Automatically give %Developer SELECT privileges on %Studio_SourceControl.Change and SourceControl_Git.Change

[isc-tleavitt]

Might need to do this in a %z class with $$$AddAllRoleTemporary

This seems to be new to 2024.1 - need to understand why.

[isc-tleavitt]

This is definitely new to 2024.1 - if I run:
select * from %Studio_SourceControl.Change

On 2023.1.2 (which I have handy), given a user with %Developer, %SQL, and read on the current DB, it's fine. I get SQLCODE -99 on 2024.1.

[isc-tleavitt]

Actually this is just a matter of the system-level "SQL security enabled" flag - see:
d $system.SQL.CurrentSettings()

[isc-tleavitt]

Can also use a different sql variant to get around this. (That's what we should do.)

[isc-tleavitt]

@isc-hwojnick here's the short story here:
A user with %Development:USE (not even necessarily %Developer, ideally) should be able to use git-source-control exactly the same as a user with %All.
There are a few places that are / might be running in to issues related to this. Ultimately, it boils down to the note from https://docs.intersystems.com/iris20241/csp/docbook/DocBook.UI.Page.cls?KEY=GSQL_privileges :

"InterSystems SQL enforces privilege checking for ODBC, JDBC, Dynamic SQL, and the SQL Shell interface on InterSystems IRIS data platform. Embedded SQL statements do not perform privilege checking; it is assumed that applications using Embedded SQL will check for privileges before using Embedded SQL statements. Similarly, direct invocation of class queries that do not involve %SQL.Statement objects is considered application access and does not check for SQL privileges."

There are a few places that we use %SQL.Statement in our codebase:
SourceControl.Git.Change:GetOtherDeveloperChanges - this could be an issue and might be the root cause for this issue. To fix, see https://docs.intersystems.com/irislatest/csp/documatic/%25CSP.Documatic.cls?LIBRARY=%25SYS&CLASSNAME=%25SQL.Statement#%25Prepare - want to call %Prepare with checkPriv = 0
SourceControl.Git.Utils:ConfigureWeb - none of these are relevant because it's install-time and expected to be installed with sufficient privileges.

There might also be one or two things in %Studio.SourceControl.Change that are subject to this - need to investigate/test.