[vtctldserver] Migrate GetPermissions PR#9903 (#10013)

* [vtctldserver] Migrate GetPermissions PR#9903

This PR migrates GetPermissions rpc to VtctldServer

Run it locally: vtctldclient --server ":15999" GetPermissions zone1-100
unit test: go test vitess.io/vitess/go/vt/vtctl/grpcvtctldserver -run TestGetPermissions

Signed-off-by: Rameez Sajwani <rameezwazirali@hotmail.com>

* [vtctldserver] Migrate GetPermissions PR#9903

This PR migrates GetPermissions rpc to VtctldServer
Run it locally: vtctldclient --server ":15999" GetPermissions zone1-100
unit test: go test vitess.io/vitess/go/vt/vtctl/grpcvtctldserver -run TestGetPermissions

Signed-off-by: Rameez Sajwani <rameezwazirali@hotmail.com>

* [vtctldserver] Migrate GetPermissions PR#9903

This PR migrates GetPermissions rpc to VtctldServer
Run it locally: vtctldclient --server ":15999" GetPermissions zone1-100
unit test: go test vitess.io/vitess/go/vt/vtctl/grpcvtctldserver -run TestGetPermissions

Signed-off-by: Rameez Sajwani <rameezwazirali@hotmail.com>

* [vtctldserver] Migrate GetPermissions PR#9903

This PR migrates GetPermissions rpc to VtctldServer
Run it locally: vtctldclient --server ":15999" GetPermissions zone1-100
unit test: go test vitess.io/vitess/go/vt/vtctl/grpcvtctldserver -run TestGetPermissiions

Signed-off-by: Rameez Sajwani <rameezwazirali@hotmail.com>

go/cmd/vtctldclient/command/tablets.go

@@ -73,6 +73,14 @@ Note: hook names may not contain slash (/) characters.
 		Args:                  cobra.MinimumNArgs(2),
 		RunE:                  commandExecuteHook,
 	}
+	// GetPermissions makes a GetPermissions gRPC call to a vtctld.
+	GetPermissions = &cobra.Command{
+		Use:                   "GetPermissions <tablet_alias>",
+		Short:                 "Displays the permissions for a tablet.",
+		DisableFlagsInUseLine: true,
+		Args:                  cobra.ExactArgs(1),
+		RunE:                  commandGetPermissions,
+	}
 	// GetTablet makes a GetTablet gRPC call to a vtctld.
 	GetTablet = &cobra.Command{
 		Use:                   "GetTablet <alias>",
@@ -291,6 +299,29 @@ func commandExecuteHook(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
+func commandGetPermissions(cmd *cobra.Command, args []string) error {
+	alias, err := topoproto.ParseTabletAlias(cmd.Flags().Arg(0))
+	if err != nil {
+		return err
+	}
+
+	cli.FinishedParsing(cmd)
+
+	resp, err := client.GetPermissions(commandCtx, &vtctldatapb.GetPermissionsRequest{
+		TabletAlias: alias,
+	})
+	if err != nil {
+		return err
+	}
+	p, err := cli.MarshalJSON(resp.Permissions)
+	if err != nil {
+		return err
+	}
+	fmt.Printf("%s\n", p)
+
+	return nil
+}
+
 func commandGetTablet(cmd *cobra.Command, args []string) error {
 	aliasStr := cmd.Flags().Arg(0)
 	alias, err := topoproto.ParseTabletAlias(aliasStr)
@@ -565,6 +596,7 @@ func init() {
 	Root.AddCommand(DeleteTablets)
 
 	Root.AddCommand(ExecuteHook)
+	Root.AddCommand(GetPermissions)
 	Root.AddCommand(GetTablet)
 
 	GetTablets.Flags().StringSliceVarP(&getTabletsOptions.TabletAliasStrings, "tablet-alias", "t", nil, "List of tablet aliases to filter by")

go/vt/proto/vtctldata/vtctldata_vtproto.pb.go

@@ -3622,6 +3622,92 @@ func (m *GetKeyspaceResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *GetPermissionsRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GetPermissionsRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *GetPermissionsRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.TabletAlias != nil {
+		size, err := m.TabletAlias.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *GetPermissionsResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GetPermissionsResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *GetPermissionsResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Permissions != nil {
+		size, err := m.Permissions.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *GetRoutingRulesRequest) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -10280,6 +10366,38 @@ func (m *GetKeyspaceResponse) SizeVT() (n int) {
 	return n
 }
 
+func (m *GetPermissionsRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.TabletAlias != nil {
+		l = m.TabletAlias.SizeVT()
+		n += 1 + l + sov(uint64(l))
+	}
+	if m.unknownFields != nil {
+		n += len(m.unknownFields)
+	}
+	return n
+}
+
+func (m *GetPermissionsResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Permissions != nil {
+		l = m.Permissions.SizeVT()
+		n += 1 + l + sov(uint64(l))
+	}
+	if m.unknownFields != nil {
+		n += len(m.unknownFields)
+	}
+	return n
+}
+
 func (m *GetRoutingRulesRequest) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -20927,6 +21045,180 @@ func (m *GetKeyspaceResponse) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *GetPermissionsRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetPermissionsRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetPermissionsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TabletAlias", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.TabletAlias == nil {
+				m.TabletAlias = &topodata.TabletAlias{}
+			}
+			if err := m.TabletAlias.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetPermissionsResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetPermissionsResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetPermissionsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Permissions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Permissions == nil {
+				m.Permissions = &tabletmanagerdata.Permissions{}
+			}
+			if err := m.Permissions.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *GetRoutingRulesRequest) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0

go/vt/proto/vtctlservice/vtctlservice_grpc.pb.go

@@ -214,6 +214,8 @@ type VtctldClient interface {
 	GetKeyspace(ctx context.Context, in *vtctldata.GetKeyspaceRequest, opts ...grpc.CallOption) (*vtctldata.GetKeyspaceResponse, error)
 	// GetKeyspaces returns the keyspace struct of all keyspaces in the topo.
 	GetKeyspaces(ctx context.Context, in *vtctldata.GetKeyspacesRequest, opts ...grpc.CallOption) (*vtctldata.GetKeyspacesResponse, error)
+	// GetPermissions returns the permissions set on the remote tablet.
+	GetPermissions(ctx context.Context, in *vtctldata.GetPermissionsRequest, opts ...grpc.CallOption) (*vtctldata.GetPermissionsResponse, error)
 	// GetRoutingRules returns the VSchema routing rules.
 	GetRoutingRules(ctx context.Context, in *vtctldata.GetRoutingRulesRequest, opts ...grpc.CallOption) (*vtctldata.GetRoutingRulesResponse, error)
 	// GetSchema returns the schema for a tablet, or just the schema for the
@@ -688,6 +690,15 @@ func (c *vtctldClient) GetKeyspaces(ctx context.Context, in *vtctldata.GetKeyspa
 	return out, nil
 }
 
