*: Implementing RENAME USER

executor/simple.go

@@ -138,6 +138,8 @@ func (e *SimpleExec) Next(ctx context.Context, req *chunk.Chunk) (err error) {
 		err = e.executeAlterUser(x)
 	case *ast.DropUserStmt:
 		err = e.executeDropUser(x)
+	case *ast.RenameUserStmt:
+		err = e.executeRenameUser(x)
 	case *ast.SetPwdStmt:
 		err = e.executeSetPwd(x)
 	case *ast.KillStmt:
@@ -1048,6 +1050,143 @@ func (e *SimpleExec) executeGrantRole(s *ast.GrantRoleStmt) error {
 	return nil
 }
 
+// Should cover same internal mysql.* tables as DROP USER, so this function is very similar
+func (e *SimpleExec) executeRenameUser(s *ast.RenameUserStmt) error {
+	// Check privileges.
+	// Check `CREATE USER` privilege.
+	// TODO: Also allow UPDATE privilege for the mysql system schema?
+	if !config.GetGlobalConfig().Security.SkipGrantTable {
+		checker := privilege.GetPrivilegeManager(e.ctx)
+		if checker == nil {
+			return errors.New("miss privilege checker")
+		}
+		activeRoles := e.ctx.GetSessionVars().ActiveRoles
+		if !checker.RequestVerification(activeRoles, mysql.SystemDB, "", "", mysql.UpdatePriv) &&
+			!checker.RequestVerification(activeRoles, "", "", "", mysql.CreateUserPriv) {
+			return core.ErrSpecificAccessDenied.GenWithStackByArgs("CREATE USER or UPDATE on mysql.*")
+		}
+	}
+
+	failedUsers := make([]string, 0, len(s.UserToUsers))
+	sysSession, err := e.getSysSession()
+	defer e.releaseSysSession(sysSession)
+	if err != nil {
+		return err
+	}
+	sqlExecutor := sysSession.(sqlexec.SQLExecutor)
+
+	if _, err := sqlExecutor.ExecuteInternal(context.TODO(), "begin"); err != nil {
+		return err
+	}
+
+	for _, userToUser := range s.UserToUsers {
+		oldUser, newUser := userToUser.OldUser, userToUser.NewUser
+		exists, err := userExists(e.ctx, oldUser.Username, oldUser.Hostname)
+		if err != nil {
+			return err
+		}
+		if !exists {
+			failedUsers = append(failedUsers, oldUser.String())
+			break
+		}
+
+		exists, err = userExists(e.ctx, newUser.Username, newUser.Hostname)
+		if err != nil {
+			return err
+		}
+		if exists {
+			failedUsers = append(failedUsers, newUser.String())
+			break
+		}
+
+		// begin a transaction to rename a user.
+		// Could be restructured with an array of table, user/host columns and break/continue for easier maintenance.
+
+		if err = renameUserHostInSystemTable(sqlExecutor, mysql.UserTable, "User", "Host", userToUser); err != nil {
+			failedUsers = append(failedUsers, oldUser.String())
+			break
+		}
+
+		// delete privileges from mysql.global_priv
+		if err = renameUserHostInSystemTable(sqlExecutor, mysql.GlobalPrivTable, "User", "Host", userToUser); err != nil {
+			failedUsers = append(failedUsers, oldUser.String())
+			if _, err := sqlExecutor.ExecuteInternal(context.TODO(), "rollback"); err != nil {
+				return err
+			}
+			continue
+		}
+
+		// delete privileges from mysql.db
+		if err = renameUserHostInSystemTable(sqlExecutor, mysql.DBTable, "User", "Host", userToUser); err != nil {
+			failedUsers = append(failedUsers, oldUser.String())
+			break
+		}
+
+		// delete privileges from mysql.tables_priv
+		if err = renameUserHostInSystemTable(sqlExecutor, mysql.TablePrivTable, "User", "Host", userToUser); err != nil {
+			failedUsers = append(failedUsers, oldUser.String())
+			break
+		}
+
+		// delete relationship from mysql.role_edges
+		if err = renameUserHostInSystemTable(sqlExecutor, mysql.RoleEdgeTable, "TO_USER", "TO_HOST", userToUser); err != nil {
+			failedUsers = append(failedUsers, oldUser.String())
+			break
+		}
+
+		if err = renameUserHostInSystemTable(sqlExecutor, mysql.RoleEdgeTable, "FROM_USER", "FROM_HOST", userToUser); err != nil {
+			failedUsers = append(failedUsers, oldUser.String())
+			// Should we really break here as in DROP USER? it should all be rolled back right for this Old to New rename?
+			// Since the FROM_USER/HOST is already done
+			break
+		}
+
+		// delete relationship from mysql.default_roles
+		if err = renameUserHostInSystemTable(sqlExecutor, mysql.DefaultRoleTable, "DEFAULT_ROLE_USER", "DEFAULT_ROLE_HOST", userToUser); err != nil {
+			failedUsers = append(failedUsers, oldUser.String())
+			break
+		}
+
+		if err = renameUserHostInSystemTable(sqlExecutor, mysql.DefaultRoleTable, "USER", "HOST", userToUser); err != nil {
+			failedUsers = append(failedUsers, oldUser.String())
+			break
+		}
+
+		// delete relationship from mysql.global_grants
+		// TODO: add global_grants into the parser
+		if err = renameUserHostInSystemTable(sqlExecutor, "global_grants", "User", "Host", userToUser); err != nil {
+			failedUsers = append(failedUsers, oldUser.String())
+			break
+		}
+
+		// WASHERE:
+		//TODO: need update columns_priv once we implement columns_priv functionality.
+	}
+
+	if len(failedUsers) == 0 {
+		if _, err := sqlExecutor.ExecuteInternal(context.TODO(), "commit"); err != nil {
+			return err
+		}
+	} else {
+		if _, err := sqlExecutor.ExecuteInternal(context.TODO(), "rollback"); err != nil {
+			return err
+		}
+		return ErrCannotUser.GenWithStackByArgs("RENAME USER", strings.Join(failedUsers, ","))
+	}
+	domain.GetDomain(e.ctx).NotifyUpdatePrivilege(e.ctx)
+	return nil
+}
+
+func renameUserHostInSystemTable(sqlExecutor sqlexec.SQLExecutor, tableName, usernameColumn, hostColumn string, users *ast.UserToUser) error {
+	sql := new(strings.Builder)
+	sqlexec.MustFormatSQL(sql, `UPDATE %n.%n SET %n = %?, %n = %? WHERE %n = %? and %n = %?;`,
+		mysql.SystemDB, tableName,
+		usernameColumn, users.NewUser.Username, hostColumn, users.NewUser.Hostname,
+		usernameColumn, users.OldUser.Username, hostColumn, users.OldUser.Hostname)
+	_, err := sqlExecutor.ExecuteInternal(context.TODO(), sql.String())
+	return err
+}
+
 func (e *SimpleExec) executeDropUser(s *ast.DropUserStmt) error {
 	// Check privileges.
 	// Check `CREATE USER` privilege.
@@ -1411,7 +1550,7 @@ func (e *SimpleExec) executeDropStats(s *ast.DropStatsStmt) (err error) {
 
