MDEV-37948 ALTER TABLE TRUNCATE PARTITION requires only DROP privilege

[FarihaIS]

Description

ALTER TABLE ... TRUNCATE PARTITION only checks for DROP privilege, while ALTER TABLE ... DROP PARTITION correctly requires both DROP and ALTER privileges. This is inconsistent and a privilege issue since TRUNCATE PARTITION is an ALTER TABLE statement.

Add ALTER privilege check to TRUNCATE PARTITION to match DROP PARTITION behavior and documentation.

Release Notes

N/A

How can this PR be tested?

Execute the main.partition_grant test in mysql-test-run. This commit adds a test in partition_grant.test.

Before the fix

A user with only DROP privilege can truncate partitions:

main.partition_grant                     [ fail ]
        Test ended at 2026-01-28 20:16:01

CURRENT_TEST: main.partition_grant
mysqltest: At line 92: query 'alter table t1 truncate partition p1' succeeded - should have failed with error ER_TABLEACCESS_DENIED_ERROR (1142)...

The result from queries just before the failure was:
< snip >
...
create table t1 (a int) partition by list (a) (partition p1 values in (1), partition p2 values in (2), partition p3 values in (3));
insert into t1 values (1),(2),(3);
revoke all privileges on mysqltest_1.* from mysqltest_1@localhost;
grant drop on mysqltest_1.* to mysqltest_1@localhost;
connect  conn6,localhost,mysqltest_1,,mysqltest_1;
show grants for current_user;
Grants for mysqltest_1@localhost
GRANT USAGE ON *.* TO `mysqltest_1`@`localhost`
GRANT DROP ON `mysqltest_1`.* TO `mysqltest_1`@`localhost`
alter table t1 truncate partition p1;

After the fix

A user needs both ALTER and DROP privileges to truncate partitions:

main.partition_grant                     [ pass ]     81

Basing the PR against the correct MariaDB version

• This is a bug fix, and the PR is based against the branch 12.2.

Copyright

All new code of the whole pull request, including one or several files that are either new files or modified ones, are contributed under the BSD-new license. I am contributing on behalf of my employer Amazon Web Services, Inc.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[svoj]

LGTM

[svoj]

Please keep as is for now, but having DROP_ACL here looks misleading to my eye. DROP_ACL refers to table object, not partition object. OTOH DROP_ACL on a database implies DROP_ACL on all tables in that database.

Looks like it comes from https://bugs.mysql.com/bug.php?id=17139, but I believe ALTER_ACL gives many options to spoil table data.

[FarihaIS]

I see, please let me know what changes you would like me to make here, if any. For now, I've left it as is like you suggested, thank you

[svoj]

This is more a note to other reviewers. Something to consider, I have no strong opinion on this.