session: sort MacaroonRecipe.Permissions in migration

Similar to the previous commit, we also sort the
`MacaroonRecipe.Permissions` slice to ensure it can be compared in a
deterministic manner during migrations.

Author: ViktorTigerstrom

session/sql_migration.go

@@ -382,9 +382,9 @@ func overrideSessionTimeZone(session *Session) {
 // or caveats to nil for the migrated session in that scenario, so that the
 // deep equals check does not fail in this scenario either.
 //
-// Additionally, we sort the caveats of both the kv and sql sessions by
-// their ID, so that they are always comparable in a deterministic way with deep
-// equals.
+// Additionally, we sort the caveats & permissions of both the kv and sql
+// sessions by their ID, so that they are always comparable in a deterministic
+// way with deep equals.
 func overrideMacaroonRecipe(kvSession *Session, migratedSession *Session) {
 	if kvSession.MacaroonRecipe != nil {
 		kvPerms := kvSession.MacaroonRecipe.Permissions
@@ -402,6 +402,7 @@ func overrideMacaroonRecipe(kvSession *Session, migratedSession *Session) {
 		}
 
 		sqlCaveats := migratedSession.MacaroonRecipe.Caveats
+		sqlPerms := migratedSession.MacaroonRecipe.Permissions
 
 		// If there have been caveats set for the MacaroonRecipe,
 		// the order of the postgres db caveats will in very rare cases
@@ -421,5 +422,28 @@ func overrideMacaroonRecipe(kvSession *Session, migratedSession *Session) {
 				) < 0
 			})
 		}
+
+		// Similarly, we sort the macaroon permissions for both the kv
+		// and sql sessions, so that we can compare them in a
+		// deterministic way.
+		if kvPerms != nil {
+			sort.Slice(kvPerms, func(i, j int) bool {
+				if kvPerms[i].Entity == kvPerms[j].Entity {
+					return kvPerms[i].Action <
+						kvPerms[j].Action
+				}
+
+				return kvPerms[i].Entity < kvPerms[j].Entity
+			})
+
+			sort.Slice(sqlPerms, func(i, j int) bool {
+				if sqlPerms[i].Entity == sqlPerms[j].Entity {
+					return sqlPerms[i].Action <
+						sqlPerms[j].Action
+				}
+
+				return sqlPerms[i].Entity < sqlPerms[j].Entity
+			})
+		}
 	}
 }