Add PostgreSQL CREATE USER and ALTER USER support

ramnes · ramnes · commit d38c2d06623d · 2025-08-26T22:09:24.000+02:00
Currently, the library only supports `CREATE ROLE` and `ALTER ROLE` for
PostgreSQL. `CREATE USER` and `ALTER USER` fail to parse with errors
like `"Expected: an object type after CREATE, found: USER"`

But in PostgreSQL reference:
- `CREATE USER` is equivalent to `CREATE ROLE`, except that `LOGIN` is assumed by default
- `ALTER USER` is an alias to `ALTER ROLE`
- Both should support the same options as their ROLE counterparts

This commit extends the existing `CreateRole` and `AlterRole`
structures to distinct which keyword has been used: `USER` or
`ROLE`. It allows these expressions to be parsed and displayed back.
diff --git a/src/ast/dcl.rs b/src/ast/dcl.rs
@@ -31,6 +31,26 @@ use sqlparser_derive::{Visit, VisitMut};
 use super::{display_comma_separated, Expr, Ident, Password};
 use crate::ast::{display_separated, ObjectName};
 
+/// Represents whether ROLE or USER keyword was used in CREATE/ALTER statements.
+/// In PostgreSQL, CREATE USER and ALTER USER are equivalent to CREATE ROLE and ALTER ROLE,
+/// with CREATE USER having LOGIN enabled by default.
+#[derive(Debug, Clone, PartialEq, PartialOrd, Eq, Ord, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "visitor", derive(Visit, VisitMut))]
+pub enum RoleKeyword {
+    Role,
+    User,
+}
+
+impl fmt::Display for RoleKeyword {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match self {
+            RoleKeyword::Role => write!(f, "ROLE"),
+            RoleKeyword::User => write!(f, "USER"),
+        }
+    }
+}
+
 /// An option in `ROLE` statement.
 ///
 /// <https://www.postgresql.org/docs/current/sql-createrole.html>
diff --git a/src/ast/mod.rs b/src/ast/mod.rs
@@ -55,7 +55,7 @@ pub use self::data_type::{
     ExactNumberInfo, IntervalFields, StructBracketKind, TimezoneInfo,
 };
 pub use self::dcl::{
-    AlterRoleOperation, ResetConfig, RoleOption, SecondaryRoles, SetConfigValue, Use,
+    AlterRoleOperation, ResetConfig, RoleKeyword, RoleOption, SecondaryRoles, SetConfigValue, Use,
 };
 pub use self::ddl::{
     AlterColumnOperation, AlterConnectorOwner, AlterIndexOperation, AlterPolicyOperation,
@@ -3314,6 +3314,8 @@ pub enum Statement {
     CreateRole {
         names: Vec<ObjectName>,
         if_not_exists: bool,
+        /// Whether ROLE or USER keyword was used
+        keyword: RoleKeyword,
         // Postgres
         login: Option<bool>,
         inherit: Option<bool>,
@@ -3421,6 +3423,8 @@ pub enum Statement {
     /// ```
     AlterRole {
         name: Ident,
+        /// Whether ROLE or USER keyword was used
+        keyword: RoleKeyword,
         operation: AlterRoleOperation,
     },
     /// ```sql
@@ -5279,6 +5283,7 @@ impl fmt::Display for Statement {
             Statement::CreateRole {
                 names,
                 if_not_exists,
+                keyword,
                 inherit,
                 login,
                 bypassrls,
@@ -5298,7 +5303,7 @@ impl fmt::Display for Statement {
             } => {
                 write!(
                     f,
-                    "CREATE ROLE {if_not_exists}{names}{superuser}{create_db}{create_role}{inherit}{login}{replication}{bypassrls}",
+                    "CREATE {keyword} {if_not_exists}{names}{superuser}{create_db}{create_role}{inherit}{login}{replication}{bypassrls}",
                     if_not_exists = if *if_not_exists { "IF NOT EXISTS " } else { "" },
                     names = display_separated(names, ", "),
                     superuser = match *superuser {
@@ -5337,6 +5342,7 @@ impl fmt::Display for Statement {
                         None => ""
                     }
                 )?;
+
                 if let Some(limit) = connection_limit {
                     write!(f, " CONNECTION LIMIT {limit}")?;
                 }
@@ -5506,8 +5512,12 @@ impl fmt::Display for Statement {
             Statement::AlterType(AlterType { name, operation }) => {
                 write!(f, "ALTER TYPE {name} {operation}")
             }
-            Statement::AlterRole { name, operation } => {
-                write!(f, "ALTER ROLE {name} {operation}")
+            Statement::AlterRole {
+                name,
+                keyword,
+                operation,
+            } => {
+                write!(f, "ALTER {keyword} {name} {operation}")
             }
             Statement::AlterPolicy {
                 name,
diff --git a/src/parser/alter.rs b/src/parser/alter.rs
@@ -19,7 +19,7 @@ use super::{Parser, ParserError};
 use crate::{
     ast::{
         AlterConnectorOwner, AlterPolicyOperation, AlterRoleOperation, Expr, Password, ResetConfig,
-        RoleOption, SetConfigValue, Statement,
+        RoleKeyword, RoleOption, SetConfigValue, Statement,
     },
     dialect::{MsSqlDialect, PostgreSqlDialect},
     keywords::Keyword,
@@ -39,6 +39,15 @@ impl Parser<'_> {
         ))
     }
 
