direct: revoke grants when the grants node is deleted and the parent stays - #6474
Open
shreyas-goenka wants to merge 4 commits into
Open
direct: revoke grants when the grants node is deleted and the parent stays#6474shreyas-goenka wants to merge 4 commits into
shreyas-goenka wants to merge 4 commits into
Conversation
…stays DoDelete for grants was a deliberate no-op, so removing a grants block left every grant in place. It now revokes what is actually assigned, including out-of-band grants, because dropping the node means the empty list is what the bundle enforces. The no-op existed to keep `bundle destroy` working, so apply now distinguishes the two triggers: when the parent resource is deleted in the same plan it takes the child with it, and the child delete is applied as a state-only cleanup instead. Co-authored-by: Isaac <no-reply@databricks.com>
Replaces the unit tests with an acceptance test that records the plan, the requests each deploy sends and the grants left on the schema for all three cases: the grants block removed, the list set to [], and the schema deleted along with its grants. The goldens are per-engine because the engines still disagree on the second case (direct plans an update, terraform a delete) and on the third, where terraform sends a redundant revoke for a securable it is about to drop. Also shortens childDeletesWithDeletedParent to willDeleteParent. Co-authored-by: Isaac <no-reply@databricks.com>
exhaustruct wants every field of catalog.UpdatePermissions listed, matching DoUpdate. The test wrote 16 golden files, one per case per engine. All three cases now append to a single per-engine file, so the whole comparison reads top to bottom in one place and the directory holds two goldens instead of sixteen. Co-authored-by: Isaac <no-reply@databricks.com>
`bundle destroy` hides child nodes from its banner, so the case where the parent goes away never showed what the grants node was planned as. Planning against a config with the schema removed names both nodes and their action, which is the same shape destroy applies: both are a delete, and only the parent's reaches the API on direct. Co-authored-by: Isaac <no-reply@databricks.com>
shreyas-goenka
marked this pull request as ready for review
September 2, 2026 02:24
Contributor
Approval status: pending
|
shreyas-goenka
requested review from
denik and
pietern
and removed request for
denik
September 2, 2026 11:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Grants will now be deleted on removal. When
grants: []is explicitly specified, we'll enforce an empty list, only allowing inhereted grants.