From a0d653b630cec6a7700fdd0872fe2c4e24e90232 Mon Sep 17 00:00:00 2001
From: Anthony Romano <anthony.romano@coreos.com>
Date: Tue, 12 Apr 2016 10:08:10 -0700
Subject: [PATCH 1/2] e2e: test etcdctl v2 double user grant

Crashes in 2.3.1
---
 e2e/ctl_v2_test.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/e2e/ctl_v2_test.go b/e2e/ctl_v2_test.go
index 394203d71..7b6dcf0bb 100644
--- a/e2e/ctl_v2_test.go
+++ b/e2e/ctl_v2_test.go
@@ -181,6 +181,12 @@ func testCtlV2GetRoleUser(t *testing.T, cfg *etcdProcessClusterConfig) {
 	if err := etcdctlUserGet(epc, "username"); err != nil {
 		t.Fatalf("failed to get user (%v)", err)
 	}
+	// ensure double grant gives an error; was crashing in 2.3.1
+	regrantArgs := etcdctlPrefixArgs(epc)
+	regrantArgs = append(regrantArgs, "user", "grant", "--roles", "foo", "username")
+	if err := spawnWithExpect(regrantArgs, "duplicate"); err != nil {
+		t.Fatalf("missing duplicate error on double grant role (%v)", err)
+	}
 }
 
 func TestCtlV2UserList(t *testing.T) {

From a12fd9cc92d16435f7ca31c6ba33417ccff2dea4 Mon Sep 17 00:00:00 2001
From: Anthony Romano <anthony.romano@coreos.com>
Date: Tue, 12 Apr 2016 10:26:40 -0700
Subject: [PATCH 2/2] etcdctl: print grant/revoke error instead of scanning
 roles for changes

Fixes #5045
---
 etcdctl/ctlv2/command/user_commands.go | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/etcdctl/ctlv2/command/user_commands.go b/etcdctl/ctlv2/command/user_commands.go
index 2ff6a9647..497ab4a2a 100644
--- a/etcdctl/ctlv2/command/user_commands.go
+++ b/etcdctl/ctlv2/command/user_commands.go
@@ -17,8 +17,6 @@ package command
 import (
 	"fmt"
 	"os"
-	"reflect"
-	"sort"
 	"strings"
 
 	"github.com/bgentry/speakeasy"
@@ -195,21 +193,12 @@ func userGrantRevoke(c *cli.Context, grant bool) {
 		os.Exit(1)
 	}
 
-	var newUser *client.User
 	if grant {
-		newUser, err = api.GrantUser(ctx, user, roles)
+		_, err = api.GrantUser(ctx, user, roles)
 	} else {
-		newUser, err = api.RevokeUser(ctx, user, roles)
-	}
-	sort.Strings(newUser.Roles)
-	sort.Strings(currentUser.Roles)
-	if reflect.DeepEqual(newUser.Roles, currentUser.Roles) {
-		if grant {
-			fmt.Printf("User unchanged; roles already granted")
-		} else {
-			fmt.Printf("User unchanged; roles already revoked")
-		}
+		_, err = api.RevokeUser(ctx, user, roles)
 	}
+
 	if err != nil {
 		fmt.Fprintln(os.Stderr, err.Error())
 		os.Exit(1)