tarantool / tarantool / 11032491917

88%

push

github

config: grant runtime access to lua_call from config

This patch introduces the ability to grant execution privileges for Lua
functions through declarative configuration, even when the database is
in read-only mode or has an outdated schema version.

Users can specify  `lua_call: [<func_name>]`, enabling the execution of
specified Lua functions (e.g., `failover:execute()` when all instance
are in read-only mode). The `lua_call: [all]` option is also supported,
allowing access to all global Lua functions except built-in ones,
regardless of database mode or status.

Privileges are still written to the database when possible for consistency
and compatibility.

Closes tarantool#10310

@TarantoolBot document
Title: Grant runtime access to Lua functions via configuration

It is now possible to grant execution privileges for Lua functions
through the declarative configuration, even when the database is in
read-only mode or has an outdated schema version.

You can specify function permissions using the `lua_call` option in
the configuration, for example:

```yaml
credentials:
  users:
    alice:
      privileges:
        - permissions: [execute]
          lua_call: [my_func]
```

This grants the `alice` user permission to execute the `my_func` Lua
function, regardless of the database's mode or status. The special option
`lua_call: [all]` is also supported, granting access to all global Lua
functions except built-in ones, bypassing database restrictions.

Privileges will still be written to the database when possible to
maintain compatibility and consistency with other privilege types.

68972 of 122509 branches covered (56.3%)

101738 of 116529 relevant lines covered (87.31%)

2513567.42 hits per line