Merge branch 'master' into parallel-downloading-url-engine

base/base/StringRef.h

@@ -46,9 +46,9 @@ struct StringRef
 
     constexpr StringRef(const char * data_, size_t size_) : data(data_), size(size_) {}
 
-    StringRef(const std::string & s) : data(s.data()), size(s.size()) {}
+    StringRef(const std::string & s) : data(s.data()), size(s.size()) {} /// NOLINT
     constexpr explicit StringRef(std::string_view s) : data(s.data()), size(s.size()) {}
-    constexpr StringRef(const char * data_) : StringRef(std::string_view{data_}) {}
+    constexpr StringRef(const char * data_) : StringRef(std::string_view{data_}) {} /// NOLINT
     constexpr StringRef() = default;
 
     std::string toString() const { return std::string(data, size); }

docs/en/operations/named-collections.md

@@ -41,7 +41,7 @@ Example of configuration:
 </clickhouse>
 ```
 
-### An example of using named connections with the s3 function
+### Example of using named connections with the s3 function
 
 ```sql
 INSERT INTO FUNCTION s3(s3_mydata, url = 'https://s3.us-east-1.amazonaws.com/yourbucket/mydata/test_file.tsv.gz',
@@ -57,7 +57,7 @@ FROM s3(s3_mydata, url = 'https://s3.us-east-1.amazonaws.com/yourbucket/mydata/t
 1 rows in set. Elapsed: 0.279 sec. Processed 10.00 thousand rows, 90.00 KB (35.78 thousand rows/s., 322.02 KB/s.)
 ```
 
-### An example of using named connections with an S3 table
+### Example of using named connections with an S3 table
 
 ```sql
 CREATE TABLE s3_engine_table (number Int64)
@@ -72,7 +72,7 @@ SELECT * FROM s3_engine_table LIMIT 3;
 └────────┘
 ```
 
-## Named connections for accessing MySQL database.
+## Named connections for accessing MySQL database
 
 The description of parameters see [mysql](../sql-reference/table-functions/mysql.md).
 
@@ -94,7 +94,7 @@ Example of configuration:
 </clickhouse>
 ```
 
-### An example of using named connections with the mysql function
+### Example of using named connections with the mysql function
 
 ```sql
 SELECT count() FROM mysql(mymysql, table = 'test');
@@ -104,7 +104,7 @@ SELECT count() FROM mysql(mymysql, table = 'test');
 └─────────┘
 ```
 
-### An example of using named connections with an MySQL table
+### Example of using named connections with an MySQL table
 
 ```sql
 CREATE TABLE mytable(A Int64) ENGINE = MySQL(mymysql, table = 'test', connection_pool_size=3, replace_query=0);
@@ -115,7 +115,20 @@ SELECT count() FROM mytable;
 └─────────┘
 ```
 
-### An example of using named with an external dictionary with source MySQL
+### Example of using named connections with database with engine MySQL
+
+```sql
+CREATE DATABASE mydatabase ENGINE = MySQL(mymysql);
+
+SHOW TABLES FROM mydatabase;
+
+┌─name───┐
+│ source │
+│ test   │
+└────────┘
+```
+
+### Example of using named connections with an external dictionary with source MySQL
 
 ```sql
 CREATE DICTIONARY dict (A Int64, B String)
@@ -130,3 +143,87 @@ SELECT dictGet('dict', 'B', 2);
 │ two                     │
 └─────────────────────────┘
 ```
+
+## Named connections for accessing PostgreSQL database
+
+The description of parameters see [postgresql](../sql-reference/table-functions/postgresql.md).
+
+Example of configuration:
+```xml
+<clickhouse>
+    <named_collections>
+        <mypg>
+            <user>pguser</user>
+            <password>jw8s0F4</password>
+            <host>127.0.0.1</host>
+            <port>5432</port>
+            <database>test</database>
+            <schema>test_schema</schema>
+            <connection_pool_size>8</connection_pool_size>
+        </mypg>
+    </named_collections>
+</clickhouse>
+```
+
+### Example of using named connections with the postgresql function
+
+```sql
+SELECT * FROM postgresql(mypg, table = 'test');
+
+┌─a─┬─b───┐
+│ 2 │ two │
+│ 1 │ one │
+└───┴─────┘
+
+
+SELECT * FROM postgresql(mypg, table = 'test', schema = 'public');
+
+┌─a─┐
+│ 1 │
+│ 2 │
+│ 3 │
+└───┘
+```
+
+
+### Example of using named connections with database with engine PostgreSQL
+
+```sql
+CREATE TABLE mypgtable (a Int64) ENGINE = PostgreSQL(mypg, table = 'test', schema = 'public');
+
+SELECT * FROM mypgtable;
+
+┌─a─┐
+│ 1 │
+│ 2 │
+│ 3 │
+└───┘
+```
+
+### Example of using named connections with database with engine PostgreSQL
+
+```sql
+CREATE DATABASE mydatabase ENGINE = PostgreSQL(mypg);
+
+SHOW TABLES FROM mydatabase
+
+┌─name─┐
+│ test │
+└──────┘
+```
+
+### Example of using named connections with an external dictionary with source POSTGRESQL
+
+```sql
+CREATE DICTIONARY dict (a Int64, b String)
+PRIMARY KEY a
+SOURCE(POSTGRESQL(NAME mypg TABLE test))
+LIFETIME(MIN 1 MAX 2)
+LAYOUT(HASHED());
+
+SELECT dictGet('dict', 'b', 2);
+
+┌─dictGet('dict', 'b', 2)─┐
+│ two                     │
+└─────────────────────────┘
+```

docs/ru/operations/named-collections.md

@@ -24,7 +24,7 @@ $ cat /etc/clickhouse-server/config.d/named_collections.xml
 </clickhouse>
 ```
 
-## Именованные соединения для доступа к S3.
+## Именованные соединения для доступа к S3
 
 Описание параметров смотри [Табличная Функция S3](../sql-reference/table-functions/s3.md).
 
@@ -72,7 +72,7 @@ SELECT * FROM s3_engine_table LIMIT 3;
 └────────┘
 ```
 
-## Пример использования именованных соединений с базой данных MySQL.
+## Пример использования именованных соединений с базой данных MySQL
 
 Описание параметров смотри [mysql](../sql-reference/table-functions/mysql.md).
 
