Projects/mysqladm-rs
Projects
/
mysqladm-rs
12
2
Fork 0
Code Issues 36 Pull Requests Releases Activity

Compare commits

base: Projects:7025982d448794967b7a7c76fc029df1e917fd60
Branches Tags
Projects:main
Projects:dpkg-packaging
..
compare: Projects:1bb1c133e85f8c0a4db705c2566df5133d620ace
Branches Tags
Projects:main
Projects:dpkg-packaging

2 Commits
7025982d44 ... 1bb1c133e8

Author SHA1 Message Date
Oystein Kristoffer Tveit 1bb1c133e8
Consistently name db connection `connection` 2024-08-07 21:54:13 +02:00
Oystein Kristoffer Tveit 5a7516aed8
Rename most instances of "permission" to "privilege" 2024-08-07 21:51:03 +02:00
8 changed files with 189 additions and 161 deletions
Show Stats Expand all files Collapse all files

187
src/cli/database_command.rs
View File

@ -28,29 +28,29 @@ pub enum DatabaseCommand {
#[command()] #[command()]
ListDb(DatabaseListArgs), ListDb(DatabaseListArgs),
/// List user permissions for one or more databases /// List user privileges for one or more databases
/// ///
/// If no database names are provided, it will show permissions for all databases you have access to. /// If no database names are provided, it will show privileges for all databases you have access to.
#[command()] #[command()]
ShowDbPerm(DatabaseShowPermArgs), ShowDbPrivs(DatabaseShowPrivsArgs),
/// Change user permissions for one or more databases. See `edit-db-perm --help` for details. /// Change user privileges for one or more databases. See `edit-db-privs --help` for details.
/// ///
/// This command has two modes of operation: /// This command has two modes of operation:
/// ///
/// 1. Interactive mode: If nothing else is specified, the user will be prompted to edit the permissions using a text editor. /// 1. Interactive mode: If nothing else is specified, the user will be prompted to edit the privileges using a text editor.
/// ///
/// You can configure your preferred text editor by setting the `VISUAL` or `EDITOR` environment variables. /// You can configure your preferred text editor by setting the `VISUAL` or `EDITOR` environment variables.
/// ///
/// Follow the instructions inside the editor for more information. /// Follow the instructions inside the editor for more information.
/// ///
/// 2. Non-interactive mode: If the `-p` flag is specified, the user can write permissions using arguments. /// 2. Non-interactive mode: If the `-p` flag is specified, the user can write privileges using arguments.
/// ///
/// The permission arguments should be formatted as `<db>:<user>:<privileges>` /// The privilege arguments should be formatted as `<db>:<user>:<privileges>`
/// where the privileges are a string of characters, each representing a single permissions. /// where the privileges are a string of characters, each representing a single privilege.
/// The character `A` is an exception, because it represents all permissions. /// The character `A` is an exception - it represents all privileges.
/// ///
/// The character to permission mapping is declared as follows: /// The character-to-privilege mapping is defined as follows:
/// ///
/// - `s` - SELECT /// - `s` - SELECT
/// - `i` - INSERT /// - `i` - INSERT
@ -65,24 +65,27 @@ pub enum DatabaseCommand {
/// - `r` - REFERENCES /// - `r` - REFERENCES
/// - `A` - ALL PRIVILEGES /// - `A` - ALL PRIVILEGES
/// ///
/// If you provide a database name, you can omit it from the permission arguments. /// If you provide a database name, you can omit it from the privilege string,
/// e.g. `edit-db-privs my_db -p my_user:siu` is equivalent to `edit-db-privs -p my_db:my_user:siu`.
/// While it doesn't make much of a difference for a single edit, it can be useful for editing multiple users
/// on the same database at once.
/// ///
/// Example usage of non-interactive mode: /// Example usage of non-interactive mode:
/// ///
/// Set permissions `SELECT`, `INSERT`, and `UPDATE` for user `my_user` on database `my_db`: /// Enable privileges `SELECT`, `INSERT`, and `UPDATE` for user `my_user` on database `my_db`:
/// ///
/// mysqladm edit-db-perm -p my_db:my_user:siu /// `mysqladm edit-db-privs -p my_db:my_user:siu`
/// ///
/// Set all permissions for user `my_other_user` on database `my_other_db`: /// Enable all privileges for user `my_other_user` on database `my_other_db`:
/// ///
/// mysqladm edit-db-perm -p my_other_db:my_other_user:A /// `mysqladm edit-db-privs -p my_other_db:my_other_user:A`
/// ///
/// Set miscellaneous permissions for multiple users on database `my_db`: /// Set miscellaneous privileges for multiple users on database `my_db`:
/// ///
/// mysqladm edit-db-perm my_db -p my_user:siu my_other_user:ct /// `mysqladm edit-db-privs my_db -p my_user:siu my_other_user:ct``
/// ///
#[command(verbatim_doc_comment)] #[command(verbatim_doc_comment)]
EditDbPerm(DatabaseEditPermArgs), EditDbPrivs(DatabaseEditPrivsArgs),
} }
#[derive(Parser)] #[derive(Parser)]
@ -107,7 +110,7 @@ pub struct DatabaseListArgs {
} }
#[derive(Parser)] #[derive(Parser)]
pub struct DatabaseShowPermArgs { pub struct DatabaseShowPrivsArgs {
/// The name of the database(s) to show. /// The name of the database(s) to show.
#[arg(num_args = 0..)] #[arg(num_args = 0..)]