+func (c *vtctldClient) GetPermissions(ctx context.Context, in *vtctldata.GetPermissionsRequest, opts ...grpc.CallOption) (*vtctldata.GetPermissionsResponse, error) {
+	out := new(vtctldata.GetPermissionsResponse)
+	err := c.cc.Invoke(ctx, "/vtctlservice.Vtctld/GetPermissions", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *vtctldClient) GetRoutingRules(ctx context.Context, in *vtctldata.GetRoutingRulesRequest, opts ...grpc.CallOption) (*vtctldata.GetRoutingRulesResponse, error) {
 	out := new(vtctldata.GetRoutingRulesResponse)
 	err := c.cc.Invoke(ctx, "/vtctlservice.Vtctld/GetRoutingRules", in, out, opts...)
@@ -1252,6 +1263,8 @@ type VtctldServer interface {
 	GetKeyspace(context.Context, *vtctldata.GetKeyspaceRequest) (*vtctldata.GetKeyspaceResponse, error)
 	// GetKeyspaces returns the keyspace struct of all keyspaces in the topo.
 	GetKeyspaces(context.Context, *vtctldata.GetKeyspacesRequest) (*vtctldata.GetKeyspacesResponse, error)
+	// GetPermissions returns the permissions set on the remote tablet.
+	GetPermissions(context.Context, *vtctldata.GetPermissionsRequest) (*vtctldata.GetPermissionsResponse, error)
 	// GetRoutingRules returns the VSchema routing rules.
 	GetRoutingRules(context.Context, *vtctldata.GetRoutingRulesRequest) (*vtctldata.GetRoutingRulesResponse, error)
 	// GetSchema returns the schema for a tablet, or just the schema for the
@@ -1515,6 +1528,9 @@ func (UnimplementedVtctldServer) GetKeyspace(context.Context, *vtctldata.GetKeys
 func (UnimplementedVtctldServer) GetKeyspaces(context.Context, *vtctldata.GetKeyspacesRequest) (*vtctldata.GetKeyspacesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetKeyspaces not implemented")
 }
+func (UnimplementedVtctldServer) GetPermissions(context.Context, *vtctldata.GetPermissionsRequest) (*vtctldata.GetPermissionsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetPermissions not implemented")
+}
 func (UnimplementedVtctldServer) GetRoutingRules(context.Context, *vtctldata.GetRoutingRulesRequest) (*vtctldata.GetRoutingRulesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetRoutingRules not implemented")
 }
@@ -2173,6 +2189,24 @@ func _Vtctld_GetKeyspaces_Handler(srv interface{}, ctx context.Context, dec func
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Vtctld_GetPermissions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(vtctldata.GetPermissionsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VtctldServer).GetPermissions(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/vtctlservice.Vtctld/GetPermissions",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VtctldServer).GetPermissions(ctx, req.(*vtctldata.GetPermissionsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Vtctld_GetRoutingRules_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(vtctldata.GetRoutingRulesRequest)
 	if err := dec(in); err != nil {
@@ -3201,6 +3235,10 @@ var Vtctld_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetKeyspaces",
 			Handler:    _Vtctld_GetKeyspaces_Handler,
 		},
+		{
+			MethodName: "GetPermissions",
+			Handler:    _Vtctld_GetPermissions_Handler,
+		},
 		{
 			MethodName: "GetRoutingRules",
 			Handler:    _Vtctld_GetRoutingRules_Handler,

go/vt/vtctl/grpcvtctldclient/client_gen.go

@@ -272,6 +272,15 @@ func (client *gRPCVtctldClient) GetKeyspaces(ctx context.Context, in *vtctldatap
 	return client.c.GetKeyspaces(ctx, in, opts...)
 }
 
+// GetPermissions is part of the vtctlservicepb.VtctldClient interface.
+func (client *gRPCVtctldClient) GetPermissions(ctx context.Context, in *vtctldatapb.GetPermissionsRequest, opts ...grpc.CallOption) (*vtctldatapb.GetPermissionsResponse, error) {
+	if client.c == nil {
+		return nil, status.Error(codes.Unavailable, connClosedMsg)
+	}
+
+	return client.c.GetPermissions(ctx, in, opts...)
+}
+
 // GetRoutingRules is part of the vtctlservicepb.VtctldClient interface.
 func (client *gRPCVtctldClient) GetRoutingRules(ctx context.Context, in *vtctldatapb.GetRoutingRulesRequest, opts ...grpc.CallOption) (*vtctldatapb.GetRoutingRulesResponse, error) {
 	if client.c == nil {

go/vt/vtctl/grpcvtctldserver/server.go

@@ -1171,6 +1171,27 @@ func (s *VtctldServer) GetKeyspaces(ctx context.Context, req *vtctldatapb.GetKey
 	return &vtctldatapb.GetKeyspacesResponse{Keyspaces: keyspaces}, nil
 }
 
+// GetPermissions is part of the vtctlservicepb.VtctldServer interface.
+func (s *VtctldServer) GetPermissions(ctx context.Context, req *vtctldatapb.GetPermissionsRequest) (*vtctldatapb.GetPermissionsResponse, error) {
+	span, ctx := trace.NewSpan(ctx, "VtctldServer.GetPermissions")
+	defer span.Finish()
+
+	span.Annotate("tablet_alias", topoproto.TabletAliasString(req.TabletAlias))
+	ti, err := s.ts.GetTablet(ctx, req.TabletAlias)
+	if err != nil {
+		return nil, vterrors.Errorf(vtrpc.Code_NOT_FOUND, "Failed to get tablet %v: %v", req.TabletAlias, err)
+	}
+
+	p, err := s.tmc.GetPermissions(ctx, ti.Tablet)
+	if err != nil {
+		return nil, err
+	}
+
+	return &vtctldatapb.GetPermissionsResponse{
+		Permissions: p,
+	}, nil
+}
+
 // GetRoutingRules is part of the vtctlservicepb.VtctldServer interface.
 func (s *VtctldServer) GetRoutingRules(ctx context.Context, req *vtctldatapb.GetRoutingRulesRequest) (*vtctldatapb.GetRoutingRulesResponse, error) {
 	span, ctx := trace.NewSpan(ctx, "VtctldServer.GetRoutingRules")

go/vt/vtctl/grpcvtctldserver/server_test.go

@@ -4277,6 +4277,153 @@ func TestGetKeyspaces(t *testing.T) {
 	assert.Error(t, err)
 }
 
