fix mysql_info crash if PUBLIC role is used on MariaDB 10.11+ (#712)

* tests: grant a privilege to the PUBLIC role to force the module to fail

* skip the PUBLIC role from the users migration example

* Cut the 3rd matching group as it fails to match roles without quotes

The group purpose was to match the closing quotes. We don't need the
value after the TO. So we can ignore this entirely.

* add MariaDB role detection

* Add changelog fragment

* doc: add notes that users_info doesn't support MariaDB roles.

changelogs/fragments/grant_to_public.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - mysql_info - fix a crash (ERROR 1141, There is no such grant defined for user 'PUBLIC' on host '%') when using the ``users_info`` filter with a PUBLIC role present in MariaDB 10.11+. Do note that the fix doesn't change the fact that the module won't return the privileges from the PUBLIC role in the users privileges list. It can't do that because you have to login as the particular user and use `SHOW GRANTS FOR CURRENT_USER`. We considered using an aggregation with the `SHOW GRANTS FOR PUBLIC` command. However, this approach would make copying users from one server to another transform the privileges inherited from the role as if they were direct privileges on the user.

plugins/module_utils/user.py

@@ -662,7 +662,7 @@ def privileges_get(cursor, user, host, maria_role=False):
         if not maria_role:
             res = re.match("""GRANT (.+) ON (.+) TO (['`"]).*\\3@(['`"]).*\\4( IDENTIFIED BY PASSWORD (['`"]).+\\6)? ?(.*)""", grant[0])
         else:
-            res = re.match("""GRANT (.+) ON (.+) TO (['`"]).*\\3""", grant[0])
+            res = re.match("""GRANT (.+) ON (.+) TO .*""", grant[0])
 
         if res is None:
             # If a user has roles assigned, we'll have one of priv tuples looking like

plugins/modules/mysql_info.py

@@ -50,6 +50,7 @@ notes:
 - Compatible with MariaDB or MySQL.
 - Calculating the size of a database might be slow, depending on the number and size of tables in it.
   To avoid this, use I(exclude_fields=db_size).
+- filters C(users_info) doesn't support MariaDB roles.
 
 attributes:
   check_mode:
@@ -161,6 +162,7 @@ EXAMPLES = r'''
       - item.name != 'root'  # In case you don't want to import admin accounts
       - item.name != 'mariadb.sys'
       - item.name != 'mysql'
+      - item.name != 'PUBLIC'  # MariaDB roles are not supported
 '''
 
 RETURN = r'''
@@ -606,7 +608,9 @@ class MySQL_Info(object):
             user = line['User']
             host = line['Host']
 
-            user_priv = privileges_get(self.cursor, user, host)
+            # MariaDB roles have no host
+            is_role = self.server_implementation == 'mariadb' and not host
+            user_priv = privileges_get(self.cursor, user, host, maria_role=is_role)
 
             if not user_priv:
                 self.module.warn("No privileges found for %s on host %s" % (user, host))

tests/integration/targets/test_mysql_info/tasks/filter_users_info.yml

@@ -31,6 +31,19 @@
             CREATE TABLE IF NOT EXISTS users_info_db.T_UPPER
             (id int, name1 varchar(9), NAME2 varchar(9), Name3 varchar(9))
 
+    # No need for a specific test later. When the module will retrieve the
+    # users privileges, it will fail with an error "1141 - There is no such
+    # grant defined for user 'PUBLIC' on host'%'" if the PUBLIC role is not
+    # handled properly by our module.
+    - name: Mysql_info users_info | Grant to PUBLIC for MariaDB 10.11+
+      community.mysql.mysql_query:
+        query:
+          - >-
+            GRANT SELECT,INSERT,UPDATE,DELETE on users_info_db.* TO PUBLIC
+      when:
+        - db_engine == 'mariadb'
+        - db_version is version('10.11.1', '>=')
+
     # I failed to create a procedure using community.mysql.mysql_query.
     # Maybe it's because we must changed the delimiter.
     - name: Mysql_info users_info | Create procedure SQL file
@@ -277,7 +290,7 @@
         - item.name != 'mysql.sys'
         - item.name != 'mysql.infoschema'
         - item.name != 'mysql.session'
-
+        - item.name != 'PUBLIC'  # MariaDB roles are not supported
 
     # ================================== Cleanup ============================