feat(rbac): RBAC support connection object

[TCeason]

I hereby agree to the terms of the CLA available at: https://docs.databend.com/dev/policies/cla/

Summary

1. New Configuration Parameter: Introduces enable_experimental_connection_rbac_check to toggle RBAC permission verification for connections. Disabled by default for backward compatibility.
2. Global Privileges: Adds CREATE CONNECTION and ACCESS CONNECTION global privileges governing connection creation and unrestricted usage rights respectively.
3. Ownership Model: Implements OWNERSHIP semantics, allowing privileged users/roles to perform arbitrary DDL operations on connections.
4. **Show grants on connection <connection_name>.

For more detailed information, please refer to the issue content

• Fix: Feature: RBAC Enhancement for CONNECTION Object Permission Control #18359

Tests

• Unit Test
• Logic Test
• Benchmark Test
• No Test - Explain why

Type of change

• Bug Fix (non-breaking change which fixes an issue)
• New Feature (non-breaking change which adds functionality)
• Breaking Change (fix or feature that could cause existing functionality not to work as expected)
• Documentation Update
• Refactoring
• Performance Improvement
• Other (please describe):

---

This change is 

[TCeason]

Test on local:

Test Steps:

In main version

1. Root User Operations:

-- Create a role named 'role_a'
create role role_a;
create user a identified by '123' with default_role='role_a';
grant role role_a to a;
create user b identified by '123';
create connection c1 storage_type = 's3' access_key_id ='minioadmin' secret_access_key ='minioadmin' ENDPOINT_URL='http://127.0.0.1:9900';
create connection c2 storage_type = 's3' access_key_id ='22' secret_access_key ='22' ENDPOINT_URL='http://127.0.0.1:9900';
create connection c3 storage_type = 's3' access_key_id ='33' secret_access_key ='33' ENDPOINT_URL='http://127.0.0.1:9900';

In pr version

set global enable_experimental_connection_privilege_check=1;
grant access connection on connection c1 to role role_a;
grant ownership on connection c2 to role role_a;

2. User 'a' Operations:

show connections;
╭──────────────────────────────────────────────────────────────────────────────────────────────────────╮
│  name  │ storage_type │                                storage_params                                │
│ String │    String    │                                    String                                    │
├────────┼──────────────┼──────────────────────────────────────────────────────────────────────────────┤
│ 'c1'   │ 's3'         │ 'access_key_id=******min endpoint_url=******900 secret_access_key=******min' │
│ 'c2'   │ 's3'         │ 'access_key_id=22 endpoint_url=******900 secret_access_key=22'               │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────╯

desc connection c1;
╭──────────────────────────────────────────────────────────────────────────────────────────────────────╮
│  name  │ storage_type │                                storage_params                                │
│ String │    String    │                                    String                                    │
├────────┼──────────────┼──────────────────────────────────────────────────────────────────────────────┤
│ 'c1'   │ 's3'         │ 'access_key_id=******min endpoint_url=******900 secret_access_key=******min' │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────╯
desc connection c2;
╭────────────────────────────────────────────────────────────────────────────────────────╮
│  name  │ storage_type │                         storage_params                         │
│ String │    String    │                             String                             │
├────────┼──────────────┼────────────────────────────────────────────────────────────────┤
│ 'c2'   │ 's3'         │ 'access_key_id=22 endpoint_url=******900 secret_access_key=22' │
╰────────────────────────────────────────────────────────────────────────────────────────╯

show grants for role role_a;
╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│  privileges │     object_name     │     object_id    │ grant_to │   name   │                                grants                               │
│    String   │        String       │ Nullable(String) │  String  │  String  │                                String                               │
├─────────────┼─────────────────────┼──────────────────┼──────────┼──────────┼─────────────────────────────────────────────────────────────────────┤
│ 'ALL'       │ 'c1'                │ NULL             │ 'ROLE'   │ 'role_a' │ 'GRANT ALL ON CONNECTION c1 TO ROLE `role_a`'                       │
│ 'OWNERSHIP' │ 'c2'                │ NULL             │ 'ROLE'   │ 'role_a' │ 'GRANT OWNERSHIP ON CONNECTION c2 TO ROLE `role_a`'                 │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

show grants on connection c1;