name: Vec<String>, name: Vec<String>,
@ -118,18 +121,18 @@ pub struct DatabaseShowPermArgs {
} }
#[derive(Parser)] #[derive(Parser)]
pub struct DatabaseEditPermArgs { pub struct DatabaseEditPrivsArgs {
/// The name of the database to edit permissions for. /// The name of the database to edit privileges for.
pub name: Option<String>, pub name: Option<String>,
#[arg(short, long, value_name = "[DATABASE:]USER:PERMISSIONS", num_args = 0..)] #[arg(short, long, value_name = "[DATABASE:]USER:PRIVILEGES", num_args = 0..)]
pub perm: Vec<String>, pub privs: Vec<String>,
/// Whether to output the information in JSON format. /// Whether to output the information in JSON format.
#[arg(short, long)] #[arg(short, long)]
pub json: bool, pub json: bool,
/// Specify the text editor to use for editing permissions. /// Specify the text editor to use for editing privileges
#[arg(short, long)] #[arg(short, long)]
pub editor: Option<String>, pub editor: Option<String>,
@ -140,30 +143,30 @@ pub struct DatabaseEditPermArgs {
pub async fn handle_command( pub async fn handle_command(
command: DatabaseCommand, command: DatabaseCommand,
mut conn: MySqlConnection, mut connection: MySqlConnection,
) -> anyhow::Result<()> { ) -> anyhow::Result<()> {
let result = conn let result = connection
.transaction(|txn| { .transaction(|txn| {
Box::pin(async move { Box::pin(async move {
match command { match command {
DatabaseCommand::CreateDb(args) => create_databases(args, txn).await, DatabaseCommand::CreateDb(args) => create_databases(args, txn).await,
DatabaseCommand::DropDb(args) => drop_databases(args, txn).await, DatabaseCommand::DropDb(args) => drop_databases(args, txn).await,
DatabaseCommand::ListDb(args) => list_databases(args, txn).await, DatabaseCommand::ListDb(args) => list_databases(args, txn).await,
DatabaseCommand::ShowDbPerm(args) => show_databases(args, txn).await, DatabaseCommand::ShowDbPrivs(args) => show_database_privileges(args, txn).await,
DatabaseCommand::EditDbPerm(args) => edit_permissions(args, txn).await, DatabaseCommand::EditDbPrivs(args) => edit_privileges(args, txn).await,
} }
}) })
}) })
.await; .await;
close_database_connection(conn).await; close_database_connection(connection).await;
result result
} }
async fn create_databases( async fn create_databases(
args: DatabaseCreateArgs, args: DatabaseCreateArgs,
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<()> { ) -> anyhow::Result<()> {
if args.name.is_empty() { if args.name.is_empty() {
anyhow::bail!("No database names provided"); anyhow::bail!("No database names provided");
@ -171,7 +174,7 @@ async fn create_databases(
for name in args.name { for name in args.name {
// TODO: This can be optimized by fetching all the database privileges in one query. // TODO: This can be optimized by fetching all the database privileges in one query.
if let Err(e) = create_database(&name, conn).await { if let Err(e) = create_database(&name, connection).await {
eprintln!("Failed to create database '{}': {}", name, e); eprintln!("Failed to create database '{}': {}", name, e);
eprintln!("Skipping..."); eprintln!("Skipping...");
} }
@ -180,14 +183,17 @@ async fn create_databases(
Ok(()) Ok(())
} }
async fn drop_databases(args: DatabaseDropArgs, conn: &mut MySqlConnection) -> anyhow::Result<()> { async fn drop_databases(
args: DatabaseDropArgs,
connection: &mut MySqlConnection,
) -> anyhow::Result<()> {
if args.name.is_empty() { if args.name.is_empty() {
anyhow::bail!("No database names provided"); anyhow::bail!("No database names provided");
} }
for name in args.name { for name in args.name {
// TODO: This can be optimized by fetching all the database privileges in one query. // TODO: This can be optimized by fetching all the database privileges in one query.
if let Err(e) = drop_database(&name, conn).await { if let Err(e) = drop_database(&name, connection).await {
eprintln!("Failed to drop database '{}': {}", name, e); eprintln!("Failed to drop database '{}': {}", name, e);
eprintln!("Skipping..."); eprintln!("Skipping...");
} }
@ -196,8 +202,11 @@ async fn drop_databases(args: DatabaseDropArgs, conn: &mut MySqlConnection) -> a
Ok(()) Ok(())
} }
async fn list_databases(args: DatabaseListArgs, conn: &mut MySqlConnection) -> anyhow::Result<()> { async fn list_databases(
let databases = get_database_list(conn).await?; args: DatabaseListArgs,
connection: &mut MySqlConnection,
) -> anyhow::Result<()> {
let databases = get_database_list(connection).await?;
if databases.is_empty() { if databases.is_empty() {
println!("No databases to show."); println!("No databases to show.");
@ -215,17 +224,17 @@ async fn list_databases(args: DatabaseListArgs, conn: &mut MySqlConnection) -> a
Ok(()) Ok(())
} }
async fn show_databases( async fn show_database_privileges(
args: DatabaseShowPermArgs, args: DatabaseShowPrivsArgs,
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<()> { ) -> anyhow::Result<()> {
let database_users_to_show = if args.name.is_empty() { let database_users_to_show = if args.name.is_empty() {
get_all_database_privileges(conn).await? get_all_database_privileges(connection).await?
} else { } else {
