Skip to content

fix: add view privilege (GRANT/REVOKE) support to plan/apply#272

Open
dilame wants to merge 1 commit intostripe:mainfrom
dilame:fix/view-privilege-diffs
Open

fix: add view privilege (GRANT/REVOKE) support to plan/apply#272
dilame wants to merge 1 commit intostripe:mainfrom
dilame:fix/view-privilege-diffs

Conversation

@dilame
Copy link
Copy Markdown

@dilame dilame commented Mar 23, 2026

Fixes #271

Summary

pg-schema-diff plan ignores VIEW ACL diffs — both missing GRANT and missing REVOKE. Table privileges work correctly, but views are completely excluded from the privilege pipeline.

Root cause

Three layers:

  1. SQL query (internal/queries/queries.sql): GetTablePrivileges filters relkind IN ('r', 'p'), excluding views ('v')
  2. Schema model (internal/schema/schema.go): View struct has no Privileges field
  3. Diff/plan logic (pkg/diff/view_sql_generator.go): viewDiff has no privilegesDiff, Add() emits no GRANTs, Alter() does not diff privileges

Changes

  • Include views (relkind = 'v') in GetTablePrivileges query
  • Add Privileges []TablePrivilege to View struct (reuses existing type)
  • Populate view privileges in fetchViews() via fetchPrivileges()
  • Normalize view privileges in normalizeView()
  • Wire privilege diffing into buildViewDiff() and viewSQLGenerator.{Add,Alter}
  • Add 8 acceptance test cases covering: no-op, grant, revoke, multiple privileges, WITH GRANT OPTION, non-public schema, new view with privileges, drop view with privileges

Test plan

  • All existing acceptance tests pass (no regressions)
  • New TestViewPrivilegeCases covers grant, revoke, grant option, schema-qualified views
  • Verify plan output includes GRANT/REVOKE for views

Fixes stripe#271 — pg-schema-diff plan previously ignored VIEW ACL diffs
(both missing GRANT and missing REVOKE), while table privileges worked
correctly.

Root cause: views (relkind='v') were excluded from the privilege query,
the View struct had no Privileges field, and the view diff pipeline had
no privilege diffing logic.

Changes:
- Include views (relkind='v') in GetTablePrivileges query
- Add Privileges field to View struct
- Populate view privileges in fetchViews()
- Wire privilege diffing into buildViewDiff/viewSQLGenerator
- Add acceptance tests for view privilege scenarios
@cla-assistant
Copy link
Copy Markdown

cla-assistant bot commented Mar 23, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

pg-schema-diff plan ignores VIEW ACL diffs (both missing GRANT and missing REVOKE)

1 participant