planner: check DROP privilege for TRUNCATE PARTITION statement (#64024)

[jjshanks]

What problem does this PR solve?

Issue Number: close #64024

Problem Summary:

ALTER TABLE TRUNCATE PARTITION and ALTER TABLE DROP PARTITION have inconsistent privilege requirements. Currently, TRUNCATE PARTITION only requires ALTER privilege, while DROP PARTITION correctly requires DROP privilege. This is inconsistent with MySQL behavior, where both operations require DROP privilege since they both perform destructive data operations.

What changed and how does it work?

Added privilege checking for ALTER TABLE TRUNCATE PARTITION to require DROP privilege, making it consistent with DROP PARTITION.

Changes:

• pkg/planner/core/planbuilder.go: Added a new else if branch in buildDDL() to check for ast.AlterTableTruncatePartition and enforce DROP privilege requirement, mirroring the existing logic for ast.AlterTableDropPartition
• tests/integrationtest/t/privilege/privileges.test: Added integration test to verify that both TRUNCATE PARTITION and DROP PARTITION require DROP privilege

How it works:
When the planner encounters an ALTER TABLE TRUNCATE PARTITION statement, it now builds visitInfo with mysql.DropPriv requirement, generating a "DROP command denied" error if the user lacks the privilege.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No need to test

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

This is a breaking change for users who currently rely on TRUNCATE PARTITION working with only ALTER privilege. They will now need DROP privilege.

Documentation

• Affects user behaviors

• Contains syntax changes

• Contains variable changes

• Contains experimental features

• Changes MySQL compatibility

• Users who previously could truncate partitions with only ALTER privilege now need DROP privilege

• Improves MySQL compatibility by aligning privilege requirements

Release note

Fix: `ALTER TABLE TRUNCATE PARTITION` now correctly requires `DROP` privilege, consistent with MySQL and `DROP PARTITION` behavior. Previously, it incorrectly allowed the operation with only `ALTER` privilege.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign king-dylan for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS
• pkg/planner/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

Hi @jjshanks. Thanks for your PR.

I'm waiting for a pingcap member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

Welcome @jjshanks!

It looks like this is your first PR to pingcap/tidb 🎉.

I'm the bot to help you request reviewers, add labels and more, See available commands.

We want to make sure your contribution gets all the attention it needs!



Thank you, and welcome to pingcap/tidb. 😃

[pingcap-cla-assistant]

All committers have signed the CLA.

[tiprow]

Hi @jjshanks. Thanks for your PR.

PRs from untrusted users cannot be marked as trusted with /ok-to-test in this repo meaning untrusted PR authors can never trigger tests themselves. Collaborators can still trigger tests on the PR using /test all.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[lance6716]

/ok-to-test

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.4479%. Comparing base (a2d4284) to head (17eb80f).

Additional details and impacted files

@@               Coverage Diff                @@
##             master     #64225        +/-   ##
================================================
+ Coverage   72.7255%   73.4479%   +0.7224%     
================================================
  Files          1859       1860         +1     
  Lines        503882     503977        +95     
================================================
+ Hits         366451     370161      +3710     
+ Misses       115158     111719      -3439     
+ Partials      22273      22097       -176     

Flag	Coverage Δ
integration	41.8393% <100.0000%> (?)
unit	72.5796% <42.8571%> (+0.2902%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
dumpling	52.8700% <ø> (+0.1132%)	⬆️
parser	∅ <ø> (∅)
br	46.4055% <ø> (+0.0455%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jjshanks]

/retest