// TODO: This can be optimized by fetching all the database privileges in one query. // TODO: This can be optimized by fetching all the database privileges in one query.
let mut result = Vec::with_capacity(args.name.len()); let mut result = Vec::with_capacity(args.name.len());
for name in args.name { for name in args.name {
match get_database_privileges(&name, conn).await { match get_database_privileges(&name, connection).await {
Ok(db) => result.extend(db), Ok(db) => result.extend(db),
Err(e) => { Err(e) => {
eprintln!("Failed to show database '{}': {}", name, e); eprintln!("Failed to show database '{}': {}", name, e);
@ -276,11 +285,11 @@ async fn show_databases(
Ok(()) Ok(())
} }
/// See documentation for `DatabaseCommand::EditPerm`. /// See documentation for `DatabaseCommand::EditDbPrivs`.
fn parse_permission_table_cli_arg(arg: &str) -> anyhow::Result<DatabasePrivilegeRow> { fn parse_privilege_table_cli_arg(arg: &str) -> anyhow::Result<DatabasePrivilegeRow> {
let parts: Vec<&str> = arg.split(':').collect(); let parts: Vec<&str> = arg.split(':').collect();
if parts.len() != 3 { if parts.len() != 3 {
anyhow::bail!("Invalid argument format. See `edit-perm --help` for more information."); anyhow::bail!("Invalid argument format. See `edit-db-privs --help` for more information.");
} }
let db = parts[0].to_string(); let db = parts[0].to_string();
@ -329,14 +338,14 @@ fn parse_permission_table_cli_arg(arg: &str) -> anyhow::Result<DatabasePrivilege
result.lock_tables_priv = true; result.lock_tables_priv = true;
result.references_priv = true; result.references_priv = true;
} }
_ => anyhow::bail!("Invalid permission character: {}", char), _ => anyhow::bail!("Invalid privilege character: {}", char),
} }
} }
Ok(result) Ok(result)
} }
fn parse_permission(yn: &str) -> anyhow::Result<bool> { fn parse_privilege(yn: &str) -> anyhow::Result<bool> {
match yn.to_ascii_lowercase().as_str() { match yn.to_ascii_lowercase().as_str() {
"y" => Ok(true), "y" => Ok(true),
"n" => Ok(false), "n" => Ok(false),
@ -344,7 +353,7 @@ fn parse_permission(yn: &str) -> anyhow::Result<bool> {
} }
} }
fn parse_permission_data_from_editor(content: String) -> anyhow::Result<Vec<DatabasePrivilegeRow>> { fn parse_privilege_data_from_editor(content: String) -> anyhow::Result<Vec<DatabasePrivilegeRow>> {
content content
.trim() .trim()
.split('\n') .split('\n')
@ -360,27 +369,27 @@ fn parse_permission_data_from_editor(content: String) -> anyhow::Result<Vec<Data
Ok(DatabasePrivilegeRow { Ok(DatabasePrivilegeRow {
db: (*line_parts.first().unwrap()).to_owned(), db: (*line_parts.first().unwrap()).to_owned(),
user: (*line_parts.get(1).unwrap()).to_owned(), user: (*line_parts.get(1).unwrap()).to_owned(),
select_priv: parse_permission(line_parts.get(2).unwrap()) select_priv: parse_privilege(line_parts.get(2).unwrap())
.context("Could not parse SELECT privilege")?, .context("Could not parse SELECT privilege")?,
insert_priv: parse_permission(line_parts.get(3).unwrap()) insert_priv: parse_privilege(line_parts.get(3).unwrap())
.context("Could not parse INSERT privilege")?, .context("Could not parse INSERT privilege")?,
update_priv: parse_permission(line_parts.get(4).unwrap()) update_priv: parse_privilege(line_parts.get(4).unwrap())
.context("Could not parse UPDATE privilege")?, .context("Could not parse UPDATE privilege")?,
delete_priv: parse_permission(line_parts.get(5).unwrap()) delete_priv: parse_privilege(line_parts.get(5).unwrap())
.context("Could not parse DELETE privilege")?, .context("Could not parse DELETE privilege")?,
create_priv: parse_permission(line_parts.get(6).unwrap()) create_priv: parse_privilege(line_parts.get(6).unwrap())
.context("Could not parse CREATE privilege")?, .context("Could not parse CREATE privilege")?,
drop_priv: parse_permission(line_parts.get(7).unwrap()) drop_priv: parse_privilege(line_parts.get(7).unwrap())
.context("Could not parse DROP privilege")?, .context("Could not parse DROP privilege")?,
alter_priv: parse_permission(line_parts.get(8).unwrap()) alter_priv: parse_privilege(line_parts.get(8).unwrap())
.context("Could not parse ALTER privilege")?, .context("Could not parse ALTER privilege")?,
index_priv: parse_permission(line_parts.get(9).unwrap()) index_priv: parse_privilege(line_parts.get(9).unwrap())
.context("Could not parse INDEX privilege")?, .context("Could not parse INDEX privilege")?,
create_tmp_table_priv: parse_permission(line_parts.get(10).unwrap()) create_tmp_table_priv: parse_privilege(line_parts.get(10).unwrap())
.context("Could not parse CREATE TEMPORARY TABLE privilege")?, .context("Could not parse CREATE TEMPORARY TABLE privilege")?,
lock_tables_priv: parse_permission(line_parts.get(11).unwrap()) lock_tables_priv: parse_privilege(line_parts.get(11).unwrap())
.context("Could not parse LOCK TABLES privilege")?, .context("Could not parse LOCK TABLES privilege")?,
references_priv: parse_permission(line_parts.get(12).unwrap()) references_priv: parse_privilege(line_parts.get(12).unwrap())
.context("Could not parse REFERENCES privilege")?, .context("Could not parse REFERENCES privilege")?,
}) })
}) })
@ -412,40 +421,40 @@ fn format_privileges_line(
.to_string() .to_string()
} }
pub async fn edit_permissions( pub async fn edit_privileges(
