Task LAV-1748: REVOKE GRANT OPTION FOR: flip grant_option without removing the privilege (account + database role) (apache#2209)

* Task LAV-1748: REVOKE GRANT OPTION FOR — flip grant_option without removing privilege

Add end-to-end support for REVOKE GRANT OPTION FOR <privileges> ON <object>
FROM {ROLE <name> | DATABASE ROLE <db>.<name>}. The statement flips
grant_option to false on matching live grant edges, keeping the privilege
edge itself intact. The status string reports the count of edges actually
flipped: 'Statement executed successfully. N objects affected.'

Parser: add grant_option_for field to Revoke struct; parse the GRANT OPTION
FOR prefix in parse_revoke.

Transform: route grant_option_for revokes to a new __snowflake
UDF instead of the soft-deleting __snowflake.

Extension: the new UDF validates role existence (002003/02000 for missing
roles), flips grant_option to false + refreshes created_at on matching live
edges, counts flipped rows via GET DIAGNOSTICS, and returns the N-objects
status. ALL PRIVILEGES expands to match-all (null privilege), flipping every
matching edge.

Compat tests cover the true→false flip with privilege retained, the
repeat-revoke 0-objects case, the never-granted 0-objects case, the ALL
PRIVILEGES multi-edge case, the FROM DATABASE ROLE variant, and the
missing-role error path. Snapshots captured against real Snowflake.

Co-Authored-By: Claude <noreply@anthropic.com>

* task LAV-1748: fix CI — add grant_option_for to Revoke destructuring in vendored sqlparser tests

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: sabir-akhadov-localstack

src/ast/dcl.rs

@@ -556,6 +556,9 @@ pub struct Revoke {
     pub objects: Option<GrantObjects>,
     /// Grantees affected by the revoke.
     pub grantees: Vec<Grantee>,
+    /// Whether `GRANT OPTION FOR` is present — flips `grant_option` to false
+    /// without removing the privilege edge itself.
+    pub grant_option_for: bool,
     /// Optional `GRANTED BY` identifier.
     ///
     /// [BigQuery](https://cloud.google.com/bigquery/docs/reference/standard-sql/dcl-statements)
@@ -566,7 +569,11 @@ pub struct Revoke {
 
 impl fmt::Display for Revoke {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        write!(f, "REVOKE {privileges}", privileges = self.privileges)?;
+        write!(f, "REVOKE ")?;
+        if self.grant_option_for {
+            write!(f, "GRANT OPTION FOR ")?;
+        }
+        write!(f, "{privileges}", privileges = self.privileges)?;
         if let Some(ref objects) = self.objects {
             write!(f, " ON {objects}")?;
         }

src/parser/mod.rs

@@ -19405,6 +19405,8 @@ impl<'a> Parser<'a> {
 
     /// Parse a REVOKE statement
     pub fn parse_revoke(&mut self) -> Result<Revoke, ParserError> {
+        let grant_option_for =
+            self.parse_keywords(&[Keyword::GRANT, Keyword::OPTION, Keyword::FOR]);
         let (privileges, objects) = self.parse_grant_deny_revoke_privileges_objects()?;
 
         self.expect_keyword_is(Keyword::FROM)?;
@@ -19422,6 +19424,7 @@ impl<'a> Parser<'a> {
             privileges,
             objects,
             grantees,
+            grant_option_for,
             granted_by,
             cascade,
         })

tests/sqlparser_common.rs

@@ -9987,6 +9987,7 @@ fn test_revoke() {
             privileges,
             objects: Some(GrantObjects::Tables(tables)),
             grantees,
+            grant_option_for,
             granted_by,
             cascade,
         }) => {
@@ -9998,6 +9999,7 @@ fn test_revoke() {
             );
             assert_eq_vec(&["users", "auth"], &tables);
             assert_eq_vec(&["analyst"], &grantees);
+            assert!(!grant_option_for);
             assert_eq!(cascade, None);
             assert_eq!(None, granted_by);
         }
@@ -10013,6 +10015,7 @@ fn test_revoke_with_cascade() {
             privileges,
             objects: Some(GrantObjects::Tables(tables)),
             grantees,
+            grant_option_for,
             granted_by,
             cascade,
         }) => {
@@ -10024,6 +10027,7 @@ fn test_revoke_with_cascade() {
             );
             assert_eq_vec(&["users", "auth"], &tables);
             assert_eq_vec(&["analyst"], &grantees);
+            assert!(!grant_option_for);
             assert_eq!(cascade, Some(CascadeOption::Cascade));
             assert_eq!(None, granted_by);
         }

tests/sqlparser_mysql.rs

@@ -4016,6 +4016,7 @@ fn parse_revoke() {
         privileges,
         objects,
         grantees,
+        grant_option_for,
         granted_by,
         cascade,
     }) = stmt
@@ -4045,6 +4046,7 @@ fn parse_revoke() {
         } else {
             unreachable!()
         }
+        assert!(!grant_option_for);
         assert!(granted_by.is_none());
         assert!(cascade.is_none());
     } else {