cockroachdb / cockroachdb/cockroach
SHOW BACKUP ... WITH PRIVILEGES generates invalid GRANT syntax for UDF's/SP's
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
**Describe the problem**
When restoring a database to another cluster the SHOW BACKUP ... WITH PRIVILEGES command is used to generate GRANTS to re-apply the privileges present on the source cluster where the backup was taken to the database on the new target cluster.
If the database contains Stored Procedures or User Defined Functions the GRANTs created by the SHOW BACKUP command for these object types generates an incorrect GRANT syntax e.g.
GRANT EXECUTE ON ROUTINE test_grants_proc TO public;
**To Reproduce**
-- create a cluster and login
cockroach start-single-node --insecure --background
cockroach sql --insecure
--create a new database
create database test_show_backup_privs;
use test_show_backup_privs;
-- Create a simple SQL function.
CREATE FUNCTION public.test_grants_fn()
RETURNS STRING
LANGUAGE SQL
AS $$
SELECT 'hello from test_grants_fn'
$$;
-- Create a simple SQL procedure.
CREATE PROCEDURE public.test_grants_proc(msg STRING)
LANGUAGE SQL
AS $$
SELECT 'echo: ' || msg;
$$;
-- create a user and grant some privileges
create user test_grants;
grant execute on function public.test_grants_fn to test_grants;
grant execute on procedure public.test_grants_proc to test_grants;
-- backup the database
BACKUP DATABASE test_show_backup_privs INTO 'nodelocal://1/test_show_backup_privs_backup';
-- get details of the backup
SHOW BACKUPS IN 'nodelocal://1/test_show_backup_privs_backup';
-- replace the subdirectory to that shown from above command
-- select the GRANTs generated
select object_name, privileges from [SHOW BACKUP FROM '/2025/12/16-174659.32' IN 'nodelocal://1/test_show_backup_privs_backup' WITH PRIVILEGES] where object_type = 'function';
-- try to run the GRANT statements generated
root@localhost:26257/movr> GRANT EXECUTE ON ROUTINE test_grants_proc TO public;
ERROR: statement ignored: at or near "test_grants_proc": syntax error
SQLSTATE: 42601
DETAIL: source SQL:
GRANT EXECUTE ON ROUTINE test_grants_proc TO public
^
HINT: try \h GRANT
root@localhost:26257/test_show_backup_privs> GRANT EXECUTE ON ROUTINE test_grants_fn TO test_grants;
ERROR: statement ignored: at or near "test_grants_fn": syntax error
SQLSTATE: 42601
DETAIL: source SQL:
GRANT EXECUTE ON ROUTINE test_grants_fn TO test_grants
^
HINT: try \h GRANT
**Expected behavior**
Either the GRANT syntax should support 'GRANT EXECUTE ON ROUTINE' or 'SHOW BACKUP ... WITH PRIVILEGES' should generate the correct 'GRANT EXECUTE ON PROCEDURE|FUNCTION' syntax.
**Additional data / screenshots**
**Environment:**
- CockroachDB version : v25.3.2
- Server OS: aarch64-apple-darwin21
- Client app : cockroach sql
**Additional context**
Jira issue: CRDB-57953
Contributor guide
Assessment
This issue has not been assessed yet.