args: DatabaseEditPermArgs, args: DatabaseEditPrivsArgs,
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<()> { ) -> anyhow::Result<()> {
let permission_data = if let Some(name) = &args.name { let privilege_data = if let Some(name) = &args.name {
get_database_privileges(name, conn).await? get_database_privileges(name, connection).await?
} else { } else {
get_all_database_privileges(conn).await? get_all_database_privileges(connection).await?
}; };
let permissions_to_change = if !args.perm.is_empty() { let privileges_to_change = if !args.privs.is_empty() {
if let Some(name) = args.name { if let Some(name) = args.name {
args.perm args.privs
.iter() .iter()
.map(|perm| { .map(|p| {
parse_permission_table_cli_arg(&format!("{}:{}", name, &perm)) parse_privilege_table_cli_arg(&format!("{}:{}", name, &p))
.context(format!("Failed parsing database permissions: `{}`", &perm)) .context(format!("Failed parsing database privileges: `{}`", &p))
}) })
.collect::<anyhow::Result<Vec<DatabasePrivilegeRow>>>()? .collect::<anyhow::Result<Vec<DatabasePrivilegeRow>>>()?
} else { } else {
args.perm args.privs
.iter() .iter()
.map(|perm| { .map(|p| {
parse_permission_table_cli_arg(perm) parse_privilege_table_cli_arg(p)
.context(format!("Failed parsing database permissions: `{}`", &perm)) .context(format!("Failed parsing database privileges: `{}`", &p))
}) })
.collect::<anyhow::Result<Vec<DatabasePrivilegeRow>>>()? .collect::<anyhow::Result<Vec<DatabasePrivilegeRow>>>()?
} }
} else { } else {
let comment = indoc! {r#" let comment = indoc! {r#"
# Welcome to the permission editor. # Welcome to the privilege editor.
# Each line defines what permissions a single user has on a single database. # Each line defines what privileges a single user has on a single database.
# The first two columns respectively represent the database name and the user, and the remaining columns are the permissions. # The first two columns respectively represent the database name and the user, and the remaining columns are the privileges.
# If the user should have a permission, write 'Y', otherwise write 'N'. # If the user should have a certain privilege, write 'Y', otherwise write 'N'.
# #
# Lines starting with '#' are comments and will be ignored. # Lines starting with '#' are comments and will be ignored.
"#}; "#};
@ -454,13 +463,13 @@ pub async fn edit_permissions(
let example_user = format!("{}_user", unix_user.name); let example_user = format!("{}_user", unix_user.name);
let example_db = format!("{}_db", unix_user.name); let example_db = format!("{}_db", unix_user.name);
let longest_username = permission_data let longest_username = privilege_data
.iter() .iter()
.map(|p| p.user.len()) .map(|p| p.user.len())
.max() .max()
.unwrap_or(example_user.len()); .unwrap_or(example_user.len());
let longest_database_name = permission_data let longest_database_name = privilege_data
.iter() .iter()
.map(|p| p.db.len()) .map(|p| p.db.len())
.max() .max()
@ -471,7 +480,7 @@ pub async fn edit_permissions(
.map(db_priv_field_human_readable_name) .map(db_priv_field_human_readable_name)
.collect(); .collect();
// Pad the first two columns with spaces to align the permissions. // Pad the first two columns with spaces to align the privileges.
header[0] = format!("{:width$}", header[0], width = longest_database_name); header[0] = format!("{:width$}", header[0], width = longest_database_name);
header[1] = format!("{:width$}", header[1], width = longest_username); header[1] = format!("{:width$}", header[1], width = longest_username);
@ -503,14 +512,14 @@ pub async fn edit_permissions(
"{}\n{}\n{}", "{}\n{}\n{}",
comment, comment,
header.join(" "), header.join(" "),
if permission_data.is_empty() { if privilege_data.is_empty() {
format!("# {}", example_line) format!("# {}", example_line)
} else { } else {
permission_data privilege_data
.iter() .iter()
.map(|perm| { .map(|privs| {
format_privileges_line( format_privileges_line(
perm, privs,
longest_username, longest_username,
longest_database_name, longest_database_name,
) )
@ -522,18 +531,18 @@ pub async fn edit_permissions(
)? )?
.unwrap(); .unwrap();
parse_permission_data_from_editor(result) parse_privilege_data_from_editor(result)
.context("Could not parse permission data from editor")? .context("Could not parse privilege data from editor")?
}; };
for row in permissions_to_change.iter() { for row in privileges_to_change.iter() {
if !user_exists(&row.user, conn).await? { if !user_exists(&row.user, connection).await? {
// TODO: allow user to return and correct their mistake // TODO: allow user to return and correct their mistake
anyhow::bail!("User {} does not exist", row.user); anyhow::bail!("User {} does not exist", row.user);
} }
} }
let diffs = diff_permissions(permission_data, &permissions_to_change).await; let diffs = diff_privileges(privilege_data, &privileges_to_change).await;
if diffs.is_empty() { if diffs.is_empty() {
println!("No changes to make."); println!("No changes to make.");
@ -542,7 +551,7 @@ pub async fn edit_permissions(
// TODO: Add confirmation prompt. // TODO: Add confirmation prompt.
apply_permission_diffs(diffs, conn).await?; apply_privilege_diffs(diffs, connection).await?;
Ok(()) Ok(())
} }

