influxdata / influxdata/influxdb

can't fully remove a database from user grants

Open
#7,579 4 comments 0 reactions 0 assignees View on GitHub
1.x kind/feature-request security security/misc
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

### Feature Request

__Proposal:__ [Description of the feature]

Dropping a database should remove it from all user grants.

__Current behavior:__ [What currently happens]

DBs are listed forever, even if no privs and the db is dropped.

__Use case:__ [Why is this important (helps with prioritizing requests)]

Cleanliness, esp if many databases are created over time.

```
> show grants for alice
database privilege
boop READ

> drop database boop
> show grants for alice
database privilege
boop READ

> revoke all on boop from alice
> show grants for alice
database privilege
boop NO PRIVILEGES

> grant read on mydb to alice
> show grants for alice
database privilege
boop NO PRIVILEGES
mydb READ

> revoke all on mydb from alice
> show grants for alice
database privilege
boop NO PRIVILEGES
mydb NO PRIVILEGES

>
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the shown grant, drop database, show grants, and revoke commands. Trace the database-drop and user-grant handling paths to find where database entries remain. Done means dropping a database removes it from every user's grants, including entries with no remaining privileges, and the example sequence no longer lists it.

Written by the indexing model from the issue text.

Assessment

Domain
authorization, databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.