+func TestGetPermissions(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	var testGetPermissionsReply = &tabletmanagerdatapb.Permissions{
+		UserPermissions: []*tabletmanagerdatapb.UserPermission{
+			{
+				Host: "host1",
+				User: "user1",
+				Privileges: map[string]string{
+					"create": "yes",
+					"delete": "no",
+				},
+			},
+		},
+		DbPermissions: []*tabletmanagerdatapb.DbPermission{
+			{
+				Host: "host2",
+				Db:   "db1",
+				User: "user2",
+				Privileges: map[string]string{
+					"create": "no",
+					"delete": "yes",
+				},
+			},
+		},
+	}
+	tests := []struct {
+		name      string
+		tablets   []*topodatapb.Tablet
+		tmc       testutil.TabletManagerClient
+		req       *vtctldatapb.GetPermissionsRequest
+		shouldErr bool
+	}{
+		{
+			name: "ok",
+			tablets: []*topodatapb.Tablet{
+				{
+					Alias: &topodatapb.TabletAlias{
+						Cell: "zone1",
+						Uid:  100,
+					},
+				},
+			},
+			tmc: testutil.TabletManagerClient{
+				GetPermissionsResults: map[string]struct {
+					Permissions *tabletmanagerdatapb.Permissions
+					Error       error
+				}{
+					"zone1-0000000100": {
+						Permissions: testGetPermissionsReply,
+						Error:       nil,
+					},
+				},
+			},
+			req: &vtctldatapb.GetPermissionsRequest{
+				TabletAlias: &topodatapb.TabletAlias{
+					Cell: "zone1",
+					Uid:  100,
+				},
+			},
+		},
+		{
+			name: "no tablet",
+			tablets: []*topodatapb.Tablet{
+				{
+					Alias: &topodatapb.TabletAlias{
+						Cell: "zone1",
+						Uid:  404,
+					},
+				},
+			},
+			tmc: testutil.TabletManagerClient{
+				GetPermissionsResults: map[string]struct {
+					Permissions *tabletmanagerdatapb.Permissions
+					Error       error
+				}{
+					"zone1-0000000100": {
+						Permissions: testGetPermissionsReply,
+						Error:       nil,
+					},
+				},
+			},
+			req: &vtctldatapb.GetPermissionsRequest{
+				TabletAlias: &topodatapb.TabletAlias{
+					Cell: "zone1",
+					Uid:  100,
+				},
+			},
+			shouldErr: true,
+		},
+		{
+			name: "tmc call failed",
+			tablets: []*topodatapb.Tablet{
+				{
+					Alias: &topodatapb.TabletAlias{
+						Cell: "zone1",
+						Uid:  100,
+					},
+				},
+			},
+			tmc: testutil.TabletManagerClient{
+				GetPermissionsResults: map[string]struct {
+					Permissions *tabletmanagerdatapb.Permissions
+					Error       error
+				}{
+					"zone1-0000000100": {
+						Permissions: testGetPermissionsReply,
+						Error:       assert.AnError,
+					},
+				},
+			},
+			req: &vtctldatapb.GetPermissionsRequest{
+				TabletAlias: &topodatapb.TabletAlias{
+					Cell: "zone1",
+					Uid:  100,
+				},
+			},
+			shouldErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			ts := memorytopo.NewServer("zone1")
+			testutil.AddTablets(ctx, t, ts, nil, tt.tablets...)
+
+			vtctld := testutil.NewVtctldServerWithTabletManagerClient(t, ts, &tt.tmc, func(ts *topo.Server) vtctlservicepb.VtctldServer {
+				return NewVtctldServer(ts)
+			})
+			resp, err := vtctld.GetPermissions(ctx, tt.req)
+			if tt.shouldErr {
+				assert.Error(t, err)
+				return
+			}
+			// we should expect same user and DB permissions as assigned
+			assert.Equal(t, resp.Permissions.DbPermissions[0].Host, "host2")
+			assert.Equal(t, resp.Permissions.UserPermissions[0].Host, "host1")
+
+			require.NoError(t, err)
+		})
+	}
+}
+
 func TestGetRoutingRules(t *testing.T) {
 	t.Parallel()
 

go/vt/vtctl/grpcvtctldserver/testutil/test_tmclient.go

@@ -171,6 +171,13 @@ type TabletManagerClient struct {
 		Error    error
 	}
 	// keyed by tablet alias.
+	GetPermissionsDelays map[string]time.Duration
+	// keyed by tablet alias.
+	GetPermissionsResults map[string]struct {
+		Permissions *tabletmanagerdatapb.Permissions
+		Error       error
+	}
+	// keyed by tablet alias.
 	GetReplicasResults map[string]struct {
 		Replicas []string
 		Error    error
@@ -183,6 +190,16 @@ type TabletManagerClient struct {
 		Error  error
 	}
 	// keyed by tablet alias.
+	InitPrimaryDelays map[string]time.Duration
+	// keyed by tablet alias. injects a sleep to the end of the function
+	// regardless of parent context timeout or error result.
+	InitPrimaryPostDelays map[string]time.Duration
+	// keyed by tablet alias.
+	InitPrimaryResults map[string]struct {
+		Result string
+		Error  error
+	}
+	// keyed by tablet alias.
 	PrimaryPositionDelays map[string]time.Duration
 	// keyed by tablet alias.
 	PrimaryPositionResults map[string]struct {
@@ -208,16 +225,6 @@ type TabletManagerClient struct {
 		Error  error
 	}
 	// keyed by tablet alias.
-	InitPrimaryDelays map[string]time.Duration
-	// keyed by tablet alias. injects a sleep to the end of the function
-	// regardless of parent context timeout or error result.
-	InitPrimaryPostDelays map[string]time.Duration
-	// keyed by tablet alias.
-	InitPrimaryResults map[string]struct {
-		Result string
-		Error  error
-	}
-	// keyed by tablet alias.
 	RefreshStateResults map[string]error
 	// keyed by `<tablet_alias>/<wait_pos>`.
 	ReloadSchemaDelays map[string]time.Duration
@@ -505,6 +512,36 @@ func (fake *TabletManagerClient) ExecuteHook(ctx context.Context, tablet *topoda
 	return nil, fmt.Errorf("%w: no ExecuteHook result set for tablet %s", assert.AnError, key)
 }
 