42
src/cli/mysql_admutils_compatibility/mysql_dbadm.rs
View File

@ -50,6 +50,10 @@ pub struct Args {
pub help_editperm: bool, pub help_editperm: bool,
} }
// NOTE: mysql-dbadm explicitly calls privileges "permissions".
// This is something we're trying to move away from.
// See https://git.pvv.ntnu.no/Projects/mysqladm-rs/issues/29
/// Create, drop or edit permissions for the DATABASE(s), /// Create, drop or edit permissions for the DATABASE(s),
/// as determined by the COMMAND. /// as determined by the COMMAND.
/// ///
@ -158,27 +162,27 @@ pub async fn main() -> anyhow::Result<()> {
// Hopefully, not many people rely on this in an automated fashion, as it // Hopefully, not many people rely on this in an automated fashion, as it
// is made to be interactive in nature. However, we should still try to // is made to be interactive in nature. However, we should still try to
// replicate the old behavior as closely as possible. // replicate the old behavior as closely as possible.
let edit_permissions_args = database_command::DatabaseEditPermArgs { let edit_privileges_args = database_command::DatabaseEditPrivsArgs {
name: Some(args.database), name: Some(args.database),
perm: vec![], privs: vec![],
json: false, json: false,
editor: None, editor: None,
yes: false, yes: false,
}; };
database_command::edit_permissions(edit_permissions_args, &mut connection).await?; database_command::edit_privileges(edit_privileges_args, &mut connection).await?;
} }
} }
Ok(()) Ok(())
} }
async fn show_db(name: &str, conn: &mut MySqlConnection) -> anyhow::Result<()> { async fn show_db(name: &str, connection: &mut MySqlConnection) -> anyhow::Result<()> {
// NOTE: mysql-dbadm show has a quirk where valid database names // NOTE: mysql-dbadm show has a quirk where valid database names
// for non-existent databases will report with no users. // for non-existent databases will report with no users.
// This function should *not* check for db existence, only // This function should *not* check for db existence, only
// validate the names. // validate the names.
let permissions = database_privilege_operations::get_database_privileges(name, conn) let privileges = database_privilege_operations::get_database_privileges(name, connection)
.await .await
.unwrap_or(vec![]); .unwrap_or(vec![]);
@ -190,24 +194,24 @@ async fn show_db(name: &str, conn: &mut MySqlConnection) -> anyhow::Result<()> {
), ),
name, name,
); );
if permissions.is_empty() { if privileges.is_empty() {
println!("# (no permissions currently granted to any users)"); println!("# (no permissions currently granted to any users)");
} else { } else {
for permission in permissions { for privilege in privileges {
println!( println!(
" {:<16} {:<7} {:<7} {:<7} {:<7} {:<7} {:<7} {:<7} {:<7} {:<7} {:<7} {}", " {:<16} {:<7} {:<7} {:<7} {:<7} {:<7} {:<7} {:<7} {:<7} {:<7} {:<7} {}",
permission.user, privilege.user,
yn(permission.select_priv), yn(privilege.select_priv),
yn(permission.insert_priv), yn(privilege.insert_priv),
yn(permission.update_priv), yn(privilege.update_priv),
yn(permission.delete_priv), yn(privilege.delete_priv),
yn(permission.create_priv), yn(privilege.create_priv),
yn(permission.drop_priv), yn(privilege.drop_priv),
yn(permission.alter_priv), yn(privilege.alter_priv),
yn(permission.index_priv), yn(privilege.index_priv),
yn(permission.create_tmp_table_priv), yn(privilege.create_tmp_table_priv),
yn(permission.lock_tables_priv), yn(privilege.lock_tables_priv),
yn(permission.references_priv) yn(privilege.references_priv)
); );
} }
} }

34
src/cli/user_command.rs
View File

@ -74,8 +74,11 @@ pub struct UserShowArgs {
json: bool, json: bool,
} }
pub async fn handle_command(command: UserCommand, mut conn: MySqlConnection) -> anyhow::Result<()> { pub async fn handle_command(
let result = conn command: UserCommand,
mut connection: MySqlConnection,
) -> anyhow::Result<()> {
let result = connection
.transaction(|txn| { .transaction(|txn| {
Box::pin(async move { Box::pin(async move {
match command { match command {
@ -88,18 +91,21 @@ pub async fn handle_command(command: UserCommand, mut conn: MySqlConnection) ->
}) })
.await; .await;
close_database_connection(conn).await; close_database_connection(connection).await;
result result
} }
async fn create_users(args: UserCreateArgs, conn: &mut MySqlConnection) -> anyhow::Result<()> { async fn create_users(
args: UserCreateArgs,
connection: &mut MySqlConnection,
) -> anyhow::Result<()> {
if args.username.is_empty() { if args.username.is_empty() {
anyhow::bail!("No usernames provided"); anyhow::bail!("No usernames provided");
} }
for username in args.username { for username in args.username {
if let Err(e) = create_database_user(&username, conn).await { if let Err(e) = create_database_user(&username, connection).await {
eprintln!("{}", e); eprintln!("{}", e);
eprintln!("Skipping...\n"); eprintln!("Skipping...\n");
continue; continue;
@ -120,7 +126,7 @@ async fn create_users(args: UserCreateArgs, conn: &mut MySqlConnection) -> anyho
username, username,
password_file: None, password_file: None,
}, },
conn, connection,
) )
.await?; .await?;
} }
@ -129,13 +135,13 @@ async fn create_users(args: UserCreateArgs, conn: &mut MySqlConnection) -> anyho
Ok(()) Ok(())
} }
async fn drop_users(args: UserDeleteArgs, conn: &mut MySqlConnection) -> anyhow::Result<()> { async fn drop_users(args: UserDeleteArgs, connection: &mut MySqlConnection) -> anyhow::Result<()> {
if args.username.is_empty() { if args.username.is_empty() {
anyhow::bail!("No usernames provided"); anyhow::bail!("No usernames provided");
} }
for username in args.username { for username in args.username {
if let Err(e) = delete_database_user(&username, conn).await { if let Err(e) = delete_database_user(&username, connection).await {
eprintln!("{}", e); eprintln!("{}", e);
eprintln!("Skipping..."); eprintln!("Skipping...");
} }
@ -156,7 +162,7 @@ pub fn read_password_from_stdin_with_double_check(username: &str) -> anyhow::Res
async fn change_password_for_user( async fn change_password_for_user(
args: UserPasswdArgs, args: UserPasswdArgs,
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<()> { ) -> anyhow::Result<()> {
// NOTE: although this also is checked in `set_password_for_database_user`, we check it here // NOTE: although this also is checked in `set_password_for_database_user`, we check it here
// to provide a more natural order of error messages. // to provide a more natural order of error messages.
@ -172,16 +178,16 @@ async fn change_password_for_user(
read_password_from_stdin_with_double_check(&args.username)? read_password_from_stdin_with_double_check(&args.username)?
}; };
set_password_for_database_user(&args.username, &password, conn).await?; set_password_for_database_user(&args.username, &password, connection).await?;
Ok(()) Ok(())
} }
async fn show_users(args: UserShowArgs, conn: &mut MySqlConnection) -> anyhow::Result<()> { async fn show_users(args: UserShowArgs, connection: &mut MySqlConnection) -> anyhow::Result<()> {
let unix_user = get_current_unix_user()?; let unix_user = get_current_unix_user()?;
let users = if args.username.is_empty() { let users = if args.username.is_empty() {
get_all_database_users_for_unix_user(&unix_user, conn).await? get_all_database_users_for_unix_user(&unix_user, connection).await?
} else { } else {
let mut result = vec![]; let mut result = vec![];
for username in args.username { for username in args.username {
@ -191,7 +197,7 @@ async fn show_users(args: UserShowArgs, conn: &mut MySqlConnection) -> anyhow::R
continue; continue;
} }
let user = get_database_user_for_user(&username, conn).await?; let user = get_database_user_for_user(&username, connection).await?;
if let Some(user) = user { if let Some(user) = user {
result.push(user); result.push(user);
} else { } else {
@ -205,7 +211,7 @@ async fn show_users(args: UserShowArgs, conn: &mut MySqlConnection) -> anyhow::R
for user in users.iter() { for user in users.iter() {
user_databases.insert( user_databases.insert(
user.user.clone(), user.user.clone(),
get_databases_where_user_has_privileges(&user.user, conn).await?, get_databases_where_user_has_privileges(&user.user, connection).await?,
); );
} }