@@ -104,7 +104,7 @@ SELECT count() FROM mysql(mymysql, table = 'test');
 └─────────┘
 ```
 
-### Пример использования именованных таблицей с движком mysql
+### Пример использования именованных соединений таблицей с движком mysql
 
 ```sql
 CREATE TABLE mytable(A Int64) ENGINE = MySQL(mymysql, table = 'test', connection_pool_size=3, replace_query=0);
@@ -115,7 +115,20 @@ SELECT count() FROM mytable;
 └─────────┘
 ```
 
-### Пример использования именованных с внешним словарем с источником mysql
+### Пример использования именованных соединений базой данных с движком MySQL
+
+```sql
+CREATE DATABASE mydatabase ENGINE = MySQL(mymysql);
+
+SHOW TABLES FROM mydatabase;
+
+┌─name───┐
+│ source │
+│ test   │
+└────────┘
+```
+
+### Пример использования именованных соединений с внешним словарем с источником mysql
 
 ```sql
 CREATE DICTIONARY dict (A Int64, B String)
@@ -130,3 +143,86 @@ SELECT dictGet('dict', 'B', 2);
 │ two                     │
 └─────────────────────────┘
 ```
+
+## Пример использования именованных соединений с базой данных PostgreSQL
+
+Описание параметров смотри [postgresql](../sql-reference/table-functions/postgresql.md).
+
+Пример конфигурации:
+```xml
+<clickhouse>
+    <named_collections>
+        <mypg>
+            <user>pguser</user>
+            <password>jw8s0F4</password>
+            <host>127.0.0.1</host>
+            <port>5432</port>
+            <database>test</database>
+            <schema>test_schema</schema>
+            <connection_pool_size>8</connection_pool_size>
+        </mypg>
+    </named_collections>
+</clickhouse>
+```
+
+### Пример использования именованных соединений с табличной функцией postgresql
+
+```sql
+SELECT * FROM postgresql(mypg, table = 'test');
+
+┌─a─┬─b───┐
+│ 2 │ two │
+│ 1 │ one │
+└───┴─────┘
+
+
+SELECT * FROM postgresql(mypg, table = 'test', schema = 'public');
+
+┌─a─┐
+│ 1 │
+│ 2 │
+│ 3 │
+└───┘
+```
+
+### Пример использования именованных соединений таблицей с движком PostgreSQL
+
+```sql
+CREATE TABLE mypgtable (a Int64) ENGINE = PostgreSQL(mypg, table = 'test', schema = 'public');
+
+SELECT * FROM mypgtable;
+
+┌─a─┐
+│ 1 │
+│ 2 │
+│ 3 │
+└───┘
+```
+
+### Пример использования именованных соединений базой данных с движком PostgreSQL
+
+```sql
+CREATE DATABASE mydatabase ENGINE = PostgreSQL(mypg);
+
+SHOW TABLES FROM mydatabase
+
+┌─name─┐
+│ test │
+└──────┘
+```
+
+### Пример использования именованных соединений с внешним словарем с источником POSTGRESQL
+
+```sql
+CREATE DICTIONARY dict (a Int64, b String)
+PRIMARY KEY a
+SOURCE(POSTGRESQL(NAME mypg TABLE test))
+LIFETIME(MIN 1 MAX 2)
+LAYOUT(HASHED());
+
+SELECT dictGet('dict', 'b', 2);
+
+┌─dictGet('dict', 'b', 2)─┐
+│ two                     │
+└─────────────────────────┘
+```

programs/local/LocalServer.cpp

@@ -15,6 +15,7 @@
 #include <base/scope_guard_safe.h>
 #include <Interpreters/UserDefinedSQLObjectsLoader.h>
 #include <Interpreters/Session.h>
+#include <Access/AccessControl.h>
 #include <Common/Exception.h>
 #include <Common/Macros.h>
 #include <Common/Config/ConfigProcessor.h>
@@ -388,7 +389,9 @@ void LocalServer::setupUsers()
         "</clickhouse>";
 
     ConfigurationPtr users_config;
-
+    auto & access_control = global_context->getAccessControl();
+    access_control.setPlaintextPasswordSetting(config().getBool("allow_plaintext_password", true));
+    access_control.setNoPasswordSetting(config().getBool("allow_no_password", true));
     if (config().has("users_config") || config().has("config-file") || fs::exists("config.xml"))
     {
         const auto users_config_path = config().getString("users_config", config().getString("config-file", "config.xml"));
@@ -397,10 +400,7 @@ void LocalServer::setupUsers()
         users_config = loaded_config.configuration;
     }
     else
-    {
         users_config = getConfigurationFromXMLString(minimal_default_user_xml);
-    }
-
     if (users_config)
         global_context->setUsersConfig(users_config);
     else
@@ -802,7 +802,6 @@ void LocalServer::processOptions(const OptionsDescription &, const CommandLineOp
 
 }
 
-
 #pragma GCC diagnostic ignored "-Wunused-function"
 #pragma GCC diagnostic ignored "-Wmissing-declarations"
 

programs/server/Server.cpp

@@ -1069,7 +1069,9 @@ if (ThreadFuzzer::instance().isEffective())
     auto & access_control = global_context->getAccessControl();
     if (config().has("custom_settings_prefixes"))
         access_control.setCustomSettingsPrefixes(config().getString("custom_settings_prefixes"));
-
+    ///set the allow_plaintext_and_no_password setting in context.
+    access_control.setPlaintextPasswordSetting(config().getBool("allow_plaintext_password", true));
+    access_control.setNoPasswordSetting(config().getBool("allow_no_password", true));
     /// Initialize access storages.
     try
     {

programs/server/config.xml

@@ -243,7 +243,7 @@
                   openssl dhparam -out /etc/clickhouse-server/dhparam.pem 4096
                  Only file format with BEGIN DH PARAMETERS is supported.
               -->
-            <!-- <dhParamsFile>/etc/clickhouse-server/dhparam.pem</dhParamsFile> -->
+	    <!-- <dhParamsFile>/etc/clickhouse-server/dhparam.pem</dhParamsFile>-->
             <verificationMode>none</verificationMode>
             <loadDefaultCAFile>true</loadDefaultCAFile>
             <cacheSessions>true</cacheSessions>
@@ -368,6 +368,10 @@
     <!-- Path to temporary data for processing hard queries. -->
     <tmp_path>/var/lib/clickhouse/tmp/</tmp_path>
     
+    <!-- Disable AuthType Plaintext_password and No_password for ACL. --> 
+    <!-- <allow_plaintext_password>0</allow_plaintext_password> -->
+    <!-- <allow_no_password>0</allow_no_password> -->`
+
     <!-- Policy from the <storage_configuration> for the temporary files.
          If not set <tmp_path> is used, otherwise <tmp_path> is ignored.
 

src/Access/AccessControl.cpp

@@ -171,7 +171,9 @@ void AccessControl::addUsersConfigStorage(const Poco::Util::AbstractConfiguratio
 void AccessControl::addUsersConfigStorage(const String & storage_name_, const Poco::Util::AbstractConfiguration & users_config_)
 {
     auto check_setting_name_function = [this](const std::string_view & setting_name) { checkSettingNameIsAllowed(setting_name); };
-    auto new_storage = std::make_shared<UsersConfigAccessStorage>(storage_name_, check_setting_name_function);
+    auto is_no_password_allowed_function = [this]() -> bool { return isNoPasswordAllowed(); };
