fix: include partitioned tables in privilege inspection (#640)

[shehjaddev]

Fixes #640

Summary

GetPrivilegesForSchema and GetColumnPrivilegesForSchema filtered pg_class.relkind to 'r', 'v', 'm', 'S' (and 'r', 'v', 'm' for columns). Partitioned tables (relkind = 'p') were never inspected. As a result:

• GRANT ... ON <partitioned table> in the desired state produced no plan step;
• removing such a grant produced no REVOKE;
• dump omitted the partitioned table's privileges.

Both queries now include 'p', which is reported as object type TABLE. queries.sql.go was regenerated with the pinned sqlc v1.30.0 (sqlc generate in ir/queries).

Note: running sqlc generate on current main also flips GetIndexesForSchemaRow.ParentIndex and ParentIndexSchema from sql.NullString to string. That predates this PR (from #643's LEFT JOIN columns), and applying it would break the inspector, so those two lines are left as they are. Only this PR's query hunks change.

Validation

Passed locally with Go 1.24.7 on Linux, embedded PostgreSQL 18:

go vet ./...
gofmt -l <changed files>      # clean
go test -count=1 ./...        # all packages ok

New test cmd/issue_640_integration_test.go, using a range-partitioned events table plus an ordinary plain table:

• on the base, the plan contains only GRANT SELECT ON TABLE plain TO reader; (this reproduces the bug);
• with the fix, both GRANT SELECT ON TABLE events TO reader; and the matching REVOKE are planned.

Scope

This covers privileges on the partitioned parent. Partitions are ordinary tables ('r') and were already handled. It does not change default privileges or the role-management behavior (see #637).

[greptile-apps]

Confidence Score: 4/5

[Medium impact] Expands privilege inspection to include partitioned tables.

The PR appears safe to merge, with a non-blocking request for column-grant regression coverage.

Findings

1.  Column grants remain untested ▶

Summary

Includes partitioned parents in table and column privilege inspection.

• Privilege plans now include grants on partitioned table parents.

Acknowledged scope: shehjaddev intentionally left the unrelated generated ParentIndex type changes unchanged because applying them would break the inspector.

_{Reviews (1) · Last reviewed commit: "fix: include partitioned tables in privi..." · Reviewed by Greptile}

[greptile-apps]

Column grants remain untested

The new test only grants table-wide SELECT, so it never exercises the changed GetColumnPrivilegesForSchema query. Removing 'p' from that query would leave this test passing while column grants on partitioned parents disappear again. Add a column-only grant, such as GRANT UPDATE (id) ON events TO reader, and check both its grant and revoke plans.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[Copilot]

🟢 Approval recommended

The focused query changes have no identified blocking defects; additional column-level coverage is optional, and tests were not rerun.

1 open finding

• Add regression coverage for column-level privileges on partitioned tables · New

What changed in this PR

Fixes #640 by including partitioned parents in privilege inspection for planning and dumps.

Changes:

• Includes partitioned tables in table- and column-privilege queries.
• Updates generated query bindings.
• Adds integration coverage for table-level GRANT and REVOKE planning.

File	Description
ir/​queries/​queries.sql.go	Updates generated privilege queries.
ir/​queries/​queries.sql	Includes partitioned tables and classifies them as TABLE.
cmd/​issue_640_integration_test.go	Tests partitioned-parent grant and revoke plans.

Files not reviewed (1)

• ir/queries/queries.sql.go: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tianzhou]

LGTM. Thanks for the contribution