+// GetPermission is part of the tmclient.TabletManagerClient interface.
+func (fake *TabletManagerClient) GetPermissions(ctx context.Context, tablet *topodatapb.Tablet) (*tabletmanagerdatapb.Permissions, error) {
+	if fake.GetPermissionsResults == nil {
+		return nil, assert.AnError
+	}
+
+	if tablet.Alias == nil {
+		return nil, assert.AnError
+	}
+
+	key := topoproto.TabletAliasString(tablet.Alias)
+
+	if fake.GetPermissionsDelays != nil {
+		if delay, ok := fake.GetPermissionsDelays[key]; ok {
+			select {
+			case <-ctx.Done():
+				return nil, ctx.Err()
+			case <-time.After(delay):
+				// proceed to results
+			}
+		}
+	}
+
+	if result, ok := fake.GetPermissionsResults[key]; ok {
+		return result.Permissions, result.Error
+	}
+
+	return nil, fmt.Errorf("%w: no permissions for %s", assert.AnError, key)
+}
+
 // GetReplicas is part of the tmclient.TabletManagerClient interface.
 func (fake *TabletManagerClient) GetReplicas(ctx context.Context, tablet *topodatapb.Tablet) ([]string, error) {
 	if fake.GetReplicasResults == nil {
@@ -549,6 +586,42 @@ func (fake *TabletManagerClient) GetSchema(ctx context.Context, tablet *topodata
 	return nil, fmt.Errorf("%w: no schemas for %s", assert.AnError, key)
 }
 
+// InitPrimary is part of the tmclient.TabletManagerClient interface.
+func (fake *TabletManagerClient) InitPrimary(ctx context.Context, tablet *topodatapb.Tablet, semiSync bool) (string, error) {
+	if fake.InitPrimaryResults == nil {
+		return "", assert.AnError
+	}
+
+	key := topoproto.TabletAliasString(tablet.Alias)
+
+	defer func() {
+		if fake.InitPrimaryPostDelays == nil {
+			return
+		}
+
+		if delay, ok := fake.InitPrimaryPostDelays[key]; ok {
+			time.Sleep(delay)
+		}
+	}()
+
+	if fake.InitPrimaryDelays != nil {
+		if delay, ok := fake.InitPrimaryDelays[key]; ok {
+			select {
+			case <-ctx.Done():
+				return "", ctx.Err()
+			case <-time.After(delay):
+				// proceed to results
+			}
+		}
+	}
+
+	if result, ok := fake.InitPrimaryResults[key]; ok {
+		return result.Result, result.Error
+	}
+
+	return "", assert.AnError
+}
+
 // PrimaryPosition is part of the tmclient.TabletManagerClient interface.
 func (fake *TabletManagerClient) PrimaryPosition(ctx context.Context, tablet *topodatapb.Tablet) (string, error) {
 	if fake.PrimaryPositionResults == nil {
@@ -671,42 +744,6 @@ func (fake *TabletManagerClient) PromoteReplica(ctx context.Context, tablet *top
 	return "", assert.AnError
 }
 
-// InitPrimary is part of the tmclient.TabletManagerClient interface.
-func (fake *TabletManagerClient) InitPrimary(ctx context.Context, tablet *topodatapb.Tablet, semiSync bool) (string, error) {
-	if fake.InitPrimaryResults == nil {
-		return "", assert.AnError
-	}
-
-	key := topoproto.TabletAliasString(tablet.Alias)
-
-	defer func() {
-		if fake.InitPrimaryPostDelays == nil {
-			return
-		}
-
-		if delay, ok := fake.InitPrimaryPostDelays[key]; ok {
-			time.Sleep(delay)
-		}
-	}()
-
-	if fake.InitPrimaryDelays != nil {
-		if delay, ok := fake.InitPrimaryDelays[key]; ok {
-			select {
-			case <-ctx.Done():
-				return "", ctx.Err()
-			case <-time.After(delay):
-				// proceed to results
-			}
-		}
-	}
-
-	if result, ok := fake.InitPrimaryResults[key]; ok {
-		return result.Result, result.Error
-	}
-
-	return "", assert.AnError
-}
-
 // RefreshState is part of the tmclient.TabletManagerClient interface.
 func (fake *TabletManagerClient) RefreshState(ctx context.Context, tablet *topodatapb.Tablet) error {
 	if fake.RefreshStateResults == nil {

go/vt/vtctl/localvtctldclient/client_gen.go

@@ -256,6 +256,11 @@ func (client *localVtctldClient) GetKeyspaces(ctx context.Context, in *vtctldata
 	return client.s.GetKeyspaces(ctx, in)
 }
 
+// GetPermissions is part of the vtctlservicepb.VtctldClient interface.
+func (client *localVtctldClient) GetPermissions(ctx context.Context, in *vtctldatapb.GetPermissionsRequest, opts ...grpc.CallOption) (*vtctldatapb.GetPermissionsResponse, error) {
+	return client.s.GetPermissions(ctx, in)
+}
+
 // GetRoutingRules is part of the vtctlservicepb.VtctldClient interface.
 func (client *localVtctldClient) GetRoutingRules(ctx context.Context, in *vtctldatapb.GetRoutingRulesRequest, opts ...grpc.CallOption) (*vtctldatapb.GetRoutingRulesResponse, error) {
 	return client.s.GetRoutingRules(ctx, in)

go/vt/vtctl/vtctl.go

@@ -3538,11 +3538,18 @@ func commandGetPermissions(ctx context.Context, wr *wrangler.Wrangler, subFlags
 	if err != nil {
 		return err
 	}
-	p, err := wr.GetPermissions(ctx, tabletAlias)
-	if err == nil {
-		printJSON(wr.Logger(), p)
-	}
+	resp, err := wr.VtctldServer().GetPermissions(ctx, &vtctldatapb.GetPermissionsRequest{
+		TabletAlias: tabletAlias,
+	})
+	if err != nil {
 		return err
+	}
+	p, err := json2.MarshalIndentPB(resp.Permissions, "	")
+	if err != nil {
+		return err
+	}
+	wr.Logger().Printf("%s\n", p)
+	return nil
 }
 