 func (e *SimpleExec) autoNewTxn() bool {
 	switch e.Statement.(type) {
-	case *ast.CreateUserStmt, *ast.AlterUserStmt, *ast.DropUserStmt:
+	case *ast.CreateUserStmt, *ast.AlterUserStmt, *ast.DropUserStmt, *ast.RenameUserStmt:
 		return true
 	}
 	return false

planner/core/planbuilder.go

@@ -639,7 +639,8 @@ func (b *PlanBuilder) Build(ctx context.Context, node ast.Node) (Plan, error) {
 	case *ast.BinlogStmt, *ast.FlushStmt, *ast.UseStmt, *ast.BRIEStmt,
 		*ast.BeginStmt, *ast.CommitStmt, *ast.RollbackStmt, *ast.CreateUserStmt, *ast.SetPwdStmt, *ast.AlterInstanceStmt,
 		*ast.GrantStmt, *ast.DropUserStmt, *ast.AlterUserStmt, *ast.RevokeStmt, *ast.KillStmt, *ast.DropStatsStmt,
-		*ast.GrantRoleStmt, *ast.RevokeRoleStmt, *ast.SetRoleStmt, *ast.SetDefaultRoleStmt, *ast.ShutdownStmt:
+		*ast.GrantRoleStmt, *ast.RevokeRoleStmt, *ast.SetRoleStmt, *ast.SetDefaultRoleStmt, *ast.ShutdownStmt,
+		*ast.RenameUserStmt:
 		return b.buildSimple(node.(ast.StmtNode))
 	case ast.DDLNode:
 		return b.buildDDL(ctx, x)
@@ -2262,7 +2263,7 @@ func (b *PlanBuilder) buildSimple(node ast.StmtNode) (Plan, error) {
 	case *ast.AlterInstanceStmt:
 		err := ErrSpecificAccessDenied.GenWithStack("SUPER")
 		b.visitInfo = appendVisitInfo(b.visitInfo, mysql.SuperPriv, "", "", "", err)
-	case *ast.AlterUserStmt:
+	case *ast.AlterUserStmt, *ast.RenameUserStmt: // TODO: Is RenameUserStmt needed here?
 		err := ErrSpecificAccessDenied.GenWithStackByArgs("CREATE USER")
 		b.visitInfo = appendVisitInfo(b.visitInfo, mysql.CreateUserPriv, "", "", "", err)
 	case *ast.GrantStmt:

session/session.go

@@ -2810,7 +2810,8 @@ func logStmt(execStmt *executor.ExecStmt, vars *variable.SessionVars) {
 	switch stmt := execStmt.StmtNode.(type) {
 	case *ast.CreateUserStmt, *ast.DropUserStmt, *ast.AlterUserStmt, *ast.SetPwdStmt, *ast.GrantStmt,
 		*ast.RevokeStmt, *ast.AlterTableStmt, *ast.CreateDatabaseStmt, *ast.CreateIndexStmt, *ast.CreateTableStmt,
-		*ast.DropDatabaseStmt, *ast.DropIndexStmt, *ast.DropTableStmt, *ast.RenameTableStmt, *ast.TruncateTableStmt:
+		*ast.DropDatabaseStmt, *ast.DropIndexStmt, *ast.DropTableStmt, *ast.RenameTableStmt, *ast.TruncateTableStmt,
+		*ast.RenameUserStmt:
 		user := vars.User
 		schemaVersion := vars.TxnCtx.SchemaVersion
 		if ss, ok := execStmt.StmtNode.(ast.SensitiveStmtNode); ok {