+    auto is_plaintext_password_allowed_function = [this]() -> bool { return isPlaintextPasswordAllowed(); };
+    auto new_storage = std::make_shared<UsersConfigAccessStorage>(storage_name_, check_setting_name_function,is_no_password_allowed_function,is_plaintext_password_allowed_function);
     new_storage->setConfig(users_config_);
     addStorage(new_storage);
     LOG_DEBUG(getLogger(), "Added {} access storage '{}', path: {}",
@@ -205,7 +207,9 @@ void AccessControl::addUsersConfigStorage(
         }
     }
     auto check_setting_name_function = [this](const std::string_view & setting_name) { checkSettingNameIsAllowed(setting_name); };
-    auto new_storage = std::make_shared<UsersConfigAccessStorage>(storage_name_, check_setting_name_function);
+    auto is_no_password_allowed_function = [this]() -> bool { return isNoPasswordAllowed(); };
+    auto is_plaintext_password_allowed_function = [this]() -> bool { return isPlaintextPasswordAllowed(); };
+    auto new_storage = std::make_shared<UsersConfigAccessStorage>(storage_name_, check_setting_name_function,is_no_password_allowed_function,is_plaintext_password_allowed_function);
     new_storage->load(users_config_path_, include_from_path_, preprocessed_dir_, get_zookeeper_function_);
     addStorage(new_storage);
     LOG_DEBUG(getLogger(), "Added {} access storage '{}', path: {}", String(new_storage->getStorageType()), new_storage->getStorageName(), new_storage->getPath());
@@ -407,7 +411,7 @@ UUID AccessControl::authenticate(const Credentials & credentials, const Poco::Ne
 {
     try
     {
-        return MultipleAccessStorage::authenticate(credentials, address, *external_authenticators);
+        return MultipleAccessStorage::authenticate(credentials, address, *external_authenticators,allow_no_password, allow_plaintext_password);
     }
     catch (...)
     {
@@ -443,6 +447,15 @@ void AccessControl::setCustomSettingsPrefixes(const String & comma_separated_pre
     setCustomSettingsPrefixes(prefixes);
 }
 
+void AccessControl::setPlaintextPasswordSetting(bool allow_plaintext_password_)
+{
+    allow_plaintext_password = allow_plaintext_password_;
+}
+void AccessControl::setNoPasswordSetting(bool allow_no_password_)
+{
+    allow_no_password = allow_no_password_;
+}
+
 bool AccessControl::isSettingNameAllowed(const std::string_view & setting_name) const
 {
     return custom_settings_prefixes->isSettingNameAllowed(setting_name);
@@ -537,6 +550,15 @@ std::vector<QuotaUsage> AccessControl::getAllQuotasUsage() const
     return quota_cache->getAllQuotasUsage();
 }
 
+bool AccessControl::isPlaintextPasswordAllowed() const
+{
+    return allow_plaintext_password;
+}
+
+bool AccessControl::isNoPasswordAllowed() const
+{
+    return allow_no_password;
+}
 
 std::shared_ptr<const EnabledSettings> AccessControl::getEnabledSettings(
     const UUID & user_id,

src/Access/AccessControl.h

@@ -4,6 +4,8 @@
 #include <Common/SettingsChanges.h>
 #include <Common/ZooKeeper/Common.h>
 #include <boost/container/flat_set.hpp>
+#include <Access/UsersConfigAccessStorage.h>
+
 #include <memory>
 
 
@@ -47,6 +49,8 @@ class AccessControl : public MultipleAccessStorage
 public:
     AccessControl();
     ~AccessControl() override;
+    std::atomic_bool allow_plaintext_password;
+    std::atomic_bool allow_no_password;
 
     /// Parses access entities from a configuration loaded from users.xml.
     /// This function add UsersConfigAccessStorage if it wasn't added before.
@@ -72,7 +76,6 @@ public:
     void reloadUsersConfigs();
     void startPeriodicReloadingUsersConfigs();
     void stopPeriodicReloadingUsersConfigs();
-
     /// Loads access entities from the directory on the local disk.
     /// Use that directory to keep created users/roles/etc.
     void addDiskStorage(const String & directory_, bool readonly_ = false);
@@ -113,6 +116,10 @@ public:
     bool isSettingNameAllowed(const std::string_view & name) const;
     void checkSettingNameIsAllowed(const std::string_view & name) const;
 
+    //sets allow_plaintext_password and allow_no_password setting
+    void setPlaintextPasswordSetting(const bool allow_plaintext_password_);
+    void setNoPasswordSetting(const bool allow_no_password_);
+
     UUID authenticate(const Credentials & credentials, const Poco::Net::IPAddress & address) const;
     void setExternalAuthenticatorsConfig(const Poco::Util::AbstractConfiguration & config);
 
@@ -146,6 +153,9 @@ public:
 
     std::vector<QuotaUsage> getAllQuotasUsage() const;
 
+    bool isPlaintextPasswordAllowed() const;
+    bool isNoPasswordAllowed() const;
+
     std::shared_ptr<const EnabledSettings> getEnabledSettings(
         const UUID & user_id,
         const SettingsProfileElements & settings_from_user,

src/Access/AccessRights.h

@@ -15,7 +15,7 @@ class AccessRights
 {
 public:
     AccessRights();
-    AccessRights(const AccessFlags & access);
+    explicit AccessRights(const AccessFlags & access);
     ~AccessRights();
     AccessRights(const AccessRights & src);
     AccessRights & operator =(const AccessRights & src);

src/Access/Common/AccessFlags.h

@@ -15,17 +15,17 @@ using Strings = std::vector<String>;
 class AccessFlags
 {
 public:
-    AccessFlags(AccessType type);
+    AccessFlags(AccessType type); /// NOLINT
 
     /// The same as AccessFlags(AccessType::NONE).
     AccessFlags() = default;
 
     /// Constructs from a string like "SELECT".
-    AccessFlags(const std::string_view & keyword);
+    AccessFlags(const std::string_view & keyword); /// NOLINT
 
     /// Constructs from a list of strings like "SELECT, UPDATE, INSERT".
-    AccessFlags(const std::vector<std::string_view> & keywords);
+    AccessFlags(const std::vector<std::string_view> & keywords); /// NOLINT
-    AccessFlags(const Strings & keywords);
+    AccessFlags(const Strings & keywords); /// NOLINT
 
     AccessFlags(const AccessFlags & src) = default;
     AccessFlags(AccessFlags && src) = default;
@@ -109,7 +109,7 @@ private:
     using Flags = std::bitset<SIZE>;
     Flags flags;
 
-    AccessFlags(const Flags & flags_) : flags(flags_) {}
+    AccessFlags(const Flags & flags_) : flags(flags_) {} /// NOLINT
 };
 
 AccessFlags operator |(AccessType left, AccessType right);

src/Access/Common/AccessRightsElement.h

@@ -26,7 +26,7 @@ struct AccessRightsElement
     AccessRightsElement(AccessRightsElement &&) = default;
