Fix remaining test failures

Seen in https://buildkite.com/materialize/test/builds/103189

Author: def-

src/authenticator/Cargo.toml

@@ -18,3 +18,6 @@ workspace = true
 
 [features]
 default = ["workspace-hack"]
+
+[package.metadata.cargo-udeps.ignore]
+normal = ["mz-server-core", "workspace-hack"]

test/copy-to-s3/http/grant.td

@@ -0,0 +1,10 @@
+# Copyright Materialize, Inc. and contributors. All rights reserved.
+#
+# Use of this software is governed by the Business Source License
+# included in the LICENSE file at the root of this repository.
+#
+# As of the Change Date specified in that file, in accordance with
+# the Business Source License, use of this software will be governed
+# by the Apache License, Version 2.0.
+
+> GRANT USAGE ON CONNECTION aws_conn TO "anonymous_http_user"

test/copy-to-s3/mzcompose.py

@@ -279,34 +279,56 @@ def workflow_http(c: Composition) -> None:
     """Test http endpoint allows COPY TO S3 but not COPY TO STDOUT."""
     c.up("materialized", "minio")
 
-    c.run_testdrive_files("http/setup.td")
-
-    result = c.exec(
-        "materialized",
-        "curl",
-        "http://localhost:6878/api/sql",
-        "-k",
-        "-s",
-        "--header",
-        "Content-Type: application/json",
-        "--data",
-        "{\"query\": \"COPY (SELECT 1) TO 's3://copytos3/test/http/' WITH (AWS CONNECTION = aws_conn, FORMAT = 'csv');\"}",
-        capture=True,
-    )
-    assert result.returncode == 0
-    assert json.loads(result.stdout)["results"][0]["ok"] == "COPY 1"
-
-    result = c.exec(
-        "materialized",
-        "curl",
-        "http://localhost:6878/api/sql",
-        "-k",
-        "-s",
-        "--header",
-        "Content-Type: application/json",
-        "--data",
-        '{"query": "COPY (SELECT 1) TO STDOUT"}',
-        capture=True,
-    )
-    assert result.returncode == 0
-    assert "unsupported via this API" in result.stdout
+    with c.override(Testdrive(no_reset=True)):
+        c.run_testdrive_files("http/setup.td")
+
+        result = c.exec(
+            "materialized",
+            "curl",
+            "http://localhost:6878/api/sql",
+            "-k",
+            "-s",
+            "--header",
+            "Content-Type: application/json",
+            "--data",
+            "{\"query\": \"COPY (SELECT 1) TO 's3://copytos3/test/http/' WITH (AWS CONNECTION = aws_conn, FORMAT = 'csv');\"}",
+            capture=True,
+        )
+        assert result.returncode == 0
+        assert (
+            json.loads(result.stdout)["results"][0]["error"]["message"]
+            == 'permission denied for CONNECTION "materialize.public.aws_conn"'
+            and json.loads(result.stdout)["results"][0]["error"]["detail"]
+            == "The 'anonymous_http_user' role needs USAGE privileges on CONNECTION \"materialize.public.aws_conn\""
+        )
+
+        c.run_testdrive_files("http/grant.td")
+        result = c.exec(
+            "materialized",
+            "curl",
+            "http://localhost:6878/api/sql",
+            "-k",
+            "-s",
+            "--header",
+            "Content-Type: application/json",
+            "--data",
+            "{\"query\": \"COPY (SELECT 1) TO 's3://copytos3/test/http/' WITH (AWS CONNECTION = aws_conn, FORMAT = 'csv');\"}",
+            capture=True,
+        )
+        assert result.returncode == 0
+        assert json.loads(result.stdout)["results"][0]["ok"] == "COPY 1"
+
+        result = c.exec(
+            "materialized",
+            "curl",
+            "http://localhost:6878/api/sql",
+            "-k",
+            "-s",
+            "--header",
+            "Content-Type: application/json",
+            "--data",
+            '{"query": "COPY (SELECT 1) TO STDOUT"}',
+            capture=True,
+        )
+        assert result.returncode == 0
+        assert "unsupported via this API" in result.stdout

test/legacy-upgrade/check-from-v0.83.0-role.td

@@ -11,6 +11,7 @@ $ skip-if
 SELECT mz_version_num() < 8300;
 
 > SELECT name FROM mz_roles;
+anonymous_http_user
 group
 joe
 mz_analytics