Bug fix: don't set branch control admin privs when rebasing

go/libraries/doltcore/sqle/dprocedures/dolt_branch.go

@@ -74,7 +74,7 @@ func doDoltBranch(ctx *sql.Context, args []string) (int, error) {
 
 	switch {
 	case apr.Contains(cli.CopyFlag):
-		err = copyBranch(ctx, dbData, apr, &rsc)
+		err = copyBranch(ctx, dbData, apr, &rsc, true)
 	case apr.Contains(cli.MoveFlag):
 		err = renameBranch(ctx, dbData, apr, dSess, dbName, &rsc)
 	case apr.Contains(cli.DeleteFlag), apr.Contains(cli.DeleteForceFlag):
@@ -480,7 +480,9 @@ func createNewBranch(ctx *sql.Context, dbData env.DbData[*sql.Context], apr *arg
 	return nil
 }
 
-func copyBranch(ctx *sql.Context, dbData env.DbData[*sql.Context], apr *argparser.ArgParseResults, rsc *doltdb.ReplicationStatusController) error {
+// copyBranch takes arguments from |apr| to create a branch from another branch. If |giveAdminPrivs| is true, then the
+// new branch will receive branch control admin privileges.
+func copyBranch(ctx *sql.Context, dbData env.DbData[*sql.Context], apr *argparser.ArgParseResults, rsc *doltdb.ReplicationStatusController, giveAdminPrivs bool) error {
 	if apr.NArg() != 2 {
 		return InvalidArgErr
 	}
@@ -496,10 +498,12 @@ func copyBranch(ctx *sql.Context, dbData env.DbData[*sql.Context], apr *argparse
 	}
 
 	force := apr.Contains(cli.ForceFlag)
-	return copyABranch(ctx, dbData, srcBr, destBr, force, rsc)
+	return copyABranch(ctx, dbData, srcBr, destBr, force, giveAdminPrivs, rsc)
 }
 
-func copyABranch(ctx *sql.Context, dbData env.DbData[*sql.Context], srcBr string, destBr string, force bool, rsc *doltdb.ReplicationStatusController) error {
+// copyABranch copies |srcBr| to |destBr|, forcing the copy if |force| is set, and giving branch control admin privileges
+// if |giveAdminPrivs| is set.
+func copyABranch(ctx *sql.Context, dbData env.DbData[*sql.Context], srcBr string, destBr string, force bool, giveAdminPrivs bool, rsc *doltdb.ReplicationStatusController) error {
 	if err := branch_control.CanCreateBranch(ctx, destBr); err != nil {
 		return err
 	}
@@ -522,9 +526,11 @@ func copyABranch(ctx *sql.Context, dbData env.DbData[*sql.Context], srcBr string
 			return fmt.Errorf("fatal: Unexpected error copying branch from '%s' to '%s'", srcBr, destBr)
 		}
 	}
-	err = branch_control.AddAdminForContext(ctx, destBr)
-	if err != nil {
-		return err
+
+	if giveAdminPrivs {
+		if err = branch_control.AddAdminForContext(ctx, destBr); err != nil {
+			return err
+		}
 	}
 
 	return nil

go/libraries/doltcore/sqle/dprocedures/dolt_rebase.go

@@ -723,7 +723,7 @@ func continueRebase(ctx *sql.Context) (string, error) {
 	//       branch and updates the working root and staged root for the working set. We may be able
 	//       to fix this race condition by changing doltdb.NewBranchAtCommit to use
 	//       database.CommitWithWorkingSet, since it updates a branch head and working set atomically.
-	err = copyABranch(ctx, dbData, rebaseWorkingBranch, rebaseBranch, true, nil)
+	err = copyABranch(ctx, dbData, rebaseWorkingBranch, rebaseBranch, true, false, nil)
 	if err != nil {
 		return "", err
 	}

go/libraries/doltcore/sqle/enginetest/branch_control_test.go

@@ -1050,6 +1050,68 @@ var BranchControlTests = []BranchControlTest{
 			},
 		},
 	},
+	{
+		// https://github.com/dolthub/dolt/issues/10352
+		Name: "Rebase respects existing branch control privileges",
+		SetUpScript: []string{
+			"create table tbl (i int);",
+			"insert into tbl values (42);",
+			"call dolt_commit('-A','-m', 'initial data');",
+			"call dolt_branch('branch1');",
+			"CREATE USER testuser@localhost;",
+			"GRANT ALL ON *.* TO testuser@localhost;",
+			"DELETE FROM dolt_branch_control WHERE user = '%';",
+			"INSERT INTO dolt_branch_control VALUES ('%','%','root','%', 'admin');",
+			"INSERT INTO dolt_branch_control VALUES ('%','branch1','testuser','%', 'write');",
+			"call dolt_commit('--allow-empty', '-m', 'empty');",
+		},
+		Assertions: []BranchControlTestAssertion{
+			{
+				User:     "testuser",
+				Host:     "localhost",
+				Query:    "SELECT * FROM dolt_branch_control WHERE user = 'testuser' and branch = 'branch1';",
+				Expected: []sql.Row{{"%", "branch1", "testuser", "%", "write"}},
+			},
+			{
+				User:     "testuser",
+				Host:     "localhost",
+				Query:    "call dolt_checkout('branch1');",
+				Expected: []sql.Row{{0, "Switched to branch 'branch1'"}},
+			},
+			{
+				User:     "testuser",
+				Host:     "localhost",
+				Query:    "insert into tbl values (23);",
+				Expected: []sql.Row{{types.OkResult{Info: nil, RowsAffected: 0x1, InsertID: 0x0}}},
+			},
+			{
+				User:     "testuser",
+				Host:     "localhost",
+				Query:    "call dolt_commit('-a', '-m', 'user1 change');",
+				Expected: []sql.Row{{doltCommit}},
+			},
+			{
+				User:  "testuser",
+				Host:  "localhost",
+				Query: "call dolt_rebase('--interactive', 'main');",
+				Expected: []sql.Row{
+					{0, "interactive rebase started on branch dolt_rebase_branch1; adjust the rebase plan in the dolt_rebase table, then continue rebasing by calling dolt_rebase('--continue')"},
+				},
+			},
+			{
+				User:     "testuser",
+				Host:     "localhost",
+				Query:    "call dolt_rebase('--continue');",
+				Expected: []sql.Row{{0, "Successfully rebased and updated refs/heads/branch1"}},
+			},
+			{
+				User:     "testuser",
+				Host:     "localhost",
+				Query:    "SELECT * FROM dolt_branch_control WHERE user = 'testuser' and branch = 'branch1';",
+				Expected: []sql.Row{{"%", "branch1", "testuser", "%", "write"}},
+			},
+		},
+	},
 	{
 		Name: "Creating branch creates new entry",
 		SetUpScript: []string{