     AccessRightsElement & operator=(AccessRightsElement &&) = default;
 
-    AccessRightsElement(AccessFlags access_flags_) : access_flags(access_flags_) {}
+    explicit AccessRightsElement(AccessFlags access_flags_) : access_flags(access_flags_) {}
 
     AccessRightsElement(AccessFlags access_flags_, const std::string_view & database_);
     AccessRightsElement(AccessFlags access_flags_, const std::string_view & database_, const std::string_view & table_);

src/Access/Common/AllowedClientHosts.h

@@ -18,7 +18,7 @@ public:
     class IPSubnet
     {
     public:
-        IPSubnet() {}
+        IPSubnet() = default;
         IPSubnet(const IPAddress & prefix_, const IPAddress & mask_) { set(prefix_, mask_); }
         IPSubnet(const IPAddress & prefix_, size_t num_prefix_bits) { set(prefix_, num_prefix_bits); }
         explicit IPSubnet(const IPAddress & address) { set(address); }
@@ -43,9 +43,9 @@ public:
 
     struct AnyHostTag {};
 
-    AllowedClientHosts() {}
+    AllowedClientHosts() = default;
-    AllowedClientHosts(AnyHostTag) { addAnyHost(); }
+    AllowedClientHosts(AnyHostTag) { addAnyHost(); } /// NOLINT
-    ~AllowedClientHosts() {}
+    ~AllowedClientHosts() = default;
 
     AllowedClientHosts(const AllowedClientHosts & src) = default;
     AllowedClientHosts & operator =(const AllowedClientHosts & src) = default;

src/Access/Common/AuthenticationData.h

@@ -54,7 +54,7 @@ class AuthenticationData
 public:
     using Digest = std::vector<uint8_t>;
 
-    AuthenticationData(AuthenticationType type_ = AuthenticationType::NO_PASSWORD) : type(type_) {}
+    explicit AuthenticationData(AuthenticationType type_ = AuthenticationType::NO_PASSWORD) : type(type_) {}
     AuthenticationData(const AuthenticationData & src) = default;
     AuthenticationData & operator =(const AuthenticationData & src) = default;
     AuthenticationData(AuthenticationData && src) = default;

src/Access/ContextAccess.h

@@ -158,7 +158,7 @@ public:
 
 private:
     friend class AccessControl;
-    ContextAccess() {}
+    ContextAccess() {} /// NOLINT
     ContextAccess(const AccessControl & access_control_, const Params & params_);
 
     void initialize();

src/Access/Credentials.h

@@ -21,7 +21,6 @@ public:
 protected:
     [[noreturn]] static void throwNotReady();
 
-protected:
     bool is_ready = false;
     String user_name;
 };

src/Access/EnabledQuota.h

@@ -60,8 +60,8 @@ public:
 
 private:
     friend class QuotaCache;
-    EnabledQuota(const Params & params_);
+    explicit EnabledQuota(const Params & params_);
-    EnabledQuota() {}
+    EnabledQuota() {} /// NOLINT
 
     const String & getUserName() const { return params.user_name; }
 

src/Access/EnabledRoles.h

@@ -41,7 +41,7 @@ public:
 
 private:
     friend class RoleCache;
-    EnabledRoles(const Params & params_);
+    explicit EnabledRoles(const Params & params_);
 
     void setRolesInfo(const std::shared_ptr<const EnabledRolesInfo> & info_, scope_guard & notifications);
 

src/Access/EnabledRowPolicies.h

@@ -44,7 +44,7 @@ public:
 
 private:
     friend class RowPolicyCache;
-    EnabledRowPolicies(const Params & params_);
+    explicit EnabledRowPolicies(const Params & params_);
 
     struct MixedFiltersKey
     {

src/Access/EnabledSettings.h

@@ -38,7 +38,7 @@ public:
 
 private:
     friend class SettingsProfilesCache;
-    EnabledSettings(const Params & params_);
+    explicit EnabledSettings(const Params & params_);
     void setInfo(const std::shared_ptr<const SettingsProfilesInfo> & info_);
 
     const Params params;

src/Access/ExternalAuthenticators.h

@@ -51,7 +51,6 @@ private:
     using LDAPCaches = std::map<String, LDAPCache>;               // server name -> cache
     using LDAPParams = std::map<String, LDAPClient::Params>;      // server name -> params
 
-private:
     mutable std::recursive_mutex mutex;
     LDAPParams ldap_client_params_blueprint;
     mutable LDAPCaches ldap_caches;

src/Access/GSSAcceptor.h

@@ -47,7 +47,6 @@ private:
     void resetHandles() noexcept;
     void initHandles();
 
-private:
     const Params params;
 
     bool is_failed = false;

src/Access/IAccessStorage.cpp

@@ -23,6 +23,7 @@ namespace ErrorCodes
     extern const int IP_ADDRESS_NOT_ALLOWED;
     extern const int LOGICAL_ERROR;
     extern const int NOT_IMPLEMENTED;
+    extern const int AUTHENTICATION_FAILED;
 }
 
 
@@ -440,9 +441,9 @@ void IAccessStorage::notify(const Notifications & notifications)
 UUID IAccessStorage::authenticate(
     const Credentials & credentials,
     const Poco::Net::IPAddress & address,
-    const ExternalAuthenticators & external_authenticators) const
+    const ExternalAuthenticators & external_authenticators, bool allow_no_password, bool allow_plaintext_password) const
 {
-    return *authenticateImpl(credentials, address, external_authenticators, /* throw_if_user_not_exists = */ true);
+    return *authenticateImpl(credentials, address, external_authenticators, /* throw_if_user_not_exists = */ true, allow_no_password, allow_plaintext_password);
 }
 
 
@@ -450,9 +451,9 @@ std::optional<UUID> IAccessStorage::authenticate(
     const Credentials & credentials,
     const Poco::Net::IPAddress & address,
     const ExternalAuthenticators & external_authenticators,
-    bool throw_if_user_not_exists) const
+    bool throw_if_user_not_exists, bool allow_no_password, bool allow_plaintext_password) const
 {
-    return authenticateImpl(credentials, address, external_authenticators, throw_if_user_not_exists);
+    return authenticateImpl(credentials, address, external_authenticators, throw_if_user_not_exists, allow_no_password, allow_plaintext_password);
 }
 
 
@@ -460,7 +461,7 @@ std::optional<UUID> IAccessStorage::authenticateImpl(
     const Credentials & credentials,
     const Poco::Net::IPAddress & address,
     const ExternalAuthenticators & external_authenticators,
-    bool throw_if_user_not_exists) const
+    bool throw_if_user_not_exists, bool allow_no_password, bool allow_plaintext_password) const
 {
     if (auto id = find<User>(credentials.getUserName()))
     {
@@ -468,6 +469,8 @@ std::optional<UUID> IAccessStorage::authenticateImpl(
         {
             if (!isAddressAllowed(*user, address))
                 throwAddressNotAllowed(address);
+            if (isNoPasswordAllowed(*user, allow_no_password) || isPlaintextPasswordAllowed(*user, allow_plaintext_password))
+                throwPasswordTypeNotAllowed();
 
