Repository navigation
fix(#2810): grant CREATE PSE via default_access_role.hdbrole - #2846
Merged
Merged
Conversation
…grants The first attempt added CREATE PSE to _grants.hdbgrants under the tutorials-kg-grantor SQL grantor. That failed on DEV deploy (20261019-105602): the deployer emitted GRANT "CREATE PSE" TO ...#OO, which HANA rejects as 'invalid role name' — a system privilege cannot be granted that way, and the grantor lacks CREATE PSE WITH ADMIN OPTION. Correct HDI-native mechanism (per the @sap/hdi-deploy README): a role at the exact path src/defaults/default_access_role.hdbrole named default_access_role is auto-granted by the container object owner to the service instance's global access role on deploy — so a system privilege listed in it is granted by #OO with no external grantor. - db/src/defaults/default_access_role.hdbrole: new; system_privileges [CREATE PSE]. Path + name are the trigger for the deployer special case. - db/src/_grants.hdbgrants: reverted to SPARQL-only (remove CREATE PSE). - runbook: B1 rewritten to the default_access_role mechanism + the failed hdbgrants attempt recorded. No .hdinamespace needed (db/src defines no real namespace prefix); db/src/.hdiconfig already maps .hdbrole.
This was referenced Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #2844. The
CREATE PSEgrant it added via_grants.hdbgrantsfailed on DEV deploy (tutorials-db-deployertask, run20261019-105602):A system privilege can't be granted through the
tutorials-kg-grantorSQL-grantor path (the deployer treats the list entries as roles, and the grantor doesn't holdCREATE PSE WITH ADMIN OPTIONanyway).Correct mechanism (per the @sap/hdi-deploy README)
A role at the exact path
src/defaults/default_access_role.hdbrolenameddefault_access_roleis special-cased by the HDI Deployer: on deploy it is created by the container object owner (#OO) and granted to the service instance's global access role. A system privilege listed in it is therefore granted by#OO— no external grantor, no.hdbgrants.Changes
db/src/defaults/default_access_role.hdbrole(new) —system_privileges: ["CREATE PSE"]. Path + name are the trigger for the deployer special case.db/src/_grants.hdbgrants— reverted to SPARQL-only (removed the brokenCREATE PSE).default_access_rolemechanism; the failed.hdbgrantsattempt recorded for posterity.No
.hdinamespaceneeded (db/srchas no real namespace prefix);db/src/.hdiconfigalready maps.hdbrole.Verify after deploy
Then B2 (PSE + remote source) and B3 (
VECTOR_EMBEDDINGviaTUTORIALS_AICORE). Tier A (built-in NLP) already verified green on DEV.