From c948b64355ecc2f347ecc704fa05a80e89c7c2b1 Mon Sep 17 00:00:00 2001
From: David Assigbi <50207516+davidassigbi@users.noreply.github.com>
Date: Wed, 29 Jul 2026 14:57:12 +0200
Subject: [PATCH] fix(user-permissions): assign @permission in onlyif query to
 prevent spurious corrective runs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The permission_exists.sql.epp template never assigned the SQL variable
@permission inside its loop, so it stayed NULL. Since permission_name =
NULL is never TRUE, the onlyif subquery always returned NULL, ISNULL
coerced it to 'REVOKE', and the check always saw a mismatch — causing
Puppet to re-grant permissions on every run.
---
 templates/query/user/permission_exists.sql.epp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/query/user/permission_exists.sql.epp b/templates/query/user/permission_exists.sql.epp
index 3d99358d..3f0fe587 100644
--- a/templates/query/user/permission_exists.sql.epp
+++ b/templates/query/user/permission_exists.sql.epp
@@ -3,5 +3,6 @@ USE [<%= $database %>];
 DECLARE @perm_state varchar(250), @error_msg varchar(250), @permission varchar(250);
 <% $permissions.each |$requested_permission| { %>
     <% $permission = $requested_permission.upcase %>
+SET @permission = '<%= $permission %>';
 <%= epp('sqlserver/snippets/user/permission/exists.sql.epp', $user_permission_exists_parameters) %>
 <% } %>