Private/issue 9160 grant strict compat 80

[ljluestc]

What problem does this PR solve?

Issue Number: close #9160

Problem Summary:

• MySQL 8.0 disallows GRANT from implicitly creating users (equivalent to always enforcing NO_AUTO_CREATE_USER).
• TiDB still allows implicit user creation by GRANT when sql_mode does not include NO_AUTO_CREATE_USER.
• This PR adds a compatibility switch so users can opt into MySQL 8.0 behavior.

What changed and how does it work?

• Added a new session/global boolean system variable:
  • tidb_strict_compatibility_80
  • default: OFF
• Updated GRANT execution path in pkg/executor/grant.go:
  • when target user does not exist, return ErrCantCreateUserWithGrant if either:
    • sql_mode contains NO_AUTO_CREATE_USER, or
    • tidb_strict_compatibility_80=ON
  • otherwise preserve existing TiDB behavior (auto-create user on GRANT).
• Added regression unit test TestGrantCreateUserWithStrictCompatibility80 in pkg/executor/grant_test.go to cover strict-on and strict-off behavior.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No need to test

  • I checked and no code files have been changed.

Manual test:

• make bazel_prepare
• go test --tags=intest ./pkg/executor -run TestGrantCreateUserWithStrictCompatibility80
• go test ./pkg/sessionctx/variable -run '^$'

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

Add `tidb_strict_compatibility_80` to enable MySQL 8.0 compatible GRANT behavior: when enabled, GRANT no longer implicitly creates non-existent users.

[ti-chi-bot]

[FORMAT CHECKER NOTIFICATION]

Notice: To remove the do-not-merge/invalid-title label, please follow title format, for example pkg [, pkg2, pkg3]: what is changed or *: what is changed.

The title description (the part after :) must be between 1 and 320 characters. Please check if your title exceeds this limit.

_{📖 For more info, you can check the "Contribute Code" section in the development guide.}

[ti-chi-bot]

Hi @ljluestc. Thanks for your PR.

I'm waiting for a pingcap member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[pingcap-cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign terry1purcell for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS
• pkg/planner/OWNERS
• pkg/sessionctx/vardef/OWNERS
• pkg/sessionctx/variable/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: bbfda887-a722-4132-9f0e-94855bb50382

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}