expression: MySQL compatible current_user function

[morgo]

What problem does this PR solve?

Currently current_user() returns the same as user(), which is incorrect.
Fixes #7613

What is changed and how it works?

Added support for a 'matcheduser' and 'matchedhost'. This will also be required for statements like SHOW GRANTS (without FOR USER option). See #7614

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)

Code changes

• Has exported function/method change
• Has exported variable/fields change
• Has interface methods change

Side effects

• Increased code complexity

Related changes

• Need to update the documentation

[morgo]

/run-all-tests

[morgo]

I started looking at fixing SHOW GRANTS. It is relatively straightforward, but one question I have for reviewers is if SessionVars.User should contain the matched user instead, and have new attributes for the actual user+host.

This would make SHOW GRANTS work without modification. For example see how SHOW GRANTS needs a hack to convert the actual user to the matched user. I suspect there may be other commands that make this mistake:

morgo@ryzen:~/go/src/github.com/pingcap/tidb$ git diff
diff --git a/executor/builder.go b/executor/builder.go
index 1f9ef0e0c..51d9d4c44 100644
--- a/executor/builder.go
+++ b/executor/builder.go
@@ -42,6 +42,7 @@ import (
        "github.com/pingcap/tidb/table"
        "github.com/pingcap/tidb/types"
        "github.com/pingcap/tidb/util/admin"
+       "github.com/pingcap/tidb/util/auth"
        "github.com/pingcap/tidb/util/chunk"
        "github.com/pingcap/tidb/util/ranger"
        "github.com/pingcap/tidb/util/timeutil"
@@ -484,7 +485,10 @@ func (b *executorBuilder) buildShow(v *plannercore.Show) Executor {
                is:           b.is,
        }
        if e.Tp == ast.ShowGrants && e.User == nil {
-               e.User = e.ctx.GetSessionVars().User
+               e.User = &auth.UserIdentity{
+                       Username:        e.ctx.GetSessionVars().User.MatchedUsername,
+                       Hostname:        e.ctx.GetSessionVars().User.MatchedHostname,
+               }
        }
        if len(v.Conditions) == 0 {
                return e
diff --git a/planner/core/planbuilder.go b/planner/core/planbuilder.go
index 33c48c11a..f15890462 100644
--- a/planner/core/planbuilder.go
+++ b/planner/core/planbuilder.go
@@ -1576,7 +1576,15 @@ func buildShowSchema(s *ast.ShowStmt) (schema *expression.Schema) {
        case ast.ShowCreateDatabase:
                names = []string{"Database", "Create Database"}
        case ast.ShowGrants:
-               names = []string{fmt.Sprintf("Grants for %s", s.User)}
+
+               if s.User != nil {
+                       names = []string{fmt.Sprintf("Grants for %s", s.User)}
+               } else {
+                       // Default to the session user
+                       // Can't grab the name from here.
+                       names = []string{fmt.Sprintf("Grants for User")}
+               }
+
        case ast.ShowIndex:
                names = []string{"Table", "Non_unique", "Key_name", "Seq_in_index",
                        "Column_name", "Collation", "Cardinality", "Sub_part", "Packed",

I have not tested how much breaks yet by setting SessionVars.User to the matched user. Looking for reviewer feedback :-) Thx.

[winoros]

Package Privilege's maintainer is on vacation. There may not be quick response. :(

[morgo]

No problems :-)

I noticed one counterpoint today. In show processlist you want the actual identity rather than the matched identity, so this would create a bug if the meaning of SessionVars.User was changed.

https://github.com/pingcap/tidb/blob/master/session/session.go#L715-L718

[tiancaiamao]

I think add the matched user & host fields is okay.
Well done! @morgo

[tiancaiamao]

How about change this method signature to

// ConnectionVerification verifies user privilege for connection.
// Returns the actual user+host from the privileges table, including any wildcard characters.
ConnectionVerification(user, host string, auth, salt []byte) (string, string, bool)

Then we can remove the ConnectionMatchIdentity method ?

[tiancaiamao]

It could be done once if ConnectionVerification returns the matched user & host.

[morgo]

Sounds good. I thought about this some more, and I think we should call it AuthUsername + AuthHostname, since it describes which user/hostname matched for auth purposes. Would you agree?

[tiancaiamao]

Agree!

[morgo]

I've made the suggested changes, and renamed matched* to auth*. It looks cleaner - thank you for the feedback.

Should the authUser and AuthHost also be part of the UserPrivileges struct?

[tiancaiamao]

LGTM
/run-all-tests

[tiancaiamao]

/run-all-tests

[tiancaiamao]

/run-unit-test

[tiancaiamao]

PTAL @lysu

[lysu]

LGTM