::ValidationError)
@@ -440,7 +442,7 @@ FROM `user`
 ";
 
 pub async fn list_database_users(
-    db_users: Vec<MySQLUser>,
+    db_users: &[MySQLUser],
     unix_user: &UnixUser,
     connection: &mut MySqlConnection,
     db_is_mariadb: bool,
@@ -448,7 +450,7 @@ pub async fn list_database_users(
 ) -> ListUsersResponse {
     let mut results = BTreeMap::new();
 
-    for db_user in db_users {
+    for db_user in db_users.iter().cloned() {
         if let Err(err) =
             validate_db_or_user_request(&DbOrUser::User(db_user.clone()), unix_user, group_denylist)
                 .map_err(ListUsersError::ValidationError)
@@ -462,7 +464,7 @@ pub async fn list_database_users(
                 DB_USER_SELECT_STATEMENT_MARIADB.to_string()
             } else {
                 DB_USER_SELECT_STATEMENT_MYSQL.to_string()
-            } + "WHERE `mysql`.`user`.`User` = ?"),
+            } + "WHERE `mysql`.`user`.`User` = ? AND `mysql`.`user`.`Host` = '%'"),
         )
         .bind(db_user.as_str())
         .fetch_optional(&mut *connection)
@@ -499,7 +501,7 @@ pub async fn list_all_database_users_for_unix_user(
             DB_USER_SELECT_STATEMENT_MARIADB.to_string()
         } else {
             DB_USER_SELECT_STATEMENT_MYSQL.to_string()
-        } + "WHERE `user`.`User` REGEXP ?"),
+        } + "WHERE `user`.`User` REGEXP ? AND `user`.`Host` = '%'"),
     )
     .bind(create_user_group_matching_regex(unix_user, group_denylist))
     .fetch_all(&mut *connection)
@@ -534,7 +536,7 @@ pub async fn set_databases_where_user_has_privileges(
             r"
                 SELECT `Db` AS `database`
                 FROM `db`
-                WHERE `User` = ? AND ({})
+                WHERE `User` = ?  AND `Host` = '%' AND ({})
             ",
             DATABASE_PRIVILEGE_FIELDS
                 .iter()

src/server/supervisor.rs

@@ -2,7 +2,10 @@ use std::{
     fs,
     os::{fd::FromRawFd, unix::net::UnixListener as StdUnixListener},
     path::PathBuf,
-    sync::Arc,
+    sync::{
+        Arc,
+        atomic::{AtomicU64, Ordering},
+    },
     time::Duration,
 };
 
@@ -22,7 +25,7 @@ use crate::{
     server::{
         authorization::read_and_parse_group_denylist,
         config::{MysqlConfig, ServerConfig},
-        session_handler::session_handler,
+        session_handler::{SessionId, session_handler},
     },
 };
 
@@ -87,14 +90,12 @@ impl Supervisor {
         };
 
         let mut watchdog_duration = None;
-        let mut watchdog_micro_seconds = 0;
         #[cfg(target_os = "linux")]
         let watchdog_task =
-            if systemd_mode && sd_notify::watchdog_enabled(true, &mut watchdog_micro_seconds) {
-                let watchdog_duration_ = Duration::from_micros(watchdog_micro_seconds);
+            if systemd_mode && let Some(watchdog_duration_) = sd_notify::watchdog_enabled() {
                 tracing::debug!(
                     "Systemd watchdog enabled with {} millisecond interval",
-                    watchdog_micro_seconds.div_ceil(1000),
+                    watchdog_duration_.as_millis()
                 );
                 watchdog_duration = Some(watchdog_duration_);
                 Some(spawn_watchdog_task(watchdog_duration_))
@@ -137,7 +138,7 @@ impl Supervisor {
 
         let (tx, rx) = broadcast::channel(1);
 
