feat(mysql): Allow to Grant permissions on specific columns in table

[ymaniukevich]

Description of your changes

Improved regexp expression for granting permission to specific columns in MySQL.

Fixes #214, #176

I have:

• Read and followed Crossplane's [contribution process].
• Run make reviewable to ensure this PR is ready for review.

How has this code been tested

apiVersion: mysql.sql.crossplane.io/v1alpha1
kind: Grant
metadata:
  name: user-example
spec:
  forProvider:
    databaseRef:
      name: example-db
    privileges:
      - UPDATE (`status`, `updated_at`)
      - SELECT
    table: requests
    user: user-example@%
  providerConfigRef:
    name: example

[chlunde]

@ymaniukevich would it make sense to update the examples to get e2e coverage here? We'll also need to rebase this PR after #328 is in because e2e will fail now

[chlunde]

@ymaniukevich I guess this also fixes #176 ?

[ymaniukevich]

@chlunde I'll add an e2e test to cover the case of granting table permissions. I've checked issue #176 — you're right, this will fix it as well.

[ymaniukevich]

@ymaniukevich would it make sense to update the examples to get e2e coverage here?

@chlunde I've updated the examples to improve e2e coverage.

[chlunde]

will mysql store this as a string and not normalize it, like reorder or change whitespace (UPDATE(status, updated_at) or UPDATE (updated_at, status))?

[ymaniukevich]

MySQL normalizes the statement: uppercases keywords (even if you write update, it will be stored as UPDATE), adds missing spaces/backticks, and sorts column names alphabetically.

[chlunde]

@ymaniukevich cool, thanks for researching. This will likely burn som users, if they write it in another order. We should at minimum document it, or normalize it outselves in our observe method?

[chlunde]

or disallow it via CEL expression, similar to this, but that's not very pretty 😮‍💨

x-kubernetes-validations:                           
  - rule: >-
      self.spec.forProvider.privileges.all(p,                                       
        !p.contains('(') ||
        p.split('(')[1].split(')')[0].split(', ').isSorted()                        
      )         
    message: "Column names in column-level privileges must be listed alphabetically"

[ymaniukevich]

I don’t think this is actually an issue if the user specifies the order differently. The provider will treat the resource as synced. I already have a managed resource with a different order, and everything works as expected.

Or did I misunderstand your concern?

[chlunde]

My concern is if it reconciles (does an update) every poll interval if the user specifies a different order

[ymaniukevich]

@chlunde you are right — on each loop I see Successfully requested update of external resource for Grant.
I’ll come back with changes (need to fix parseGrant function so it doesn't do the split if we have string with permission on the column)

[ymaniukevich]

I made some changes:

1. Improved the regexp to allow only DML_COMMAND (`col1`, `col2`) or just DML_COMMAND
2. Sort privileges alphabetically when comparing observed and desired state

@chlunde could you take a look when you have time?