 func commandValidatePermissionsShard(ctx context.Context, wr *wrangler.Wrangler, subFlags *flag.FlagSet, args []string) error {

proto/vtctldata.proto

@@ -555,6 +555,14 @@ message GetKeyspaceResponse {
   Keyspace keyspace = 1;
 }
 
+message GetPermissionsRequest {
+  topodata.TabletAlias tablet_alias = 1;
+}
+
+message GetPermissionsResponse {
+  tabletmanagerdata.Permissions permissions = 1;
+}
+
 message GetRoutingRulesRequest {
 }
 

proto/vtctlservice.proto

@@ -109,6 +109,8 @@ service Vtctld {
   rpc GetKeyspace(vtctldata.GetKeyspaceRequest) returns (vtctldata.GetKeyspaceResponse) {};
   // GetKeyspaces returns the keyspace struct of all keyspaces in the topo.
   rpc GetKeyspaces(vtctldata.GetKeyspacesRequest) returns (vtctldata.GetKeyspacesResponse) {};
+  // GetPermissions returns the permissions set on the remote tablet.
+  rpc GetPermissions(vtctldata.GetPermissionsRequest) returns (vtctldata.GetPermissionsResponse) {};
   // GetRoutingRules returns the VSchema routing rules.
   rpc GetRoutingRules(vtctldata.GetRoutingRulesRequest) returns (vtctldata.GetRoutingRulesResponse) {};
   // GetSchema returns the schema for a tablet, or just the schema for the

web/vtadmin/src/proto/vtadmin.d.ts

@@ -34723,6 +34723,186 @@ export namespace vtctldata {
         public toJSON(): { [k: string]: any };
     }
 
+    /** Properties of a GetPermissionsRequest. */
+    interface IGetPermissionsRequest {
+
+        /** GetPermissionsRequest tablet_alias */
+        tablet_alias?: (topodata.ITabletAlias|null);
+    }
+
+    /** Represents a GetPermissionsRequest. */
+    class GetPermissionsRequest implements IGetPermissionsRequest {
+
+        /**
+         * Constructs a new GetPermissionsRequest.
+         * @param [properties] Properties to set
+         */
+        constructor(properties?: vtctldata.IGetPermissionsRequest);
+
+        /** GetPermissionsRequest tablet_alias. */
+        public tablet_alias?: (topodata.ITabletAlias|null);
+
+        /**
+         * Creates a new GetPermissionsRequest instance using the specified properties.
+         * @param [properties] Properties to set
+         * @returns GetPermissionsRequest instance
+         */
+        public static create(properties?: vtctldata.IGetPermissionsRequest): vtctldata.GetPermissionsRequest;
+
+        /**
+         * Encodes the specified GetPermissionsRequest message. Does not implicitly {@link vtctldata.GetPermissionsRequest.verify|verify} messages.
+         * @param message GetPermissionsRequest message or plain object to encode
+         * @param [writer] Writer to encode to
+         * @returns Writer
+         */
+        public static encode(message: vtctldata.IGetPermissionsRequest, writer?: $protobuf.Writer): $protobuf.Writer;
+
+        /**
+         * Encodes the specified GetPermissionsRequest message, length delimited. Does not implicitly {@link vtctldata.GetPermissionsRequest.verify|verify} messages.
+         * @param message GetPermissionsRequest message or plain object to encode
+         * @param [writer] Writer to encode to
+         * @returns Writer
+         */
+        public static encodeDelimited(message: vtctldata.IGetPermissionsRequest, writer?: $protobuf.Writer): $protobuf.Writer;
+
+        /**
+         * Decodes a GetPermissionsRequest message from the specified reader or buffer.
+         * @param reader Reader or buffer to decode from
+         * @param [length] Message length if known beforehand
+         * @returns GetPermissionsRequest
+         * @throws {Error} If the payload is not a reader or valid buffer
+         * @throws {$protobuf.util.ProtocolError} If required fields are missing
+         */
+        public static decode(reader: ($protobuf.Reader|Uint8Array), length?: number): vtctldata.GetPermissionsRequest;
+
+        /**
+         * Decodes a GetPermissionsRequest message from the specified reader or buffer, length delimited.
+         * @param reader Reader or buffer to decode from
+         * @returns GetPermissionsRequest
+         * @throws {Error} If the payload is not a reader or valid buffer
+         * @throws {$protobuf.util.ProtocolError} If required fields are missing
+         */
+        public static decodeDelimited(reader: ($protobuf.Reader|Uint8Array)): vtctldata.GetPermissionsRequest;
+
+        /**
+         * Verifies a GetPermissionsRequest message.
+         * @param message Plain object to verify
+         * @returns `null` if valid, otherwise the reason why it is not
+         */
+        public static verify(message: { [k: string]: any }): (string|null);
+
+        /**
+         * Creates a GetPermissionsRequest message from a plain object. Also converts values to their respective internal types.
+         * @param object Plain object
+         * @returns GetPermissionsRequest
+         */
+        public static fromObject(object: { [k: string]: any }): vtctldata.GetPermissionsRequest;
+
+        /**
+         * Creates a plain object from a GetPermissionsRequest message. Also converts values to other types if specified.
+         * @param message GetPermissionsRequest
+         * @param [options] Conversion options
+         * @returns Plain object
+         */
+        public static toObject(message: vtctldata.GetPermissionsRequest, options?: $protobuf.IConversionOptions): { [k: string]: any };
+
+        /**
+         * Converts this GetPermissionsRequest to JSON.
+         * @returns JSON object
+         */
+        public toJSON(): { [k: string]: any };
+    }
+
+    /** Properties of a GetPermissionsResponse. */
+    interface IGetPermissionsResponse {
+
+        /** GetPermissionsResponse permissions */
+        permissions?: (tabletmanagerdata.IPermissions|null);
+    }
+
+    /** Represents a GetPermissionsResponse. */
+    class GetPermissionsResponse implements IGetPermissionsResponse {
+
+        /**
+         * Constructs a new GetPermissionsResponse.
+         * @param [properties] Properties to set
+         */
+        constructor(properties?: vtctldata.IGetPermissionsResponse);
+
+        /** GetPermissionsResponse permissions. */
+        public permissions?: (tabletmanagerdata.IPermissions|null);
+
+        /**
+         * Creates a new GetPermissionsResponse instance using the specified properties.
+         * @param [properties] Properties to set
+         * @returns GetPermissionsResponse instance
+         */
+        public static create(properties?: vtctldata.IGetPermissionsResponse): vtctldata.GetPermissionsResponse;
+
+        /**
+         * Encodes the specified GetPermissionsResponse message. Does not implicitly {@link vtctldata.GetPermissionsResponse.verify|verify} messages.
+         * @param message GetPermissionsResponse message or plain object to encode
+         * @param [writer] Writer to encode to
+         * @returns Writer
+         */
+        public static encode(message: vtctldata.IGetPermissionsResponse, writer?: $protobuf.Writer): $protobuf.Writer;
+
+        /**
+         * Encodes the specified GetPermissionsResponse message, length delimited. Does not implicitly {@link vtctldata.GetPermissionsResponse.verify|verify} messages.
+         * @param message GetPermissionsResponse message or plain object to encode
+         * @param [writer] Writer to encode to
+         * @returns Writer
+         */
+        public static encodeDelimited(message: vtctldata.IGetPermissionsResponse, writer?: $protobuf.Writer): $protobuf.Writer;
+
+        /**
+         * Decodes a GetPermissionsResponse message from the specified reader or buffer.
+         * @param reader Reader or buffer to decode from
+         * @param [length] Message length if known beforehand
+         * @returns GetPermissionsResponse
+         * @throws {Error} If the payload is not a reader or valid buffer
+         * @throws {$protobuf.util.ProtocolError} If required fields are missing
+         */
+        public static decode(reader: ($protobuf.Reader|Uint8Array), length?: number): vtctldata.GetPermissionsResponse;
+
+        /**
+         * Decodes a GetPermissionsResponse message from the specified reader or buffer, length delimited.
+         * @param reader Reader or buffer to decode from
+         * @returns GetPermissionsResponse
+         * @throws {Error} If the payload is not a reader or valid buffer
+         * @throws {$protobuf.util.ProtocolError} If required fields are missing
+         */
+        public static decodeDelimited(reader: ($protobuf.Reader|Uint8Array)): vtctldata.GetPermissionsResponse;
+
+        /**
+         * Verifies a GetPermissionsResponse message.
+         * @param message Plain object to verify
+         * @returns `null` if valid, otherwise the reason why it is not
+         */
+        public static verify(message: { [k: string]: any }): (string|null);
+
+        /**
+         * Creates a GetPermissionsResponse message from a plain object. Also converts values to their respective internal types.
+         * @param object Plain object
+         * @returns GetPermissionsResponse
+         */
+        public static fromObject(object: { [k: string]: any }): vtctldata.GetPermissionsResponse;
+
+        /**
+         * Creates a plain object from a GetPermissionsResponse message. Also converts values to other types if specified.
+         * @param message GetPermissionsResponse
+         * @param [options] Conversion options
+         * @returns Plain object
+         */
+        public static toObject(message: vtctldata.GetPermissionsResponse, options?: $protobuf.IConversionOptions): { [k: string]: any };
+
+        /**
+         * Converts this GetPermissionsResponse to JSON.
+         * @returns JSON object
+         */
+        public toJSON(): { [k: string]: any };
+    }
+
     /** Properties of a GetRoutingRulesRequest. */
     interface IGetRoutingRulesRequest {
     }

