Merge #123063

123063: roleoption: fix error message for SUBJECT option r=rafiss a=rafiss The string formatting logic was incorrect before. fixes #123062 Release note: None Co-authored-by: Rafi Shamim <[email protected]>
cockroachdb · Apr 25, 2024 · 7c9bab9 · 7c9bab9
2 parents 001375a + 0f82d54
commit 7c9bab9
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/pkg/ccl/logictestccl/testdata/logic_test/subject b/pkg/ccl/logictestccl/testdata/logic_test/subject
@@ -1,7 +1,7 @@
 # LogicTest: !local-mixed-23.2
 # Tests for parsing/validation of the SUBJECT role option.
 
-statement error role "root" cannot have a SUBJECT
+statement error role "root" cannot have a SUBJECT\n.*use the --root-cert-distinguished-name CLI flag
 ALTER ROLE root SUBJECT 'O=US, CN=John Doe'
 
 statement error failed to parse distinguished name foo: DN ended with incomplete type, value pair

diff --git a/pkg/sql/roleoption/role_option.go b/pkg/sql/roleoption/role_option.go
@@ -222,9 +222,11 @@ func MakeListFromKVOptions(
 					return err
 				}
 				if u.IsRootUser() {
-					return pgerror.Newf(pgcode.InvalidParameterValue, "role %q cannot have a SUBJECT", u,
+					return errors.WithDetailf(
+						pgerror.Newf(pgcode.InvalidParameterValue, "role %q cannot have a SUBJECT", u),
 						"use the --%s CLI flag to configure root",
-						cliflags.RootCertDistinguishedName.Name)
+						cliflags.RootCertDistinguishedName.Name,
+					)
 				}
 				if err := distinguishedname.ValidateDN(s); err != nil {
 					return pgerror.WithCandidateCode(err, pgcode.InvalidParameterValue)