             if (!areCredentialsValid(*user, credentials, external_authenticators))
                 throwInvalidCredentials();
@@ -503,6 +506,15 @@ bool IAccessStorage::isAddressAllowed(const User & user, const Poco::Net::IPAddr
     return user.allowed_client_hosts.contains(address);
 }
 
+bool IAccessStorage::isPlaintextPasswordAllowed(const User & user, bool allow_plaintext_password)
+{
+    return !allow_plaintext_password && user.auth_data.getType() == AuthenticationType::PLAINTEXT_PASSWORD;
+}
+
+bool IAccessStorage::isNoPasswordAllowed(const User & user, bool allow_no_password)
+{
+    return !allow_no_password && user.auth_data.getType() == AuthenticationType::NO_PASSWORD;
+}
 
 UUID IAccessStorage::generateRandomID()
 {
@@ -598,6 +610,12 @@ void IAccessStorage::throwAddressNotAllowed(const Poco::Net::IPAddress & address
     throw Exception("Connections from " + address.toString() + " are not allowed", ErrorCodes::IP_ADDRESS_NOT_ALLOWED);
 }
 
+void IAccessStorage::throwPasswordTypeNotAllowed()
+{
+    throw Exception(
+        "Authentication denied for users configured with AuthType PLAINTEXT_PASSWORD and NO_PASSWORD. Please check with Clickhouse admin to allow allow  PLAINTEXT_PASSWORD and NO_PASSWORD through server configuration ",
+        ErrorCodes::AUTHENTICATION_FAILED);
+}
 void IAccessStorage::throwInvalidCredentials()
 {
     throw Exception("Invalid credentials", ErrorCodes::WRONG_PASSWORD);

src/Access/IAccessStorage.h

@@ -24,8 +24,8 @@ class ExternalAuthenticators;
 class IAccessStorage
 {
 public:
-    IAccessStorage(const String & storage_name_) : storage_name(storage_name_) {}
+    explicit IAccessStorage(const String & storage_name_) : storage_name(storage_name_) {}
-    virtual ~IAccessStorage() {}
+    virtual ~IAccessStorage() = default;
 
     /// Returns the name of this storage.
     const String & getStorageName() const { return storage_name; }
@@ -148,8 +148,8 @@ public:
 
     /// Finds a user, check the provided credentials and returns the ID of the user if they are valid.
     /// Throws an exception if no such user or credentials are invalid.
-    UUID authenticate(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators) const;
+    UUID authenticate(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool allow_no_password=true, bool allow_plaintext_password=true) const;
-    std::optional<UUID> authenticate(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists) const;
+    std::optional<UUID> authenticate(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists, bool allow_no_password, bool allow_plaintext_password) const;
 
 protected:
     virtual std::optional<UUID> findImpl(AccessEntityType type, const String & name) const = 0;
@@ -161,10 +161,11 @@ protected:
     virtual bool updateImpl(const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists);
     virtual scope_guard subscribeForChangesImpl(const UUID & id, const OnChangedHandler & handler) const = 0;
     virtual scope_guard subscribeForChangesImpl(AccessEntityType type, const OnChangedHandler & handler) const = 0;
-    virtual std::optional<UUID> authenticateImpl(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists) const;
+    virtual std::optional<UUID> authenticateImpl(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists, bool allow_no_password, bool allow_plaintext_password) const;
     virtual bool areCredentialsValid(const User & user, const Credentials & credentials, const ExternalAuthenticators & external_authenticators) const;
     virtual bool isAddressAllowed(const User & user, const Poco::Net::IPAddress & address) const;
-
+    static bool isPlaintextPasswordAllowed(const User & user, bool allow_plaintext_password) ;
+    static bool isNoPasswordAllowed(const User & user, bool allow_no_password);
     static UUID generateRandomID();
     Poco::Logger * getLogger() const;
     static String formatEntityTypeWithName(AccessEntityType type, const String & name) { return AccessEntityTypeInfo::get(type).formatEntityNameWithType(name); }
@@ -172,7 +173,7 @@ protected:
     [[noreturn]] void throwNotFound(AccessEntityType type, const String & name) const;
     [[noreturn]] static void throwBadCast(const UUID & id, AccessEntityType type, const String & name, AccessEntityType required_type);
     [[noreturn]] void throwIDCollisionCannotInsert(
-        const UUID & id, AccessEntityType type, const String & name, AccessEntityType existing_type, const String & existing_name) const;
+    const UUID & id, AccessEntityType type, const String & name, AccessEntityType existing_type, const String & existing_name) const;
     [[noreturn]] void throwNameCollisionCannotInsert(AccessEntityType type, const String & name) const;
     [[noreturn]] void throwNameCollisionCannotRename(AccessEntityType type, const String & old_name, const String & new_name) const;
     [[noreturn]] void throwReadonlyCannotInsert(AccessEntityType type, const String & name) const;
@@ -180,7 +181,7 @@ protected:
     [[noreturn]] void throwReadonlyCannotRemove(AccessEntityType type, const String & name) const;
     [[noreturn]] static void throwAddressNotAllowed(const Poco::Net::IPAddress & address);
     [[noreturn]] static void throwInvalidCredentials();
-
+    [[noreturn]] static void throwPasswordTypeNotAllowed();
     using Notification = std::tuple<OnChangedHandler, UUID, AccessEntityPtr>;
     using Notifications = std::vector<Notification>;
     static void notify(const Notifications & notifications);

src/Access/LDAPAccessStorage.cpp

@@ -481,7 +481,7 @@ std::optional<UUID> LDAPAccessStorage::authenticateImpl(
     const Credentials & credentials,
     const Poco::Net::IPAddress & address,
     const ExternalAuthenticators & external_authenticators,
-    bool throw_if_user_not_exists) const
+    bool throw_if_user_not_exists,bool allow_no_password __attribute__((unused)), bool allow_plaintext_password __attribute__((unused))) const
 {
     std::scoped_lock lock(mutex);
     auto id = memory_storage.find<User>(credentials.getUserName());

src/Access/LDAPAccessStorage.h

@@ -37,7 +37,7 @@ public:
 
     String getLDAPServerName() const;
 
-public: // IAccessStorage implementations.
+    // IAccessStorage implementations.
     virtual const char * getStorageType() const override;
     virtual String getStorageParamsJSON() const override;
     virtual bool isReadOnly() const override { return true; }