-        // TODO: try to detech systemd socket before using the provided socket path
+        // TODO: try to detect systemd socket before using the provided socket path
         #[cfg(target_os = "linux")]
         let listener = Arc::new(RwLock::new(match config.socket_path {
             Some(ref path) => create_unix_listener_with_socket_path(path.clone()).await?,
@@ -292,7 +293,12 @@ impl Supervisor {
 
     pub async fn reload(&self) -> anyhow::Result<()> {
         #[cfg(target_os = "linux")]
-        sd_notify::notify(false, &[sd_notify::NotifyState::Reloading])?;
+        sd_notify::notify(&[
+            sd_notify::NotifyState::Reloading,
+            sd_notify::NotifyState::monotonic_usec_now()
+                .expect("Failed to get monotonic time to send to systemd while reloading"),
+            sd_notify::NotifyState::Status("Reloading configuration"),
+        ])?;
 
         let previous_config = self.config.lock().await.clone();
         self.reload_config().await?;
@@ -329,14 +335,14 @@ impl Supervisor {
         }
 
         #[cfg(target_os = "linux")]
-        sd_notify::notify(false, &[sd_notify::NotifyState::Ready])?;
+        sd_notify::notify(&[sd_notify::NotifyState::Ready])?;
 
         Ok(())
     }
 
     pub async fn shutdown(&self) -> anyhow::Result<()> {
         #[cfg(target_os = "linux")]
-        sd_notify::notify(false, &[sd_notify::NotifyState::Stopping])?;
+        sd_notify::notify(&[sd_notify::NotifyState::Stopping])?;
 
         tracing::debug!("Stop accepting new connections");
         self.stop_receiving_new_connections()?;
@@ -406,7 +412,7 @@ fn spawn_watchdog_task(duration: Duration) -> JoinHandle<()> {
         );
         loop {
             interval.tick().await;
-            if let Err(err) = sd_notify::notify(false, &[sd_notify::NotifyState::Watchdog]) {
+            if let Err(err) = sd_notify::notify(&[sd_notify::NotifyState::Watchdog]) {
                 tracing::warn!("Failed to notify systemd watchdog: {}", err);
             }
         }
@@ -429,9 +435,7 @@ fn spawn_status_notifier_task(task_tracker: TaskTracker) -> JoinHandle<()> {
                 "Waiting for connections".to_string()
             };
 
-            if let Err(e) =
-                sd_notify::notify(false, &[sd_notify::NotifyState::Status(message.as_str())])
-            {
+            if let Err(e) = sd_notify::notify(&[sd_notify::NotifyState::Status(message.as_str())]) {
                 tracing::warn!("Failed to send systemd status notification: {}", e);
             }
         }
@@ -546,7 +550,9 @@ async fn listener_task(
     group_denylist: Arc<RwLock<GroupDenylist>>,
 ) -> anyhow::Result<()> {
     #[cfg(target_os = "linux")]
-    sd_notify::notify(false, &[sd_notify::NotifyState::Ready])?;
+    sd_notify::notify(&[sd_notify::NotifyState::Ready])?;
+
+    let connection_counter = AtomicU64::new(0);
 
     loop {
         tokio::select! {
@@ -577,28 +583,29 @@ async fn listener_task(
             } => {
                 match accept_result {
                     Ok((conn, _addr)) => {
-                        tracing::debug!("Got new connection");
+                        connection_counter.fetch_add(1, Ordering::Relaxed);
+                        let conn_id = connection_counter.load(Ordering::Relaxed);
 
+                        tracing::debug!("Got new connection, assigned session ID {}", conn_id);
+
+                        let session_id = SessionId::new(conn_id);
                         let db_pool_clone = db_pool.clone();
                         let db_is_mariadb_clone = *db_is_mariadb.read().await;
                         let group_denylist_arc_clone = group_denylist.clone();
                         task_tracker.spawn(async move {
                             match session_handler(
                                 conn,
+                                session_id,
                                 db_pool_clone,
                                 db_is_mariadb_clone,
                                 &*group_denylist_arc_clone.read().await,
                             ).await {
-                                Ok(()) => {}
-                                Err(e) => {
-                                    tracing::error!("Failed to run server: {}", e);
-                                }
+                                Ok(()) => {},
+                                Err(e) => tracing::error!("Session {} failed: {}", conn_id, e),
                             }
                         });
-                    }
-                    Err(e) => {
-                        tracing::error!("Failed to accept new connection: {}", e);
-                    }
+                    },
+                    Err(e) => tracing::error!("Failed to accept new connection: {}", e),
                 }
             }
         }