fix(pgwire): guard against out-of-bounds access in DDL command parsers

Replace direct index access with bounds-checked alternatives in the
auth user DDL handler, and add early-return validation in GRANT/REVOKE
ROLE handlers to return a well-formed syntax error instead of panicking
when the command has too few parts.

Author: farhan-syah

nodedb/src/control/server/pgwire/ddl/auth_user_ddl.rs

@@ -32,7 +32,7 @@ pub fn handle_auth_user(
         ));
     }
 
-    let upper0 = parts[0].to_uppercase();
+    let upper0 = parts.first().map(|s| s.to_uppercase()).unwrap_or_default();
     match upper0.as_str() {
         "DEACTIVATE" => deactivate_auth_user(state, identity, parts),
         "ALTER" => alter_auth_user_status(state, identity, parts),

nodedb/src/control/server/pgwire/ddl/grant/role.rs

@@ -57,6 +57,13 @@ pub fn grant_role(
 ) -> PgWireResult<Vec<Response>> {
     require_admin(identity, "grant roles")?;
 
+    if parts.len() < 5 {
+        return Err(sqlstate_error(
+            "42601",
+            "syntax: GRANT ROLE <role> TO <user>",
+        ));
+    }
+
     let role = parse_role(parts[2]);
 
     if matches!(role, Role::Superuser) && !identity.is_superuser {
@@ -94,6 +101,13 @@ pub fn revoke_role(
 ) -> PgWireResult<Vec<Response>> {
     require_admin(identity, "revoke roles")?;
 
+    if parts.len() < 5 {
+        return Err(sqlstate_error(
+            "42601",
+            "syntax: REVOKE ROLE <role> FROM <user>",
+        ));
+    }
+
     let role = parse_role(parts[2]);
 
     if !parts[3].eq_ignore_ascii_case("FROM") {