Skip to content

Commit 9b47590

Browse files
authored
chore: add doc about procedure rbac (#2764)
1 parent afc2ca7 commit 9b47590

File tree

2 files changed

+29
-1
lines changed

2 files changed

+29
-1
lines changed

docs/en/guides/56-security/access-control/01-privileges.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,9 @@ Databend offers a range of privileges that allow you to exercise fine-grained co
9999
- [Session Policy Privileges](#session-policy-privileges)
100100
- [Stage Privileges](#stage-privileges)
101101
- [UDF Privileges](#udf-privileges)
102+
- [Sequence Privileges](#sequence-privileges)
103+
- [Connection Privileges](#connection-privileges)
104+
- [Procedure Privileges](#procedure-privileges)
102105
- [Catalog Privileges](#catalog-privileges)
103106
- [Share Privileges](#share-privileges)
104107

@@ -113,6 +116,7 @@ Databend offers a range of privileges that allow you to exercise fine-grained co
113116
| CREATE WAREHOUSE | Global | Creates a warehouse. |
114117
| CREATE CONNECTION | Global | Creates a connection. |
115118
| CREATE SEQUENCE | Global | Creates a sequence. |
119+
| CREATE PROCEDURE | PROCEDURE | Creates a procedure. |
116120
| DELETE | Table | Deletes or truncates rows in a table. |
117121
| DROP | Global, Database, Table, View | Drops a database, table, view or UDF. Undrops a table. |
118122
| INSERT | Table | Inserts rows into a table. |
@@ -130,6 +134,7 @@ Databend offers a range of privileges that allow you to exercise fine-grained co
130134
| USAGE | UDF | Use udf. |
131135
| ACCESS CONNECTION | CONNECTION | Access connection. |
132136
| ACCESS SEQUENCE | SEQUENCE | Access sequence. |
137+
| ACCESS PROCEDURE | PROCEDURE | Access procedure. |
133138

134139
### Global Privileges
135140

@@ -245,3 +250,12 @@ Please note that you can use the [USE DATABASE](/sql/sql-commands/ddl/database/d
245250
| Access Sequence | Can access Sequence.(e.g. Drop,Desc) |
246251
| ALL | Grants Access Sequence privileges for the specified object type. |
247252
| OWNERSHIP | Grants full control over a Sequence. Only a single role can hold this privilege on a specific object at a time. |
253+
254+
### Procedure Privileges
255+
256+
| Privilege | Description |
257+
|:-----------------|:------------------------------------------------------------------------------------------------------------------|
258+
| Access Procedure | Can access Procedure.(e.g. Drop,Call,Desc) |
259+
| ALL | Grants Access Procedure privileges for the specified object type. |
260+
| OWNERSHIP | Grants full control over a Procedure. Only a single role can hold this privilege on a specific object at a time. |
261+

docs/en/sql-reference/10-sql-commands/00-ddl/18-procedure/create-procedure.md

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: CREATE PROCEDURE
33
---
44
import FunctionDescription from '@site/src/components/FunctionDescription';
55

6-
<FunctionDescription description="Introduced or updated: v1.2.637"/>
6+
<FunctionDescription description="Introduced or updated: v1.2.816"/>
77

88
Defines a stored procedure that executes SQL operations and returns a result.
99

@@ -33,6 +33,16 @@ $$;
3333
| `COMMENT` | Optional text describing the procedure. |
3434
| `AS ...` | Encloses the procedure body, which contains SQL statements, variable declarations, loops, and a RETURN statement. |
3535

36+
## Access control requirements
37+
38+
| Privilege | Object Type | Description |
39+
|:-----------------|:------------|:---------------------|
40+
| CREATE PROCEDURE | Global | Creates a procedure. |
41+
42+
43+
To create a procedure, the user performing the operation or the [current_role](/guides/security/access-control/roles) must have the CREATE PROCEDURE [privilege](/guides/security/access-control/privileges).
44+
45+
3646
## Examples
3747

3848
This example defines a stored procedure that converts weight from kilograms (kg) to pounds (lb):
@@ -73,6 +83,10 @@ BEGIN
7383
RETURN sum;
7484
END;
7585
$$;
86+
87+
-- Grant ACCESS PROCEDURE Privilege TO role test
88+
GRANT ACCESS PROCEDURE ON PROCEDURE loop_test() to role test;
89+
7690
```
7791

7892
```sql

0 commit comments

Comments
 (0)