web/vtadmin/src/proto/vtadmin.js

@@ -82380,6 +82380,390 @@ $root.vtctldata = (function() {
         return GetKeyspaceResponse;
     })();
 
+    vtctldata.GetPermissionsRequest = (function() {
+
+        /**
+         * Properties of a GetPermissionsRequest.
+         * @memberof vtctldata
+         * @interface IGetPermissionsRequest
+         * @property {topodata.ITabletAlias|null} [tablet_alias] GetPermissionsRequest tablet_alias
+         */
+
+        /**
+         * Constructs a new GetPermissionsRequest.
+         * @memberof vtctldata
+         * @classdesc Represents a GetPermissionsRequest.
+         * @implements IGetPermissionsRequest
+         * @constructor
+         * @param {vtctldata.IGetPermissionsRequest=} [properties] Properties to set
+         */
+        function GetPermissionsRequest(properties) {
+            if (properties)
+                for (var keys = Object.keys(properties), i = 0; i < keys.length; ++i)
+                    if (properties[keys[i]] != null)
+                        this[keys[i]] = properties[keys[i]];
+        }
+
+        /**
+         * GetPermissionsRequest tablet_alias.
+         * @member {topodata.ITabletAlias|null|undefined} tablet_alias
+         * @memberof vtctldata.GetPermissionsRequest
+         * @instance
+         */
+        GetPermissionsRequest.prototype.tablet_alias = null;
+
+        /**
+         * Creates a new GetPermissionsRequest instance using the specified properties.
+         * @function create
+         * @memberof vtctldata.GetPermissionsRequest
+         * @static
+         * @param {vtctldata.IGetPermissionsRequest=} [properties] Properties to set
+         * @returns {vtctldata.GetPermissionsRequest} GetPermissionsRequest instance
+         */
+        GetPermissionsRequest.create = function create(properties) {
+            return new GetPermissionsRequest(properties);
+        };
+
+        /**
+         * Encodes the specified GetPermissionsRequest message. Does not implicitly {@link vtctldata.GetPermissionsRequest.verify|verify} messages.
+         * @function encode
+         * @memberof vtctldata.GetPermissionsRequest
+         * @static
+         * @param {vtctldata.IGetPermissionsRequest} message GetPermissionsRequest message or plain object to encode
+         * @param {$protobuf.Writer} [writer] Writer to encode to
+         * @returns {$protobuf.Writer} Writer
+         */
+        GetPermissionsRequest.encode = function encode(message, writer) {
+            if (!writer)
+                writer = $Writer.create();
+            if (message.tablet_alias != null && Object.hasOwnProperty.call(message, "tablet_alias"))
+                $root.topodata.TabletAlias.encode(message.tablet_alias, writer.uint32(/* id 1, wireType 2 =*/10).fork()).ldelim();
+            return writer;
+        };
+
+        /**
+         * Encodes the specified GetPermissionsRequest message, length delimited. Does not implicitly {@link vtctldata.GetPermissionsRequest.verify|verify} messages.
+         * @function encodeDelimited
+         * @memberof vtctldata.GetPermissionsRequest
+         * @static
+         * @param {vtctldata.IGetPermissionsRequest} message GetPermissionsRequest message or plain object to encode
+         * @param {$protobuf.Writer} [writer] Writer to encode to
+         * @returns {$protobuf.Writer} Writer
+         */
+        GetPermissionsRequest.encodeDelimited = function encodeDelimited(message, writer) {
+            return this.encode(message, writer).ldelim();
+        };
+
+        /**
+         * Decodes a GetPermissionsRequest message from the specified reader or buffer.
+         * @function decode
+         * @memberof vtctldata.GetPermissionsRequest
+         * @static
+         * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from
+         * @param {number} [length] Message length if known beforehand
+         * @returns {vtctldata.GetPermissionsRequest} GetPermissionsRequest
+         * @throws {Error} If the payload is not a reader or valid buffer
+         * @throws {$protobuf.util.ProtocolError} If required fields are missing
+         */
+        GetPermissionsRequest.decode = function decode(reader, length) {
+            if (!(reader instanceof $Reader))
+                reader = $Reader.create(reader);
+            var end = length === undefined ? reader.len : reader.pos + length, message = new $root.vtctldata.GetPermissionsRequest();
+            while (reader.pos < end) {
+                var tag = reader.uint32();
+                switch (tag >>> 3) {
+                case 1:
+                    message.tablet_alias = $root.topodata.TabletAlias.decode(reader, reader.uint32());
+                    break;
+                default:
+                    reader.skipType(tag & 7);
+                    break;
+                }
+            }
+            return message;
+        };
+
+        /**
+         * Decodes a GetPermissionsRequest message from the specified reader or buffer, length delimited.
+         * @function decodeDelimited
+         * @memberof vtctldata.GetPermissionsRequest
+         * @static
+         * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from
+         * @returns {vtctldata.GetPermissionsRequest} GetPermissionsRequest
+         * @throws {Error} If the payload is not a reader or valid buffer
+         * @throws {$protobuf.util.ProtocolError} If required fields are missing
+         */
+        GetPermissionsRequest.decodeDelimited = function decodeDelimited(reader) {
+            if (!(reader instanceof $Reader))
+                reader = new $Reader(reader);
+            return this.decode(reader, reader.uint32());
+        };
+
+        /**
+         * Verifies a GetPermissionsRequest message.
+         * @function verify
+         * @memberof vtctldata.GetPermissionsRequest
+         * @static
+         * @param {Object.<string,*>} message Plain object to verify
+         * @returns {string|null} `null` if valid, otherwise the reason why it is not
