feat: Support importing role grants

mysql/resource_grant.go

@@ -660,7 +660,7 @@ func isNonExistingGrant(err error) bool {
 }
 
 func ImportGrant(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
-	userHostDatabaseTable := strings.Split(d.Id(), "@")
+	userHostDatabaseTable := strings.Split(strings.TrimSuffix(d.Id(), ";r"), "@")
 
 	if len(userHostDatabaseTable) != 4 && len(userHostDatabaseTable) != 5 {
 		return nil, fmt.Errorf("wrong ID format %s - expected user@host@database@table (and optionally ending @ to signify grant option) where some parts can be empty)", d.Id())
@@ -676,11 +676,19 @@ func ImportGrant(ctx context.Context, d *schema.ResourceData, meta interface{})
 		Host: host,
 	}
 
-	desiredGrant := &TablePrivilegeGrant{
-		Database:   database,
-		Table:      table,
-		Grant:      grantOption,
-		UserOrRole: userOrRole,
+	var desiredGrant MySQLGrant
+	if strings.HasSuffix(d.Id(), ";r") {
+		desiredGrant = &RoleGrant{
+			UserOrRole: userOrRole,
+			Grant:      grantOption,
+		}
+	} else {
+		desiredGrant = &TablePrivilegeGrant{
+			Database:   database,
+			Table:      table,
+			Grant:      grantOption,
+			UserOrRole: userOrRole,
+		}
 	}
 
 	db, err := getDatabaseFromMeta(ctx, meta)
@@ -696,6 +704,15 @@ func ImportGrant(ctx context.Context, d *schema.ResourceData, meta interface{})
 		if foundGrant.ConflictsWithGrant(desiredGrant) {
 			res := resourceGrant().Data(nil)
 			setDataFromGrant(foundGrant, res)
+			if _, ok := desiredGrant.(*RoleGrant); ok {
+				/*
+					Import database and table for role grants literally for backwards compatibility.
+					Role grants do not have a database or table, but we still set them here to avoid
+					making existing resources to "force replacement".
+				*/
+				res.Set("database", database)
+				res.Set("table", table)
+			}
 			return []*schema.ResourceData{res}, nil
 		}
 	}

website/docs/r/grant.html.markdown

@@ -89,6 +89,7 @@ No further attributes are exported.
 
 Grants can be imported using user, host, database and table.
 For grants without explicit database or tables, use `*`.
+For role grants, append `;r` as a suffix to the import id.
 
 You can also add an extra at sign `@` to the import definition to specify
 the grant contains WITH GRANT OPTION.
@@ -97,6 +98,9 @@ the grant contains WITH GRANT OPTION.
 $ terraform import mysql_grant.example user@host@database@table
 $ terraform import mysql_grant.all_db user@host@*@*
 
+# Import a role grant
+$ terraform import mysql_grant.role user@host@database@table;r
+
 # Import the first example with grant option
 $ terraform import mysql_grant.example user@host@database@table@
 ```