tarantool / tarantool / 16469240759

88%

push

github

box: fix misleading errors on privilege revoke from admin

Trying to revoke privileges from an admin user or a super role results
in misleading errors:
```
error: 'Tuple field 5 (privilege) type does not match one required by operation:
    expected unsigned, got integer'
```

The reason is that privileges use bit module for privilege grant/revoke,
and this module operates 32-bit **signed** integers (see
https://bitop.luajit.org/semantics.html#range for details). So any bit
operation on a privilege set greater than 2^31 (for example,
box.priv.ALL == 2^32 - 1) results in a negative number:

```lua
tarantool> bit.band(box.priv.ALL, bit.bnot(box.priv.W))
---
- -3
...

```

Fortunately, this can be fixed by casting one of the operands to a
uint64_t type, so let's cast all granted or revoked privileges prior to
calculating the resulting privilege set.

Closes #11526

NO_DOC=bugfix

70700 of 124581 branches covered (56.75%)

103959 of 118706 relevant lines covered (87.58%)

1355767.78 hits per line