@@ -52,9 +52,8 @@ private: // IAccessStorage implementations.
     virtual std::optional<String> readNameImpl(const UUID & id, bool throw_if_not_exists) const override;
     virtual scope_guard subscribeForChangesImpl(const UUID & id, const OnChangedHandler & handler) const override;
     virtual scope_guard subscribeForChangesImpl(AccessEntityType type, const OnChangedHandler & handler) const override;
-    virtual std::optional<UUID> authenticateImpl(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists) const override;
+    virtual std::optional<UUID> authenticateImpl(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists, bool allow_no_password, bool allow_plaintext_password) const override;
 
-private:
     void setConfiguration(AccessControl * access_control_, const Poco::Util::AbstractConfiguration & config, const String & prefix);
     void processRoleChange(const UUID & id, const AccessEntityPtr & entity);
 

src/Access/LDAPClient.cpp

@@ -153,7 +153,7 @@ namespace
 
 }
 
-void LDAPClient::diag(const int rc, String text)
+void LDAPClient::diag(int rc, String text)
 {
     std::scoped_lock lock(ldap_global_mutex);
 

src/Access/LDAPClient.h

@@ -133,12 +133,11 @@ public:
     LDAPClient & operator= (LDAPClient &&) = delete;
 
 protected:
-    MAYBE_NORETURN void diag(const int rc, String text = "");
+    MAYBE_NORETURN void diag(int rc, String text = "");
     MAYBE_NORETURN bool openConnection();
     void closeConnection() noexcept;
     SearchResults search(const SearchParams & search_params);
 
-protected:
     const Params params;
 #if USE_LDAP
     LDAP * handle = nullptr;

src/Access/MemoryAccessStorage.h

@@ -15,7 +15,7 @@ class MemoryAccessStorage : public IAccessStorage
 public:
     static constexpr char STORAGE_TYPE[] = "memory";
 
-    MemoryAccessStorage(const String & storage_name_ = STORAGE_TYPE);
+    explicit MemoryAccessStorage(const String & storage_name_ = STORAGE_TYPE);
 
     const char * getStorageType() const override { return STORAGE_TYPE; }
 

src/Access/MultipleAccessStorage.cpp

@@ -449,14 +449,14 @@ void MultipleAccessStorage::updateSubscriptionsToNestedStorages(std::unique_lock
 }
 
 
-std::optional<UUID> MultipleAccessStorage::authenticateImpl(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists) const
+std::optional<UUID> MultipleAccessStorage::authenticateImpl(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists,bool allow_no_password, bool allow_plaintext_password) const
 {
     auto storages = getStoragesInternal();
     for (size_t i = 0; i != storages->size(); ++i)
     {
         const auto & storage = (*storages)[i];
         bool is_last_storage = (i == storages->size() - 1);
-        auto id = storage->authenticate(credentials, address, external_authenticators, throw_if_user_not_exists && is_last_storage);
+        auto id = storage->authenticate(credentials, address, external_authenticators, (throw_if_user_not_exists && is_last_storage), allow_no_password, allow_plaintext_password);
         if (id)
         {
             std::lock_guard lock{mutex};

src/Access/MultipleAccessStorage.h

@@ -17,7 +17,7 @@ public:
     using StoragePtr = std::shared_ptr<Storage>;
     using ConstStoragePtr = std::shared_ptr<const Storage>;
 
-    MultipleAccessStorage(const String & storage_name_ = STORAGE_TYPE);
+    explicit MultipleAccessStorage(const String & storage_name_ = STORAGE_TYPE);
     ~MultipleAccessStorage() override;
 
     const char * getStorageType() const override { return STORAGE_TYPE; }
@@ -50,7 +50,7 @@ protected:
     bool updateImpl(const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists) override;
     scope_guard subscribeForChangesImpl(const UUID & id, const OnChangedHandler & handler) const override;
     scope_guard subscribeForChangesImpl(AccessEntityType type, const OnChangedHandler & handler) const override;
-    std::optional<UUID> authenticateImpl(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists) const override;
+    std::optional<UUID> authenticateImpl(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists, bool allow_no_password, bool allow_plaintext_password) const override;
 
 private:
     using Storages = std::vector<StoragePtr>;

src/Access/QuotaCache.h

@@ -19,7 +19,7 @@ struct RolesOrUsersSet;
 class QuotaCache
 {
 public:
-    QuotaCache(const AccessControl & access_control_);
+    explicit QuotaCache(const AccessControl & access_control_);
     ~QuotaCache();
 
     std::shared_ptr<const EnabledQuota> getEnabledQuota(

src/Access/RoleCache.h

@@ -16,7 +16,7 @@ using RolePtr = std::shared_ptr<const Role>;
 class RoleCache
 {
 public:
-    RoleCache(const AccessControl & access_control_);
+    explicit RoleCache(const AccessControl & access_control_);
     ~RoleCache();
 
     std::shared_ptr<const EnabledRoles> getEnabledRoles(

src/Access/RolesOrUsersSet.h

@@ -26,13 +26,13 @@ struct RolesOrUsersSet
     RolesOrUsersSet & operator =(RolesOrUsersSet && src) noexcept;
 
     struct AllTag {};
-    RolesOrUsersSet(AllTag);
+    RolesOrUsersSet(AllTag); /// NOLINT
 
-    RolesOrUsersSet(const UUID & id);
+    RolesOrUsersSet(const UUID & id); /// NOLINT
-    RolesOrUsersSet(const std::vector<UUID> & ids_);
+    RolesOrUsersSet(const std::vector<UUID> & ids_); /// NOLINT
 
     /// The constructor from AST requires the AccessControl if `ast.id_mode == false`.
-    RolesOrUsersSet(const ASTRolesOrUsersSet & ast);
+    RolesOrUsersSet(const ASTRolesOrUsersSet & ast); /// NOLINT
     RolesOrUsersSet(const ASTRolesOrUsersSet & ast, const std::optional<UUID> & current_user_id);
     RolesOrUsersSet(const ASTRolesOrUsersSet & ast, const AccessControl & access_control);
     RolesOrUsersSet(const ASTRolesOrUsersSet & ast, const AccessControl & access_control, const std::optional<UUID> & current_user_id);

src/Access/RowPolicyCache.h

@@ -18,7 +18,7 @@ using RowPolicyPtr = std::shared_ptr<const RowPolicy>;
 class RowPolicyCache
 {
 public:
-    RowPolicyCache(const AccessControl & access_control_);
+    explicit RowPolicyCache(const AccessControl & access_control_);
     ~RowPolicyCache();
 
     std::shared_ptr<const EnabledRowPolicies> getEnabledRowPolicies(const UUID & user_id, const boost::container::flat_set<UUID> & enabled_roles);
@@ -26,7 +26,7 @@ public:
 private:
     struct PolicyInfo
     {
-        PolicyInfo(const RowPolicyPtr & policy_) { setPolicy(policy_); }
+        explicit PolicyInfo(const RowPolicyPtr & policy_) { setPolicy(policy_); }
