Major improvements to auth

[Hydrocharged]

This adds a myriad of tests, in addition to:

• Schema-Wide Table Privileges
• Schema Privileges
• Database Privileges
• Role Memberships

There are also many smaller changes, such as disallowing non-superusers from modifying superusers, and many more.

[github-actions]

	Main	PR
Total	42090	42090
Successful	14517	14534
Failures	27573	27556
Partial Successes1	4689	4689

	Main	PR
Successful	34.4904%	34.5308%
Failures	65.5096%	65.4692%

${\color{lightgreen}Progressions}$

alter_generic

QUERY: GRANT ALL ON SCHEMA alt_nsp1, alt_nsp2 TO public;

create_function_sql

QUERY: GRANT ALL ON SCHEMA temp_func_test TO public;

create_index

QUERY: GRANT USAGE ON SCHEMA pg_toast TO regress_reindexuser;

create_operator

QUERY: GRANT USAGE ON SCHEMA schema_op1 TO PUBLIC;

dependency

QUERY: GRANT CREATE ON DATABASE regression TO regress_dep_user1;

lock

QUERY: GRANT USAGE ON SCHEMA lock_schema1 TO regress_rol_lock1;

matview

QUERY: GRANT ALL ON SCHEMA matview_schema TO public;

publication

QUERY: GRANT CREATE ON DATABASE regression TO regress_publication_user2;

QUERY: GRANT regress_publication_user TO regress_publication_user2;

QUERY: REVOKE CREATE ON DATABASE regression FROM regress_publication_user2;

rowsecurity

QUERY: GRANT regress_rls_group1 TO regress_rls_bob;

QUERY: GRANT regress_rls_group2 TO regress_rls_carol;

QUERY: GRANT ALL ON SCHEMA regress_rls_schema to public;

select_into

QUERY: GRANT ALL ON SCHEMA selinto_schema TO public;

stats_ext

QUERY: GRANT USAGE ON SCHEMA tststats TO regress_stats_user1;

tablespace

QUERY: GRANT USAGE ON SCHEMA testschema TO regress_tablespace_user2;

test_setup

QUERY: GRANT ALL ON SCHEMA public TO public;

${\color{lightgreen}Total Progressions: 17}$

Footnotes

1. These are tests that we're marking as Successful, however they do not match the expected output in some way. This is due to small differences, such as different wording on the error messages, or the column names being incorrect while the data itself is correct. ↩

[zachmu]

LGTM, just minor comments

[zachmu]

Might do a check for current DB and error if it doesn't match

[zachmu]

Same comment elsewhere this happens

[Hydrocharged]

I think we access other DBs in the workbench. At least, tests seemingly related to those fail when I enforce this. So I reverted it and left these as TODOs for now