+         */
+        GetPermissionsRequest.verify = function verify(message) {
+            if (typeof message !== "object" || message === null)
+                return "object expected";
+            if (message.tablet_alias != null && message.hasOwnProperty("tablet_alias")) {
+                var error = $root.topodata.TabletAlias.verify(message.tablet_alias);
+                if (error)
+                    return "tablet_alias." + error;
+            }
+            return null;
+        };
+
+        /**
+         * Creates a GetPermissionsRequest message from a plain object. Also converts values to their respective internal types.
+         * @function fromObject
+         * @memberof vtctldata.GetPermissionsRequest
+         * @static
+         * @param {Object.<string,*>} object Plain object
+         * @returns {vtctldata.GetPermissionsRequest} GetPermissionsRequest
+         */
+        GetPermissionsRequest.fromObject = function fromObject(object) {
+            if (object instanceof $root.vtctldata.GetPermissionsRequest)
+                return object;
+            var message = new $root.vtctldata.GetPermissionsRequest();
+            if (object.tablet_alias != null) {
+                if (typeof object.tablet_alias !== "object")
+                    throw TypeError(".vtctldata.GetPermissionsRequest.tablet_alias: object expected");
+                message.tablet_alias = $root.topodata.TabletAlias.fromObject(object.tablet_alias);
+            }
+            return message;
+        };
+
+        /**
+         * Creates a plain object from a GetPermissionsRequest message. Also converts values to other types if specified.
+         * @function toObject
+         * @memberof vtctldata.GetPermissionsRequest
+         * @static
+         * @param {vtctldata.GetPermissionsRequest} message GetPermissionsRequest
+         * @param {$protobuf.IConversionOptions} [options] Conversion options
+         * @returns {Object.<string,*>} Plain object
+         */
+        GetPermissionsRequest.toObject = function toObject(message, options) {
+            if (!options)
+                options = {};
+            var object = {};
+            if (options.defaults)
+                object.tablet_alias = null;
+            if (message.tablet_alias != null && message.hasOwnProperty("tablet_alias"))
+                object.tablet_alias = $root.topodata.TabletAlias.toObject(message.tablet_alias, options);
+            return object;
+        };
+
+        /**
+         * Converts this GetPermissionsRequest to JSON.
+         * @function toJSON
+         * @memberof vtctldata.GetPermissionsRequest
+         * @instance
+         * @returns {Object.<string,*>} JSON object
+         */
+        GetPermissionsRequest.prototype.toJSON = function toJSON() {
+            return this.constructor.toObject(this, $protobuf.util.toJSONOptions);
+        };
+
+        return GetPermissionsRequest;
+    })();
+
+    vtctldata.GetPermissionsResponse = (function() {
+
+        /**
+         * Properties of a GetPermissionsResponse.
+         * @memberof vtctldata
+         * @interface IGetPermissionsResponse
+         * @property {tabletmanagerdata.IPermissions|null} [permissions] GetPermissionsResponse permissions
+         */
+
+        /**
+         * Constructs a new GetPermissionsResponse.
+         * @memberof vtctldata
+         * @classdesc Represents a GetPermissionsResponse.
+         * @implements IGetPermissionsResponse
+         * @constructor
+         * @param {vtctldata.IGetPermissionsResponse=} [properties] Properties to set
+         */
+        function GetPermissionsResponse(properties) {
+            if (properties)
+                for (var keys = Object.keys(properties), i = 0; i < keys.length; ++i)
+                    if (properties[keys[i]] != null)
+                        this[keys[i]] = properties[keys[i]];
+        }
+
+        /**
+         * GetPermissionsResponse permissions.
+         * @member {tabletmanagerdata.IPermissions|null|undefined} permissions
+         * @memberof vtctldata.GetPermissionsResponse
+         * @instance
+         */
+        GetPermissionsResponse.prototype.permissions = null;
+
+        /**
+         * Creates a new GetPermissionsResponse instance using the specified properties.
+         * @function create
+         * @memberof vtctldata.GetPermissionsResponse
+         * @static
+         * @param {vtctldata.IGetPermissionsResponse=} [properties] Properties to set
+         * @returns {vtctldata.GetPermissionsResponse} GetPermissionsResponse instance
+         */
+        GetPermissionsResponse.create = function create(properties) {
+            return new GetPermissionsResponse(properties);
+        };
+
+        /**
+         * Encodes the specified GetPermissionsResponse message. Does not implicitly {@link vtctldata.GetPermissionsResponse.verify|verify} messages.
+         * @function encode
+         * @memberof vtctldata.GetPermissionsResponse
+         * @static
+         * @param {vtctldata.IGetPermissionsResponse} message GetPermissionsResponse message or plain object to encode
+         * @param {$protobuf.Writer} [writer] Writer to encode to
+         * @returns {$protobuf.Writer} Writer
+         */
+        GetPermissionsResponse.encode = function encode(message, writer) {
+            if (!writer)
+                writer = $Writer.create();
+            if (message.permissions != null && Object.hasOwnProperty.call(message, "permissions"))
+                $root.tabletmanagerdata.Permissions.encode(message.permissions, writer.uint32(/* id 1, wireType 2 =*/10).fork()).ldelim();
+            return writer;
+        };
+
+        /**
+         * Encodes the specified GetPermissionsResponse message, length delimited. Does not implicitly {@link vtctldata.GetPermissionsResponse.verify|verify} messages.
+         * @function encodeDelimited
+         * @memberof vtctldata.GetPermissionsResponse