         void setPolicy(const RowPolicyPtr & policy_);
 
         RowPolicyPtr policy;

src/Access/SettingsConstraints.h

@@ -51,7 +51,7 @@ class AccessControl;
 class SettingsConstraints
 {
 public:
-    SettingsConstraints(const AccessControl & access_control_);
+    explicit SettingsConstraints(const AccessControl & access_control_);
     SettingsConstraints(const SettingsConstraints & src);
     SettingsConstraints & operator=(const SettingsConstraints & src);
     SettingsConstraints(SettingsConstraints && src) noexcept;

src/Access/SettingsConstraintsAndProfileIDs.h

@@ -15,7 +15,7 @@ struct SettingsConstraintsAndProfileIDs
     std::vector<UUID> current_profiles;
     std::vector<UUID> enabled_profiles;
 
-    SettingsConstraintsAndProfileIDs(const AccessControl & access_control_) : constraints(access_control_) {}
+    explicit SettingsConstraintsAndProfileIDs(const AccessControl & access_control_) : constraints(access_control_) {}
 };
 
 }

src/Access/SettingsProfileElement.h

@@ -33,10 +33,10 @@ struct SettingsProfileElement
     friend bool operator <=(const SettingsProfileElement & lhs, const SettingsProfileElement & rhs) { return !(rhs < lhs); }
     friend bool operator >=(const SettingsProfileElement & lhs, const SettingsProfileElement & rhs) { return !(lhs < rhs); }
 
-    SettingsProfileElement() {}
+    SettingsProfileElement() = default;
 
     /// The constructor from AST requires the AccessControl if `ast.id_mode == false`.
-    SettingsProfileElement(const ASTSettingsProfileElement & ast);
+    SettingsProfileElement(const ASTSettingsProfileElement & ast); /// NOLINT
     SettingsProfileElement(const ASTSettingsProfileElement & ast, const AccessControl & access_control);
     std::shared_ptr<ASTSettingsProfileElement> toAST() const;
     std::shared_ptr<ASTSettingsProfileElement> toASTWithNames(const AccessControl & access_control) const;
@@ -49,10 +49,10 @@ private:
 class SettingsProfileElements : public std::vector<SettingsProfileElement>
 {
 public:
-    SettingsProfileElements() {}
+    SettingsProfileElements() = default;
 
     /// The constructor from AST requires the AccessControl if `ast.id_mode == false`.
-    SettingsProfileElements(const ASTSettingsProfileElements & ast);
+    SettingsProfileElements(const ASTSettingsProfileElements & ast); /// NOLINT
     SettingsProfileElements(const ASTSettingsProfileElements & ast, const AccessControl & access_control);
     std::shared_ptr<ASTSettingsProfileElements> toAST() const;
     std::shared_ptr<ASTSettingsProfileElements> toASTWithNames(const AccessControl & access_control) const;

src/Access/SettingsProfilesCache.h

@@ -18,7 +18,7 @@ struct SettingsProfilesInfo;
 class SettingsProfilesCache
 {
 public:
-    SettingsProfilesCache(const AccessControl & access_control_);
+    explicit SettingsProfilesCache(const AccessControl & access_control_);
     ~SettingsProfilesCache();
 
     void setDefaultProfileName(const String & default_profile_name);

src/Access/SettingsProfilesInfo.h

@@ -29,7 +29,7 @@ struct SettingsProfilesInfo
     /// Names of all the profiles in `profiles`.
     std::unordered_map<UUID, String> names_of_profiles;
 
-    SettingsProfilesInfo(const AccessControl & access_control_) : constraints(access_control_), access_control(access_control_) {}
+    explicit SettingsProfilesInfo(const AccessControl & access_control_) : constraints(access_control_), access_control(access_control_) {}
     std::shared_ptr<const SettingsConstraintsAndProfileIDs> getConstraintsAndProfileIDs(
         const std::shared_ptr<const SettingsConstraintsAndProfileIDs> & previous = nullptr) const;
 

src/Access/UsersConfigAccessStorage.cpp

@@ -28,11 +28,13 @@ namespace ErrorCodes
     extern const int BAD_ARGUMENTS;
     extern const int UNKNOWN_ADDRESS_PATTERN_TYPE;
     extern const int NOT_IMPLEMENTED;
-}
+    extern const int ILLEGAL_TYPE_OF_ARGUMENT;
 
+}
 
 namespace
 {
+
     UUID generateID(AccessEntityType type, const String & name)
     {
         Poco::MD5Engine md5;
@@ -52,9 +54,7 @@ namespace
     {
         auto user = std::make_shared<User>();
         user->setName(user_name);
-
         String user_config = "users." + user_name;
-
         bool has_no_password = config.has(user_config + ".no_password");
         bool has_password_plaintext = config.has(user_config + ".password");
         bool has_password_sha256_hex = config.has(user_config + ".password_sha256_hex");
@@ -66,6 +66,7 @@ namespace
         bool has_certificates = config.has(certificates_config);
 
         size_t num_password_fields = has_no_password + has_password_plaintext + has_password_sha256_hex + has_password_double_sha1_hex + has_ldap + has_kerberos + has_certificates;
+
         if (num_password_fields > 1)
             throw Exception("More than one field of 'password', 'password_sha256_hex', 'password_double_sha1_hex', 'no_password', 'ldap', 'kerberos', 'certificates' are used to specify authentication info for user " + user_name + ". Must be only one of them.",
                 ErrorCodes::BAD_ARGUMENTS);
@@ -224,18 +225,23 @@ namespace
     }
 
 
-    std::vector<AccessEntityPtr> parseUsers(const Poco::Util::AbstractConfiguration & config)
+    std::vector<AccessEntityPtr> parseUsers(const Poco::Util::AbstractConfiguration & config, Fn<bool()> auto && is_no_password_allowed_function, Fn<bool()> auto && is_plaintext_password_allowed_function)
     {
         Poco::Util::AbstractConfiguration::Keys user_names;
         config.keys("users", user_names);
 
         std::vector<AccessEntityPtr> users;
         users.reserve(user_names.size());
-
+        bool allow_plaintext_password = is_plaintext_password_allowed_function();
+        bool allow_no_password = is_no_password_allowed_function();
         for (const auto & user_name : user_names)
         {
             try
             {
+                String user_config = "users." + user_name;
+                if ((config.has(user_config + ".password") && !allow_plaintext_password) || (config.has(user_config + ".no_password") && !allow_no_password))
+                    throw Exception("Incorrect User configuration. User is not allowed to configure PLAINTEXT_PASSWORD or NO_PASSWORD. Please configure User with authtype SHA256_PASSWORD_HASH, SHA256_PASSWORD, DOUBLE_SHA1_PASSWORD OR enable setting allow_plaintext_and_no_password in server configuration to configure user with plaintext and no password Auth_Type"
