box.schema.role.create()

Create a role. For explanation of how Tarantool maintains role data, see section Roles.

Parameters:

• role-name (string) — name of role, which should conform to the rules for object names

• options (table) — if_not_exists = true|false (default = false) - boolean; true means there should be no error if the role already exists

Returns

nil

Example:

 
box.schema.role.create('books_space_manager')        box.schema.role.create('writers_space_reader')        -- Grant read/write privileges to a role --        box.schema.role.grant('books_space_manager', 'read,write', 'space', 'books')        -- Grant write privileges to a role --        box.schema.role.grant('writers_space_reader', 'read', 'space', 'writers')        -- End: Grant privileges to roles --        -- Grant a role to a role --        box.schema.role.create('all_spaces_manager')        box.schema.role.grant('all_spaces_manager', 'books_space_manager')        box.schema.role.grant('all_spaces_manager', 'writers_space_reader')        -- End: Grant a role to a role --        -- Grant a role to a user --        box.schema.user.grant('testuser', 'books_space_manager')        box.schema.user.grant('testuser', 'writers_space_reader')        -- End: Grant a role to a user --        -- Test removing a tuple from 'writers' --        box.session.su('testuser')        local _, delete_writer_error = pcall(function()            box.space.writers:delete(3)        end)        t.assert_equals(delete_writer_error:unpack().message, "Write access to space 'writers' is denied for user 'testuser'")        box.session.su('admin')        -- Revoking a role from a user  --        box.schema.user.revoke('testuser', 'execute', 'role', 'writers_space_reader')        -- End: Revoking a role from a user --        -- Test selecting data from 'writers' --        box.session.su('testuser')        local _, select_writer_error = pcall(function()            box.space.writers:select(3)        end)        t.assert_equals(select_writer_error:unpack().message, "Read access to space 'writers' is denied for user 'testuser'")        box.session.su('admin')        -- Dropping a role  --        box.schema.role.drop('writers_space_reader')        -- End: Dropping a role  --        -- Test roles exist --        t.assert_equals(box.schema.role.exists('books_space_manager'), true)        t.assert_equals(box.schema.role.exists('all_spaces_manager'), true)        t.assert_equals(box.schema.role.exists('writers_space_reader'), false)    end)end

See also: access_control_roles.