4
src/core/common.rs
View File

@ -141,8 +141,8 @@ pub fn validate_ownership_by_user_prefix<'a>(
Ok(prefix) Ok(prefix)
} }
pub async fn close_database_connection(conn: MySqlConnection) { pub async fn close_database_connection(connection: MySqlConnection) {
if let Err(e) = conn if let Err(e) = connection
.close() .close()
.await .await
.context("Failed to close connection properly") .context("Failed to close connection properly")

2
src/core/config.rs
View File

@ -107,7 +107,7 @@ pub async fn mysql_connection_from_config(config: Config) -> anyhow::Result<MySq
) )
.await .await
{ {
Ok(conn) => conn.context("Failed to connect to MySQL"), Ok(connection) => connection.context("Failed to connect to MySQL"),
Err(_) => Err(anyhow!("Timed out after 2 seconds")).context("Failed to connect to MySQL"), Err(_) => Err(anyhow!("Timed out after 2 seconds")).context("Failed to connect to MySQL"),
} }
} }

16
src/core/database_operations.rs
View File

@ -13,13 +13,13 @@ use crate::core::{
database_privilege_operations::DATABASE_PRIVILEGE_FIELDS, database_privilege_operations::DATABASE_PRIVILEGE_FIELDS,
}; };
pub async fn create_database(name: &str, conn: &mut MySqlConnection) -> anyhow::Result<()> { pub async fn create_database(name: &str, connection: &mut MySqlConnection) -> anyhow::Result<()> {
let user = get_current_unix_user()?; let user = get_current_unix_user()?;
validate_database_name(name, &user)?; validate_database_name(name, &user)?;
// NOTE: see the note about SQL injections in `validate_owner_of_database_name` // NOTE: see the note about SQL injections in `validate_owner_of_database_name`
sqlx::query(&format!("CREATE DATABASE {}", quote_identifier(name))) sqlx::query(&format!("CREATE DATABASE {}", quote_identifier(name)))
.execute(conn) .execute(connection)
.await .await
.map_err(|e| { .map_err(|e| {
if e.to_string().contains("database exists") { if e.to_string().contains("database exists") {
@ -32,13 +32,13 @@ pub async fn create_database(name: &str, conn: &mut MySqlConnection) -> anyhow::
Ok(()) Ok(())
} }
pub async fn drop_database(name: &str, conn: &mut MySqlConnection) -> anyhow::Result<()> { pub async fn drop_database(name: &str, connection: &mut MySqlConnection) -> anyhow::Result<()> {
let user = get_current_unix_user()?; let user = get_current_unix_user()?;
validate_database_name(name, &user)?; validate_database_name(name, &user)?;
// NOTE: see the note about SQL injections in `validate_owner_of_database_name` // NOTE: see the note about SQL injections in `validate_owner_of_database_name`
sqlx::query(&format!("DROP DATABASE {}", quote_identifier(name))) sqlx::query(&format!("DROP DATABASE {}", quote_identifier(name)))
.execute(conn) .execute(connection)
.await .await
.map_err(|e| { .map_err(|e| {
if e.to_string().contains("doesn't exist") { if e.to_string().contains("doesn't exist") {
@ -56,7 +56,7 @@ struct DatabaseName {
database: String, database: String,
} }
pub async fn get_database_list(conn: &mut MySqlConnection) -> anyhow::Result<Vec<String>> { pub async fn get_database_list(connection: &mut MySqlConnection) -> anyhow::Result<Vec<String>> {
let unix_user = get_current_unix_user()?; let unix_user = get_current_unix_user()?;
let databases = sqlx::query_as::<_, DatabaseName>( let databases = sqlx::query_as::<_, DatabaseName>(
@ -68,7 +68,7 @@ pub async fn get_database_list(conn: &mut MySqlConnection) -> anyhow::Result<Vec
"#, "#,
) )
.bind(create_user_group_matching_regex(&unix_user)) .bind(create_user_group_matching_regex(&unix_user))
.fetch_all(conn) .fetch_all(connection)
.await .await
.context(format!( .context(format!(
"Failed to get databases for user '{}'", "Failed to get databases for user '{}'",
@ -80,7 +80,7 @@ pub async fn get_database_list(conn: &mut MySqlConnection) -> anyhow::Result<Vec
pub async fn get_databases_where_user_has_privileges( pub async fn get_databases_where_user_has_privileges(
username: &str, username: &str,
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<Vec<String>> { ) -> anyhow::Result<Vec<String>> {
let result = sqlx::query( let result = sqlx::query(
formatdoc!( formatdoc!(
@ -98,7 +98,7 @@ pub async fn get_databases_where_user_has_privileges(
.as_str(), .as_str(),
) )
.bind(username) .bind(username)
.fetch_all(conn) .fetch_all(connection)
.await? .await?
.into_iter() .into_iter()
.map(|databases| databases.try_get::<String, _>("database").unwrap()) .map(|databases| databases.try_get::<String, _>("database").unwrap())

