feat: 7/7 align PostgreSQL catalog compatibility

[tabVersion]

Stack: 7/7 for splitting ralph/rbac-postgres-final-alignment onto origin/main.

Base: ralph/rbac-split-06-set-role-session-semantics

Scope

• Add PostgreSQL-compatible RBAC catalog/system-function behavior for pg_auth_members, role/user catalog projections, visibility, and privilege functions.
• Update planner snapshots and SLT coverage.

Final parity

The stack tip was verified against a synthetic rebase of the source branch diff onto origin/main:

• git diff --exit-code HEAD..tmp/rbac-rebased-calibration
• git diff --check origin/main...HEAD

Tests

• cargo fmt --check
• cargo check -p risingwave_frontend -p risingwave_meta

Not run

• Runtime SLTs and planner runner were not run in this extraction pass.

[capy-ai]

Added 1 comment

[capy-ai]

[🟠 High] [🔵 Bug]

The old code had an early-return if user_catalog.id == object.owner { return Ok(true); } that covered all privilege checks (including WITH GRANT OPTION). The new code splits the logic into two branches: when require_grant_option is true, it calls check_privilege_with_grant_option which only checks is_super (line 210 of user_catalog.rs) and iterates explicit grant_privileges — it does NOT check ownership. For a non-superuser owner of an object, has_table_privilege(owner_name, owned_table, 'SELECT WITH GRANT OPTION') now incorrectly returns false instead of true. In PostgreSQL, object owners implicitly have all privileges including grant option.

// has_privilege.rs, line 234-236
if *require_grant_option {
    user_catalog.check_privilege_with_grant_option(&object.object, &vec![(*action, true)])

The non-grant-option path correctly delegates to principal_has_privilege which checks ownership via has_inherited_privilege_for_catalog_user(user.id == owner), but the grant-option path bypasses this entirely. Fix by adding an ownership check before the grant-option branch, e.g.:

if user_catalog.id == object.owner {
    true
} else if *require_grant_option {
    user_catalog.check_privilege_with_grant_option(...)
} else {
    principal_has_privilege(...)
}