Combine multiple grants into one while checking state

Author: Farid Uyar

lib/puppet/provider/mysql_grant/mysql.rb

@@ -7,7 +7,7 @@
   commands mysql_raw: 'mysql'
 
   def self.instances
-    instances = []
+    instance_configs = {}
     users.map do |user|
       user_string = cmd_user(user)
       query = "SHOW GRANTS FOR #{user_string};"
@@ -45,13 +45,6 @@ def self.instances
             (priv == 'ALL PRIVILEGES') ? 'ALL' : priv.strip
           end
         end
-        sorted_privileges = stripped_privileges.sort
-        if newer_than('mysql' => '8.0.0') && sorted_privileges == ['ALTER', 'ALTER ROUTINE', 'CREATE', 'CREATE ROLE', 'CREATE ROUTINE', 'CREATE TABLESPACE', 'CREATE TEMPORARY TABLES', 'CREATE USER',
-                                                                   'CREATE VIEW', 'DELETE', 'DROP', 'DROP ROLE', 'EVENT', 'EXECUTE', 'FILE', 'INDEX', 'INSERT', 'LOCK TABLES', 'PROCESS', 'REFERENCES',
-                                                                   'RELOAD', 'REPLICATION CLIENT', 'REPLICATION SLAVE', 'SELECT', 'SHOW DATABASES', 'SHOW VIEW', 'SHUTDOWN', 'SUPER', 'TRIGGER',
-                                                                   'UPDATE']
-          sorted_privileges = ['ALL']
-        end
         # Same here, but to remove OPTION leaving just GRANT.
         options = if %r{WITH\sGRANT\sOPTION}.match?(rest)
                     ['GRANT']
@@ -61,16 +54,40 @@ def self.instances
         # fix double backslash that MySQL prints, so resources match
         table.gsub!('\\\\', '\\')
         # We need to return an array of instances so capture these
-        instances << new(
-          name: "#{user}@#{host}/#{table}",
-          ensure: :present,
+        name = "#{user}@#{host}/#{table}"
+        if instance_configs.key?(name)
+          instance_config = instance_configs[name]
+          stripped_privileges.concat instance_config[:privileges]
+          options.concat instance_config[:options]
+        end
+
+        sorted_privileges = stripped_privileges.uniq.sort
+        if newer_than('mysql' => '8.0.0') && sorted_privileges == ['ALTER', 'ALTER ROUTINE', 'CREATE', 'CREATE ROLE', 'CREATE ROUTINE', 'CREATE TABLESPACE', 'CREATE TEMPORARY TABLES', 'CREATE USER',
+                                                                   'CREATE VIEW', 'DELETE', 'DROP', 'DROP ROLE', 'EVENT', 'EXECUTE', 'FILE', 'INDEX', 'INSERT', 'LOCK TABLES', 'PROCESS', 'REFERENCES',
+                                                                   'RELOAD', 'REPLICATION CLIENT', 'REPLICATION SLAVE', 'SELECT', 'SHOW DATABASES', 'SHOW VIEW', 'SHUTDOWN', 'SUPER', 'TRIGGER',
+                                                                   'UPDATE']
+          sorted_privileges = ['ALL']
+        end
+
+        instance_configs[name] = {
           privileges: sorted_privileges,
           table: table,
           user: "#{user}@#{host}",
-          options: options,
-        )
+          options: options.uniq,
+        }
       end
     end
+    instances = []
+    instance_configs.map do |name, config|
+      instances << new(
+        name: name,
+        ensure: :present,
+        privileges: config[:privileges],
+        table: config[:table],
+        user: config[:user],
+        options: config[:options],
+      )
+    end
     instances
   end
 

spec/acceptance/types/mysql_grant_spec.rb

@@ -698,4 +698,21 @@ class { 'mysql::server': override_options => { 'root_password' => 'password' } }
       expect(result.exit_code).to be_zero
     end
   end
+
+  describe 'multiple lines privileges', if: Gem::Version.new(mysql_version) > Gem::Version.new('8.0.0') && Gem::Version.new(mysql_version) < Gem::Version.new('10.0.0') do
+    pp = <<-MANIFEST
+        mysql_user { 'multi@localhost':
+          ensure => present,
+        }
+        mysql_grant { 'multi@localhost/*.*':
+          user       => 'multi@localhost',
+          privileges => ['SELECT', 'INSERT', 'UPDATE', 'BACKUP_ADMIN', 'FLUSH_TABLES'],
+          table      => '*.*',
+          require    => Mysql_user['multi@localhost'],
+        }
+    MANIFEST
+    it 'check idempotency in MySQL 8' do
+      idempotent_apply(pp)
+    end
+  end
 end