29
src/core/database_privilege_operations.rs
View File

@ -5,7 +5,7 @@
//! //!
//! A lot of the complexity comes from two core components: //! A lot of the complexity comes from two core components:
//! //!
//! - The permission editor that needs to be able to print //! - The privilege editor that needs to be able to print
//! an editable table of privileges and reparse the content //! an editable table of privileges and reparse the content
//! after the user has made manual changes. //! after the user has made manual changes.
//! //!
@ -28,6 +28,9 @@ use crate::core::{
database_operations::validate_database_name, database_operations::validate_database_name,
}; };
/// This is the list of fields that are used to fetch the db + user + privileges
/// from the `db` table in the database. If you need to add or remove privilege
/// fields, this is a good place to start.
pub const DATABASE_PRIVILEGE_FIELDS: [&str; 13] = [ pub const DATABASE_PRIVILEGE_FIELDS: [&str; 13] = [
"db", "db",
"user", "user",
@ -142,7 +145,7 @@ impl FromRow<'_, MySqlRow> for DatabasePrivilegeRow {
pub async fn get_database_privileges( pub async fn get_database_privileges(
database_name: &str, database_name: &str,
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<Vec<DatabasePrivilegeRow>> { ) -> anyhow::Result<Vec<DatabasePrivilegeRow>> {
let unix_user = get_current_unix_user()?; let unix_user = get_current_unix_user()?;
validate_database_name(database_name, &unix_user)?; validate_database_name(database_name, &unix_user)?;
@ -155,7 +158,7 @@ pub async fn get_database_privileges(
.join(","), .join(","),
)) ))
.bind(database_name) .bind(database_name)
.fetch_all(conn) .fetch_all(connection)
.await .await
.context("Failed to show database")?; .context("Failed to show database")?;
@ -163,7 +166,7 @@ pub async fn get_database_privileges(
} }
pub async fn get_all_database_privileges( pub async fn get_all_database_privileges(
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<Vec<DatabasePrivilegeRow>> { ) -> anyhow::Result<Vec<DatabasePrivilegeRow>> {
let unix_user = get_current_unix_user()?; let unix_user = get_current_unix_user()?;
@ -181,7 +184,7 @@ pub async fn get_all_database_privileges(
.join(","), .join(","),
)) ))
.bind(create_user_group_matching_regex(&unix_user)) .bind(create_user_group_matching_regex(&unix_user))
.fetch_all(conn) .fetch_all(connection)
.await .await
.context("Failed to show databases")?; .context("Failed to show databases")?;
@ -227,7 +230,7 @@ pub enum DatabasePrivilegesDiff {
Deleted(DatabasePrivilegeRow), Deleted(DatabasePrivilegeRow),
} }
pub async fn diff_permissions( pub async fn diff_privileges(
from: Vec<DatabasePrivilegeRow>, from: Vec<DatabasePrivilegeRow>,
to: &[DatabasePrivilegeRow], to: &[DatabasePrivilegeRow],
) -> Vec<DatabasePrivilegesDiff> { ) -> Vec<DatabasePrivilegesDiff> {
@ -265,9 +268,9 @@ pub async fn diff_permissions(
result result
} }
pub async fn apply_permission_diffs( pub async fn apply_privilege_diffs(
diffs: Vec<DatabasePrivilegesDiff>, diffs: Vec<DatabasePrivilegesDiff>,
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<()> { ) -> anyhow::Result<()> {
for diff in diffs { for diff in diffs {
match diff { match diff {
@ -297,7 +300,7 @@ pub async fn apply_permission_diffs(
.bind(yn(p.create_tmp_table_priv)) .bind(yn(p.create_tmp_table_priv))
.bind(yn(p.lock_tables_priv)) .bind(yn(p.lock_tables_priv))
.bind(yn(p.references_priv)) .bind(yn(p.references_priv))
.execute(&mut *conn) .execute(&mut *connection)
.await?; .await?;
} }
DatabasePrivilegesDiff::Modified(p) => { DatabasePrivilegesDiff::Modified(p) => {
@ -315,14 +318,14 @@ pub async fn apply_permission_diffs(
) )
.bind(p.db) .bind(p.db)
.bind(p.user) .bind(p.user)
.execute(&mut *conn) .execute(&mut *connection)
.await?; .await?;
} }
DatabasePrivilegesDiff::Deleted(p) => { DatabasePrivilegesDiff::Deleted(p) => {
sqlx::query("DELETE FROM `db` WHERE `db` = ? AND `user` = ?") sqlx::query("DELETE FROM `db` WHERE `db` = ? AND `user` = ?")
.bind(p.db) .bind(p.db)
.bind(p.user) .bind(p.user)
.execute(&mut *conn) .execute(&mut *connection)
.await?; .await?;
} }
} }
@ -349,7 +352,7 @@ mod tests {
} }
#[tokio::test] #[tokio::test]
async fn test_diff_permissions() { async fn test_diff_privileges() {
let from = vec![DatabasePrivilegeRow { let from = vec![DatabasePrivilegeRow {
db: "db".to_owned(), db: "db".to_owned(),
user: "user".to_owned(), user: "user".to_owned(),
@ -382,7 +385,7 @@ mod tests {
references_priv: true, references_priv: true,
}]; }];
let diffs = diff_permissions(from, &to).await; let diffs = diff_privileges(from, &to).await;
assert_eq!( assert_eq!(
diffs, diffs,