╭────────────────────────────────────────────────────────────────────────────────────────────╮
│      privileges     │ object_name │     object_id    │ grant_to │       name      │ grants │
│        String       │    String   │ Nullable(String) │  String  │      String     │ String │
├─────────────────────┼─────────────┼──────────────────┼──────────┼─────────────────┼────────┤
│ 'ACCESS CONNECTION' │ 'c1'        │ NULL             │ 'ROLE'   │ 'role_a'        │ ''     │
│ 'OWNERSHIP'         │ 'c1'        │ NULL             │ 'ROLE'   │ 'account_admin' │ ''     │
╰────────────────────────────────────────────────────────────────────────────────────────────╯

show grants on connection c2;
╭─────────────────────────────────────────────────────────────────────────────╮
│  privileges │ object_name │     object_id    │ grant_to │   name   │ grants │
│    String   │    String   │ Nullable(String) │  String  │  String  │ String │
├─────────────┼─────────────┼──────────────────┼──────────┼──────────┼────────┤
│ 'OWNERSHIP' │ 'c2'        │ NULL             │ 'ROLE'   │ 'role_a' │ ''     │
╰─────────────────────────────────────────────────────────────────────────────╯

2. User 'b' Operations:

-- empty result
show connections;

Rollback main

User 'a' Operations:

a@localhost:8000/default/default> show connections;
error: APIError: QueryFailed: [1063]Permission denied: privilege [Super] is required on *.* for user 'a'@'%' with roles [public,role_a]. Note: Please ensure that your current role have the appropriate permissions to create a new Warehouse|Database|Table|UDF|Stage.

User 'b' Operations:

b@localhost:8000/default/default> show connections;
error: APIError: QueryFailed: [1063]Permission denied: privilege [Super] is required on *.* for user 'b'@'%' with roles [public]. Note: Please ensure that your current role have the appropriate permissions to create a new Warehouse|Database|Table|UDF|Stage.

[drmingdrmer]

Reviewed 12 of 34 files at r1.
Reviewable status: 12 of 40 files reviewed, 3 unresolved discussions

---

src/meta/proto-conv/tests/it/v136_add_grant_object_connection.rs line 86 at r2 (raw file):

                    mt::principal::GrantObject::Stage("s1".to_string()),
                    make_bitflags!(UserPrivilegeType::{Write}),
                ),

You do not actually need these entries to be tested right?

Code quote:

                mt::principal::GrantEntry::new(
                    mt::principal::GrantObject::Global,
                    make_bitflags!(UserPrivilegeType::{CreateConnection}),
                ),
                mt::principal::GrantEntry::new(
                    mt::principal::GrantObject::Connection("c1".to_string()),
                    make_bitflags!(UserPrivilegeType::{AccessConnection}),
                ),
                mt::principal::GrantEntry::new(
                    mt::principal::GrantObject::Database("default".to_string(), "db".to_string()),
                    make_bitflags!(UserPrivilegeType::{Create}),
                ),
                mt::principal::GrantEntry::new(
                    mt::principal::GrantObject::Table(
                        "default".to_string(),
                        "db".to_string(),
                        "tb".to_string(),
                    ),
                    make_bitflags!(UserPrivilegeType::{Create}),
                ),
                mt::principal::GrantEntry::new(
                    mt::principal::GrantObject::UDF("f1".to_string()),
                    make_bitflags!(UserPrivilegeType::{Usage}),
                ),
                mt::principal::GrantEntry::new(
                    mt::principal::GrantObject::Stage("s1".to_string()),
                    make_bitflags!(UserPrivilegeType::{Write}),
                ),

---

src/meta/proto-conv/tests/it/v136_add_grant_object_connection.rs line 116 at r2 (raw file):

        object: OwnershipObject::Connection {
            name: "c1".to_string(),
        },

I see that there are two protobuf types modified but only one of them is tested. Is it as expected?

Code quote:

        object: OwnershipObject::Connection {
            name: "c1".to_string(),
        },

---

src/meta/protos/proto/ownership.proto line 55 at r2 (raw file):

    message OwnershipConnectionObject {
      string connection = 1;
    }

is this indent correct?

Code quote:

    message OwnershipConnectionObject {
      string connection = 1;
    }

[drmingdrmer]

Reviewed 3 of 6 files at r3, all commit messages.
Reviewable status: 12 of 40 files reviewed, 1 unresolved discussion (waiting on @TCeason)

[TCeason]

Compatibility tests are involved in ci and locally, and whether it is necessary to deploy to the cloud test environment cc @BohuTANG

[TCeason]

I found a user incompatibility issue. It has been converted to draft first.