cockroachdb / cockroachdb/cockroach

SHOW BACKUP ... WITH PRIVILEGES generates invalid GRANT syntax for UDF's/SP's

Open
#159,615 3 comments 0 reactions 1 assignee Claimed by @andrew-r-thomas View on GitHub
A-disaster-recovery branch-release-24.3 branch-release-25.3 C-bug P-3 T-disaster-recovery
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

**Describe the problem**

When restoring a database to another cluster the SHOW BACKUP ... WITH PRIVILEGES command is used to generate GRANTS to re-apply the privileges present on the source cluster where the backup was taken to the database on the new target cluster.
If the database contains Stored Procedures or User Defined Functions the GRANTs created by the SHOW BACKUP command for these object types generates an incorrect GRANT syntax e.g.
GRANT EXECUTE ON ROUTINE test_grants_proc TO public;

**To Reproduce**

-- create a cluster and login
cockroach start-single-node --insecure --background
cockroach sql --insecure

--create a new database
create database test_show_backup_privs;
use test_show_backup_privs;

-- Create a simple SQL function.
CREATE FUNCTION public.test_grants_fn()
RETURNS STRING
LANGUAGE SQL
AS $$
SELECT 'hello from test_grants_fn'
$$;
-- Create a simple SQL procedure.
CREATE PROCEDURE public.test_grants_proc(msg STRING)
LANGUAGE SQL
AS $$
SELECT 'echo: ' || msg;
$$;

-- create a user and grant some privileges
create user test_grants;
grant execute on function public.test_grants_fn to test_grants;
grant execute on procedure public.test_grants_proc to test_grants;

-- backup the database
BACKUP DATABASE test_show_backup_privs INTO 'nodelocal://1/test_show_backup_privs_backup';

-- get details of the backup
SHOW BACKUPS IN 'nodelocal://1/test_show_backup_privs_backup';

-- replace the subdirectory to that shown from above command
-- select the GRANTs generated
select object_name, privileges from [SHOW BACKUP FROM '/2025/12/16-174659.32' IN 'nodelocal://1/test_show_backup_privs_backup' WITH PRIVILEGES] where object_type = 'function';

-- try to run the GRANT statements generated

root@localhost:26257/movr> GRANT EXECUTE ON ROUTINE test_grants_proc TO public;
ERROR: statement ignored: at or near "test_grants_proc": syntax error
SQLSTATE: 42601
DETAIL: source SQL:
GRANT EXECUTE ON ROUTINE test_grants_proc TO public
^
HINT: try \h GRANT

root@localhost:26257/test_show_backup_privs> GRANT EXECUTE ON ROUTINE test_grants_fn TO test_grants;
ERROR: statement ignored: at or near "test_grants_fn": syntax error
SQLSTATE: 42601
DETAIL: source SQL:
GRANT EXECUTE ON ROUTINE test_grants_fn TO test_grants
^
HINT: try \h GRANT

**Expected behavior**
Either the GRANT syntax should support 'GRANT EXECUTE ON ROUTINE' or 'SHOW BACKUP ... WITH PRIVILEGES' should generate the correct 'GRANT EXECUTE ON PROCEDURE|FUNCTION' syntax.

**Additional data / screenshots**

**Environment:**
- CockroachDB version : v25.3.2
- Server OS: aarch64-apple-darwin21
- Client app : cockroach sql

**Additional context**

Jira issue: CRDB-57953

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.