+    pub fn parse_alter_user(&mut self) -> Result<Statement, ParserError> {
+        if dialect_of!(self is PostgreSqlDialect) {
+            return self.parse_pg_alter_user();
+        }
+        Err(ParserError::ParserError(
+            "ALTER USER is only supported for PostgreSqlDialect".into(),
+        ))
+    }
+
     /// Parse ALTER POLICY statement
     /// ```sql
     /// ALTER POLICY policy_name ON table_name [ RENAME TO new_name ]
@@ -162,11 +171,23 @@ impl Parser<'_> {
 
         Ok(Statement::AlterRole {
             name: role_name,
+            keyword: RoleKeyword::Role,
             operation,
         })
     }
 
     fn parse_pg_alter_role(&mut self) -> Result<Statement, ParserError> {
+        self.parse_pg_alter_role_or_user(RoleKeyword::Role)
+    }
+
+    fn parse_pg_alter_user(&mut self) -> Result<Statement, ParserError> {
+        self.parse_pg_alter_role_or_user(RoleKeyword::User)
+    }
+
+    fn parse_pg_alter_role_or_user(
+        &mut self,
+        keyword: RoleKeyword,
+    ) -> Result<Statement, ParserError> {
         let role_name = self.parse_identifier()?;
 
         // [ IN DATABASE _`database_name`_ ]
@@ -246,6 +267,7 @@ impl Parser<'_> {
 
         Ok(Statement::AlterRole {
             name: role_name,
+            keyword,
             operation,
         })
     }
diff --git a/src/parser/mod.rs b/src/parser/mod.rs
@@ -4788,6 +4788,10 @@ impl<'a> Parser<'a> {
     }
 
     fn parse_create_user(&mut self, or_replace: bool) -> Result<Statement, ParserError> {
+        if dialect_of!(self is PostgreSqlDialect) {
+            return self.parse_pg_create_user();
+        }
+
         let if_not_exists = self.parse_keywords(&[Keyword::IF, Keyword::NOT, Keyword::EXISTS]);
         let name = self.parse_identifier()?;
         let options = self.parse_key_value_options(false, &[Keyword::WITH, Keyword::TAG])?;
@@ -5995,6 +5999,17 @@ impl<'a> Parser<'a> {
     }
 
     pub fn parse_create_role(&mut self) -> Result<Statement, ParserError> {
+        self.parse_pg_create_role_or_user(RoleKeyword::Role)
+    }
+
+    pub fn parse_pg_create_user(&mut self) -> Result<Statement, ParserError> {
+        self.parse_pg_create_role_or_user(RoleKeyword::User)
+    }
+
+    fn parse_pg_create_role_or_user(
+        &mut self,
+        keyword: RoleKeyword,
+    ) -> Result<Statement, ParserError> {
         let if_not_exists = self.parse_keywords(&[Keyword::IF, Keyword::NOT, Keyword::EXISTS]);
         let names = self.parse_comma_separated(|p| p.parse_object_name(false))?;
 
@@ -6196,9 +6211,15 @@ impl<'a> Parser<'a> {
             }?
         }
 
+        // In PostgreSQL, CREATE USER defaults to LOGIN=true, CREATE ROLE defaults to LOGIN=false
+        if login.is_none() && keyword == RoleKeyword::User {
+            login = Some(true);
+        }
+
         Ok(Statement::CreateRole {
             names,
             if_not_exists,
+            keyword,
             login,
             inherit,
             bypassrls,
@@ -9263,6 +9284,7 @@ impl<'a> Parser<'a> {
             Keyword::TABLE,
             Keyword::INDEX,
             Keyword::ROLE,
+            Keyword::USER,
             Keyword::POLICY,
             Keyword::CONNECTOR,
             Keyword::ICEBERG,
@@ -9300,6 +9322,7 @@ impl<'a> Parser<'a> {
                 })
             }
             Keyword::ROLE => self.parse_alter_role(),
+            Keyword::USER => self.parse_alter_user(),
             Keyword::POLICY => self.parse_alter_policy(),
             Keyword::CONNECTOR => self.parse_alter_connector(),
             // unreachable because expect_one_of_keywords used above
diff --git a/tests/sqlparser_mssql.rs b/tests/sqlparser_mssql.rs
@@ -802,6 +802,7 @@ fn parse_alter_role() {
                 quote_style: None,
                 span: Span::empty(),
             },
+            keyword: RoleKeyword::Role,
             operation: AlterRoleOperation::RenameRole {
                 role_name: Ident {
                     value: "new_name".into(),
@@ -821,6 +822,7 @@ fn parse_alter_role() {
                 quote_style: None,
                 span: Span::empty(),
             },
+            keyword: RoleKeyword::Role,
             operation: AlterRoleOperation::AddMember {
                 member_name: Ident {
                     value: "new_member".into(),
@@ -840,6 +842,7 @@ fn parse_alter_role() {
                 quote_style: None,
                 span: Span::empty(),
             },
+            keyword: RoleKeyword::Role,
             operation: AlterRoleOperation::DropMember {
                 member_name: Ident {
                     value: "old_member".into(),
diff --git a/tests/sqlparser_postgres.rs b/tests/sqlparser_postgres.rs