+         * @static
+         * @param {vtctldata.IGetPermissionsResponse} message GetPermissionsResponse message or plain object to encode
+         * @param {$protobuf.Writer} [writer] Writer to encode to
+         * @returns {$protobuf.Writer} Writer
+         */
+        GetPermissionsResponse.encodeDelimited = function encodeDelimited(message, writer) {
+            return this.encode(message, writer).ldelim();
+        };
+
+        /**
+         * Decodes a GetPermissionsResponse message from the specified reader or buffer.
+         * @function decode
+         * @memberof vtctldata.GetPermissionsResponse
+         * @static
+         * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from
+         * @param {number} [length] Message length if known beforehand
+         * @returns {vtctldata.GetPermissionsResponse} GetPermissionsResponse
+         * @throws {Error} If the payload is not a reader or valid buffer
+         * @throws {$protobuf.util.ProtocolError} If required fields are missing
+         */
+        GetPermissionsResponse.decode = function decode(reader, length) {
+            if (!(reader instanceof $Reader))
+                reader = $Reader.create(reader);
+            var end = length === undefined ? reader.len : reader.pos + length, message = new $root.vtctldata.GetPermissionsResponse();
+            while (reader.pos < end) {
+                var tag = reader.uint32();
+                switch (tag >>> 3) {
+                case 1:
+                    message.permissions = $root.tabletmanagerdata.Permissions.decode(reader, reader.uint32());
+                    break;
+                default:
+                    reader.skipType(tag & 7);
+                    break;
+                }
+            }
+            return message;
+        };
+
+        /**
+         * Decodes a GetPermissionsResponse message from the specified reader or buffer, length delimited.
+         * @function decodeDelimited
+         * @memberof vtctldata.GetPermissionsResponse
+         * @static
+         * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from
+         * @returns {vtctldata.GetPermissionsResponse} GetPermissionsResponse
+         * @throws {Error} If the payload is not a reader or valid buffer
+         * @throws {$protobuf.util.ProtocolError} If required fields are missing
+         */
+        GetPermissionsResponse.decodeDelimited = function decodeDelimited(reader) {
+            if (!(reader instanceof $Reader))
+                reader = new $Reader(reader);
+            return this.decode(reader, reader.uint32());
+        };
+
+        /**
+         * Verifies a GetPermissionsResponse message.
+         * @function verify
+         * @memberof vtctldata.GetPermissionsResponse
+         * @static
+         * @param {Object.<string,*>} message Plain object to verify
+         * @returns {string|null} `null` if valid, otherwise the reason why it is not
+         */
+        GetPermissionsResponse.verify = function verify(message) {
+            if (typeof message !== "object" || message === null)
+                return "object expected";
+            if (message.permissions != null && message.hasOwnProperty("permissions")) {
+                var error = $root.tabletmanagerdata.Permissions.verify(message.permissions);
+                if (error)
+                    return "permissions." + error;
+            }
+            return null;
+        };
+
+        /**
+         * Creates a GetPermissionsResponse message from a plain object. Also converts values to their respective internal types.
+         * @function fromObject
+         * @memberof vtctldata.GetPermissionsResponse
+         * @static
+         * @param {Object.<string,*>} object Plain object
+         * @returns {vtctldata.GetPermissionsResponse} GetPermissionsResponse
+         */
+        GetPermissionsResponse.fromObject = function fromObject(object) {
+            if (object instanceof $root.vtctldata.GetPermissionsResponse)
+                return object;
+            var message = new $root.vtctldata.GetPermissionsResponse();
+            if (object.permissions != null) {
+                if (typeof object.permissions !== "object")
+                    throw TypeError(".vtctldata.GetPermissionsResponse.permissions: object expected");
+                message.permissions = $root.tabletmanagerdata.Permissions.fromObject(object.permissions);
+            }
+            return message;
+        };
+
+        /**
+         * Creates a plain object from a GetPermissionsResponse message. Also converts values to other types if specified.
+         * @function toObject
+         * @memberof vtctldata.GetPermissionsResponse
+         * @static
+         * @param {vtctldata.GetPermissionsResponse} message GetPermissionsResponse
+         * @param {$protobuf.IConversionOptions} [options] Conversion options
+         * @returns {Object.<string,*>} Plain object
+         */
+        GetPermissionsResponse.toObject = function toObject(message, options) {
+            if (!options)
+                options = {};
+            var object = {};
+            if (options.defaults)
+                object.permissions = null;
+            if (message.permissions != null && message.hasOwnProperty("permissions"))
+                object.permissions = $root.tabletmanagerdata.Permissions.toObject(message.permissions, options);
+            return object;
+        };
+
+        /**
+         * Converts this GetPermissionsResponse to JSON.
+         * @function toJSON
+         * @memberof vtctldata.GetPermissionsResponse
+         * @instance
+         * @returns {Object.<string,*>} JSON object
+         */
+        GetPermissionsResponse.prototype.toJSON = function toJSON() {
+            return this.constructor.toObject(this, $protobuf.util.toJSONOptions);
+        };
+
+        return GetPermissionsResponse;
+    })();
+
     vtctldata.GetRoutingRulesRequest = (function() {
 
         /**