From 476bdd23b357b3e60cdc55e814116255a9885ac7 Mon Sep 17 00:00:00 2001
From: Yasuo Honda <yasuo.honda@gmail.com>
Date: Tue, 5 May 2026 22:23:22 +0900
Subject: [PATCH] Grant execute on dbms_lock as SYS

Since Oracle 12c, SYSTEM cannot grant EXECUTE on SYS-owned packages
like DBMS_LOCK; only SYS (or a user with GRANT ANY OBJECT PRIVILEGE)
can. The grant in spec/support/unlock_and_setup_hr_user.sql therefore
fails on gvenzl/oracle-free with

    grant execute on dbms_lock to hr
                     *
    ERROR at line 1:
    ORA-01031: insufficient privileges

sqlplus does not propagate the error, so the failure has been
silently logged in CI.

The hr user happens not to need DBMS_LOCK on modern Oracle: the
threaded-cursor spec in spec/plsql/schema_spec.rb uses
DBMS_SESSION.sleep on 18c+ and only falls back to DBMS_LOCK.sleep on
older versions. DBMS_SESSION.sleep was introduced in 18c specifically
as a relocation of DBMS_LOCK.sleep so that callers no longer need
EXECUTE on DBMS_LOCK just to pause execution. On 11.2 there is no
equivalent in DBMS_SESSION (and no clean alternative outside of
DBMS_PIPE.RECEIVE_MESSAGE-on-a-nonexistent-pipe hacks), so the grant
remains necessary for the 11g matrix.

Move the grant into a separate "as sysdba" sqlplus session in
ci/setup_accounts.sh so it succeeds on both gvenzl/oracle-xe:11 and
gvenzl/oracle-free, and add "whenever sqlerror exit failure" so any
future grant failure surfaces instead of being hidden.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 ci/setup_accounts.sh                      | 9 +++++++++
 spec/support/unlock_and_setup_hr_user.sql | 1 -
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/ci/setup_accounts.sh b/ci/setup_accounts.sh
index 17f03159..1873c4b2 100755
--- a/ci/setup_accounts.sh
+++ b/ci/setup_accounts.sh
@@ -7,3 +7,12 @@ sqlplus system/${DATABASE_SYS_PASSWORD}@${DATABASE_NAME} <<SQL
 @@spec/support/create_arunit_user.sql
 exit
 SQL
+
+# `grant execute on dbms_lock` requires SYS in 12c+; SYSTEM no longer has the
+# privilege. Run it through a separate `as sysdba` session so the same script
+# works on both gvenzl/oracle-xe:11 and gvenzl/oracle-free.
+sqlplus -s sys/${DATABASE_SYS_PASSWORD}@${DATABASE_NAME} as sysdba <<SQL
+whenever sqlerror exit failure
+grant execute on dbms_lock to hr;
+exit
+SQL
diff --git a/spec/support/unlock_and_setup_hr_user.sql b/spec/support/unlock_and_setup_hr_user.sql
index 1cd91154..ee117ddf 100644
--- a/spec/support/unlock_and_setup_hr_user.sql
+++ b/spec/support/unlock_and_setup_hr_user.sql
@@ -1,4 +1,3 @@
 create user hr identified by hr;
 alter user hr identified by hr account unlock;
 grant dba to hr;
-grant execute on dbms_lock to hr;