diff --git a/fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Role.java b/fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Role.java index fcb899e09a..e4a68be449 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Role.java +++ b/fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Role.java @@ -637,19 +637,22 @@ public class Role implements Writable, GsonPostProcessable { public void revokePrivs(TablePattern tblPattern, PrivBitSet privs, Map> colPrivileges, boolean errOnNonExist) throws DdlException { - PrivBitSet existingPriv = tblPatternToPrivs.get(tblPattern); - if (existingPriv == null) { - if (errOnNonExist) { - throw new DdlException(tblPattern + " does not exist in role " + roleName); + if (!colPrivileges.isEmpty()) { + revokeCols(colPrivileges); + } else { + PrivBitSet existingPriv = tblPatternToPrivs.get(tblPattern); + if (existingPriv == null) { + if (errOnNonExist) { + throw new DdlException(tblPattern + " does not exist in role " + roleName); + } + return; } - return; + existingPriv.remove(privs); + if (existingPriv.isEmpty()) { + tblPatternToPrivs.remove(tblPattern); + } + revokePrivs(tblPattern, privs); } - existingPriv.remove(privs); - if (existingPriv.isEmpty()) { - tblPatternToPrivs.remove(tblPattern); - } - revokePrivs(tblPattern, privs); - revokeCols(colPrivileges); } private void revokeCols(Map> colPrivileges) { @@ -661,6 +664,12 @@ public class Role implements Writable, GsonPostProcessable { colPrivMap.get(entry.getKey()).removeAll(entry.getValue()); if (CollectionUtils.isEmpty(colPrivMap.get(entry.getKey()))) { colPrivMap.remove(entry.getKey()); + TablePattern tblPattern = new TablePattern(entry.getKey().getCtl(), entry.getKey().getDb(), + entry.getKey().getTbl()); + PrivBitSet existingPriv = tblPatternToPrivs.get(tblPattern); + if (existingPriv != null && existingPriv.isEmpty()) { + tblPatternToPrivs.remove(tblPattern); + } } } } diff --git a/regression-test/suites/nereids_p0/authorization/column_authorization.groovy b/regression-test/suites/nereids_p0/authorization/column_authorization.groovy index 900bfbfb82..a092ce9a3b 100644 --- a/regression-test/suites/nereids_p0/authorization/column_authorization.groovy +++ b/regression-test/suites/nereids_p0/authorization/column_authorization.groovy @@ -36,6 +36,12 @@ suite("column_authorization") { sql "drop user if exists ${user1}" sql "create user ${user1}" + + sql "grant SELECT_PRIV(id) on ${db}.${baseTable} to '${user1}'@'%';" + sql "grant SELECT_PRIV(name) on ${db}.${baseTable} to '${user1}'@'%';" + sql "revoke SELECT_PRIV(name) on ${db}.${baseTable} from '${user1}'@'%';" + sql "revoke SELECT_PRIV(id) on ${db}.${baseTable} from '${user1}'@'%';" + sql "grant SELECT_PRIV(id) on ${db}.${baseTable} to '${user1}'@'%';" sql 'sync'