36
src/core/user_operations.rs
View File

@ -10,7 +10,7 @@ use super::common::{
validate_ownership_by_user_prefix, validate_ownership_by_user_prefix,
}; };
pub async fn user_exists(db_user: &str, conn: &mut MySqlConnection) -> anyhow::Result<bool> { pub async fn user_exists(db_user: &str, connection: &mut MySqlConnection) -> anyhow::Result<bool> {
let unix_user = get_current_unix_user()?; let unix_user = get_current_unix_user()?;
validate_user_name(db_user, &unix_user)?; validate_user_name(db_user, &unix_user)?;
@ -25,42 +25,48 @@ pub async fn user_exists(db_user: &str, conn: &mut MySqlConnection) -> anyhow::R
"#, "#,
) )
.bind(db_user) .bind(db_user)
.fetch_one(conn) .fetch_one(connection)
.await? .await?
.get::<bool, _>(0); .get::<bool, _>(0);
Ok(user_exists) Ok(user_exists)
} }
pub async fn create_database_user(db_user: &str, conn: &mut MySqlConnection) -> anyhow::Result<()> { pub async fn create_database_user(
db_user: &str,
connection: &mut MySqlConnection,
) -> anyhow::Result<()> {
let unix_user = get_current_unix_user()?; let unix_user = get_current_unix_user()?;
validate_user_name(db_user, &unix_user)?; validate_user_name(db_user, &unix_user)?;
if user_exists(db_user, conn).await? { if user_exists(db_user, connection).await? {
anyhow::bail!("User '{}' already exists", db_user); anyhow::bail!("User '{}' already exists", db_user);
} }
// NOTE: see the note about SQL injections in `validate_ownership_of_user_name` // NOTE: see the note about SQL injections in `validate_ownership_of_user_name`
sqlx::query(format!("CREATE USER {}@'%'", quote_literal(db_user),).as_str()) sqlx::query(format!("CREATE USER {}@'%'", quote_literal(db_user),).as_str())
.execute(conn) .execute(connection)
.await?; .await?;
Ok(()) Ok(())
} }
pub async fn delete_database_user(db_user: &str, conn: &mut MySqlConnection) -> anyhow::Result<()> { pub async fn delete_database_user(
db_user: &str,
connection: &mut MySqlConnection,
) -> anyhow::Result<()> {
let unix_user = get_current_unix_user()?; let unix_user = get_current_unix_user()?;
validate_user_name(db_user, &unix_user)?; validate_user_name(db_user, &unix_user)?;
if !user_exists(db_user, conn).await? { if !user_exists(db_user, connection).await? {
anyhow::bail!("User '{}' does not exist", db_user); anyhow::bail!("User '{}' does not exist", db_user);
} }
// NOTE: see the note about SQL injections in `validate_ownership_of_user_name` // NOTE: see the note about SQL injections in `validate_ownership_of_user_name`
sqlx::query(format!("DROP USER {}@'%'", quote_literal(db_user),).as_str()) sqlx::query(format!("DROP USER {}@'%'", quote_literal(db_user),).as_str())
.execute(conn) .execute(connection)
.await?; .await?;
Ok(()) Ok(())
@ -69,12 +75,12 @@ pub async fn delete_database_user(db_user: &str, conn: &mut MySqlConnection) ->
pub async fn set_password_for_database_user( pub async fn set_password_for_database_user(
db_user: &str, db_user: &str,
password: &str, password: &str,
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<()> { ) -> anyhow::Result<()> {
let unix_user = crate::core::common::get_current_unix_user()?; let unix_user = crate::core::common::get_current_unix_user()?;
validate_user_name(db_user, &unix_user)?; validate_user_name(db_user, &unix_user)?;
if !user_exists(db_user, conn).await? { if !user_exists(db_user, connection).await? {
anyhow::bail!("User '{}' does not exist", db_user); anyhow::bail!("User '{}' does not exist", db_user);
} }
@ -87,7 +93,7 @@ pub async fn set_password_for_database_user(
) )
.as_str(), .as_str(),
) )
.execute(conn) .execute(connection)
.await?; .await?;
Ok(()) Ok(())
@ -113,7 +119,7 @@ pub struct DatabaseUser {
/// unix username and group names of the given unix user. /// unix username and group names of the given unix user.
pub async fn get_all_database_users_for_unix_user( pub async fn get_all_database_users_for_unix_user(
unix_user: &User, unix_user: &User,
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<Vec<DatabaseUser>> { ) -> anyhow::Result<Vec<DatabaseUser>> {
let users = sqlx::query_as::<_, DatabaseUser>( let users = sqlx::query_as::<_, DatabaseUser>(
r#" r#"
@ -126,7 +132,7 @@ pub async fn get_all_database_users_for_unix_user(
"#, "#,
) )
.bind(create_user_group_matching_regex(unix_user)) .bind(create_user_group_matching_regex(unix_user))
.fetch_all(conn) .fetch_all(connection)
.await?; .await?;
Ok(users) Ok(users)
@ -135,7 +141,7 @@ pub async fn get_all_database_users_for_unix_user(
/// This function fetches a database user if it exists. /// This function fetches a database user if it exists.
pub async fn get_database_user_for_user( pub async fn get_database_user_for_user(
username: &str, username: &str,
conn: &mut MySqlConnection, connection: &mut MySqlConnection,
) -> anyhow::Result<Option<DatabaseUser>> { ) -> anyhow::Result<Option<DatabaseUser>> {
let user = sqlx::query_as::<_, DatabaseUser>( let user = sqlx::query_as::<_, DatabaseUser>(
r#" r#"
@ -148,7 +154,7 @@ pub async fn get_database_user_for_user(
"#, "#,
) )
.bind(username) .bind(username)
.fetch_optional(conn) .fetch_optional(connection)
.await?; .await?;
Ok(user) Ok(user)