builtins: allow VIEWACTIVITY priv to use crdb_internal.request_statem…

…ent_bundle

Previously only those with the VIEWACTIVITY role could use the
crdb_internal.request_statement_bundle builtin. We should allow
the VIEWACTIVITY privilege as well since role options are now
deprecated. This allow also allow stmt bundle requests to be made
from db-console for users with this granted privilege.

Epic: none
Fixes: cockroachdb#118759

Release note (bug fix): Those with VIEWACTIVITY privilege can now
request statement bundles using crdb_internal.requets_statement_bundle
or via db-console's sql activity page.

pkg/sql/faketreeeval/evalctx.go

@@ -576,6 +576,13 @@ func (ep *DummySessionAccessor) HasViewActivityOrViewActivityRedactedRole(
 	return false, errors.WithStack(errEvalSessionVar)
 }
 
+// HasGlobalPrivilegeOrRoleOption is part of the eval.SessionAccessor interface.
+func (ep *DummySessionAccessor) HasGlobalPrivilegeOrRoleOption(
+	_ context.Context, _ privilege.Kind,
+) (bool, error) {
+	return false, errors.WithStack(errEvalSessionVar)
+}
+
 // DummyClientNoticeSender implements the eval.ClientNoticeSender interface.
 type DummyClientNoticeSender struct{}
 

pkg/sql/sem/builtins/builtins.go

@@ -57,6 +57,7 @@ import (
 	"github.com/cockroachdb/cockroach/pkg/sql/pgwire/pgcode"
 	"github.com/cockroachdb/cockroach/pkg/sql/pgwire/pgerror"
 	"github.com/cockroachdb/cockroach/pkg/sql/pgwire/pgnotice"
+	"github.com/cockroachdb/cockroach/pkg/sql/privilege"
 	"github.com/cockroachdb/cockroach/pkg/sql/protoreflect"
 	"github.com/cockroachdb/cockroach/pkg/sql/roleoption"
 	"github.com/cockroachdb/cockroach/pkg/sql/rowenc"
@@ -7728,8 +7729,8 @@ specified store on the node it's run from. One of 'mvccGC', 'merge', 'split',
 			},
 			ReturnType: tree.FixedReturnType(types.Bool),
 			Fn: func(ctx context.Context, evalCtx *eval.Context, args tree.Datums) (tree.Datum, error) {
-				hasViewActivity, err := evalCtx.SessionAccessor.HasRoleOption(
-					ctx, roleoption.VIEWACTIVITY)
+				hasViewActivity, err := evalCtx.SessionAccessor.HasGlobalPrivilegeOrRoleOption(
+					ctx, privilege.VIEWACTIVITY)
 				if err != nil {
 					return nil, err
 				}
@@ -7744,8 +7745,8 @@ specified store on the node it's run from. One of 'mvccGC', 'merge', 'split',
 					return nil, err
 				}
 
-				hasViewActivityRedacted, err := evalCtx.SessionAccessor.HasRoleOption(
-					ctx, roleoption.VIEWACTIVITYREDACTED)
+				hasViewActivityRedacted, err := evalCtx.SessionAccessor.HasGlobalPrivilegeOrRoleOption(
+					ctx, privilege.VIEWACTIVITYREDACTED)
 				if err != nil {
 					return nil, err
 				}

pkg/sql/sem/eval/deps.go

@@ -472,6 +472,10 @@ type SessionAccessor interface {
 	// HasViewActivityOrViewActivityRedactedRole returns true iff the current session user has the
 	// VIEWACTIVITY or VIEWACTIVITYREDACTED permission.
 	HasViewActivityOrViewActivityRedactedRole(ctx context.Context) (bool, error)
+
+	// HasGlobalPrivilegeOrRoleOption returns a bool representing whether the current user
+	// has a global privilege or the corresponding legacy role option.
+	HasGlobalPrivilegeOrRoleOption(ctx context.Context, privilege privilege.Kind) (bool, error)
 }
 
 // PreparedStatementState is a limited interface that exposes metadata about