+                            " Though it is not recommended to use plaintext_password and No_password for user authentication.", ErrorCodes::ILLEGAL_TYPE_OF_ARGUMENT);
                 users.push_back(parseUser(config, user_name));
             }
             catch (Exception & e)
@@ -508,14 +514,13 @@ namespace
     }
 }
 
-
+UsersConfigAccessStorage::UsersConfigAccessStorage(const CheckSettingNameFunction & check_setting_name_function_, const IsNoPasswordFunction & is_no_password_allowed_function_, const IsPlaintextPasswordFunction & is_plaintext_password_allowed_function_)
-UsersConfigAccessStorage::UsersConfigAccessStorage(const CheckSettingNameFunction & check_setting_name_function_)
+    : UsersConfigAccessStorage(STORAGE_TYPE, check_setting_name_function_, is_no_password_allowed_function_, is_plaintext_password_allowed_function_)
-    : UsersConfigAccessStorage(STORAGE_TYPE, check_setting_name_function_)
 {
 }
 
-UsersConfigAccessStorage::UsersConfigAccessStorage(const String & storage_name_, const CheckSettingNameFunction & check_setting_name_function_)
+UsersConfigAccessStorage::UsersConfigAccessStorage(const String & storage_name_, const CheckSettingNameFunction & check_setting_name_function_, const IsNoPasswordFunction & is_no_password_allowed_function_, const IsPlaintextPasswordFunction & is_plaintext_password_allowed_function_)
-    : IAccessStorage(storage_name_), check_setting_name_function(check_setting_name_function_)
+    : IAccessStorage(storage_name_), check_setting_name_function(check_setting_name_function_),is_no_password_allowed_function(is_no_password_allowed_function_), is_plaintext_password_allowed_function(is_plaintext_password_allowed_function_)
 {
 }
 
@@ -534,7 +539,6 @@ String UsersConfigAccessStorage::getStorageParamsJSON() const
     return oss.str();
 }
 
-
 String UsersConfigAccessStorage::getPath() const
 {
     std::lock_guard lock{load_mutex};
@@ -546,7 +550,6 @@ bool UsersConfigAccessStorage::isPathEqual(const String & path_) const
     return getPath() == path_;
 }
 
-
 void UsersConfigAccessStorage::setConfig(const Poco::Util::AbstractConfiguration & config)
 {
     std::lock_guard lock{load_mutex};
@@ -560,7 +563,7 @@ void UsersConfigAccessStorage::parseFromConfig(const Poco::Util::AbstractConfigu
     try
     {
         std::vector<std::pair<UUID, AccessEntityPtr>> all_entities;
-        for (const auto & entity : parseUsers(config))
+        for (const auto & entity : parseUsers(config,is_no_password_allowed_function, is_plaintext_password_allowed_function))
             all_entities.emplace_back(generateID(*entity), entity);
         for (const auto & entity : parseQuotas(config))
             all_entities.emplace_back(generateID(*entity), entity);
@@ -595,6 +598,7 @@ void UsersConfigAccessStorage::load(
         [&](Poco::AutoPtr<Poco::Util::AbstractConfiguration> new_config, bool /*initial_loading*/)
         {
             parseFromConfig(*new_config);
+
             Settings::checkNoSettingNamesAtTopLevel(*new_config, users_config_path);
         },
         /* already_loaded = */ false);

src/Access/UsersConfigAccessStorage.h

@@ -18,11 +18,15 @@ class ConfigReloader;
 class UsersConfigAccessStorage : public IAccessStorage
 {
 public:
+
     static constexpr char STORAGE_TYPE[] = "users.xml";
     using CheckSettingNameFunction = std::function<void(const std::string_view &)>;
+    using IsNoPasswordFunction = std::function<bool()>;
+    using IsPlaintextPasswordFunction =  std::function<bool()>;
+
+    UsersConfigAccessStorage(const String & storage_name_ = STORAGE_TYPE, const CheckSettingNameFunction & check_setting_name_function_ = {}, const IsNoPasswordFunction & is_no_password_allowed_function_ ={}, const IsPlaintextPasswordFunction & is_plaintext_password_allowed_function_ = {}); /// NOLINT
+    UsersConfigAccessStorage(const CheckSettingNameFunction & check_setting_name_function_, const IsNoPasswordFunction & is_no_password_allowed_function_, const IsPlaintextPasswordFunction & is_plaintext_password_allowed_function_); /// NOLINT
 
-    UsersConfigAccessStorage(const String & storage_name_ = STORAGE_TYPE, const CheckSettingNameFunction & check_setting_name_function_ = {});
-    UsersConfigAccessStorage(const CheckSettingNameFunction & check_setting_name_function_);
     ~UsersConfigAccessStorage() override;
 
     const char * getStorageType() const override { return STORAGE_TYPE; }
@@ -33,7 +37,6 @@ public:
     bool isPathEqual(const String & path_) const;
 
     void setConfig(const Poco::Util::AbstractConfiguration & config);
-
     void load(const String & users_config_path,
               const String & include_from_path = {},
               const String & preprocessed_dir = {},
@@ -48,7 +51,6 @@ public:
 
 private:
     void parseFromConfig(const Poco::Util::AbstractConfiguration & config);
-
     std::optional<UUID> findImpl(AccessEntityType type, const String & name) const override;
     std::vector<UUID> findAllImpl(AccessEntityType type) const override;
     AccessEntityPtr readImpl(const UUID & id, bool throw_if_not_exists) const override;
@@ -58,7 +60,8 @@ private:
 
     MemoryAccessStorage memory_storage;
     CheckSettingNameFunction check_setting_name_function;
-
+    IsNoPasswordFunction is_no_password_allowed_function;
+    IsPlaintextPasswordFunction is_plaintext_password_allowed_function;
     String path;
     std::unique_ptr<ConfigReloader> config_reloader;
     mutable std::mutex load_mutex;

src/AggregateFunctions/AggregateFunctionBoundingRatio.h

@@ -97,7 +97,7 @@ private:
     /** Calculates the slope of a line between leftmost and rightmost data points.
       * (y2 - y1) / (x2 - x1)
       */
-    Float64 NO_SANITIZE_UNDEFINED getBoundingRatio(const AggregateFunctionBoundingRatioData & data) const
+    static Float64 NO_SANITIZE_UNDEFINED getBoundingRatio(const AggregateFunctionBoundingRatioData & data)
     {
         if (data.empty)
             return std::numeric_limits<Float64>::quiet_NaN();
@@ -111,11 +111,11 @@ public:
         return "boundingRatio";
     }
 
-    AggregateFunctionBoundingRatio(const DataTypes & arguments)
+    explicit AggregateFunctionBoundingRatio(const DataTypes & arguments)
         : IAggregateFunctionDataHelper<AggregateFunctionBoundingRatioData, AggregateFunctionBoundingRatio>(arguments, {})
     {
-        const auto x_arg = arguments.at(0).get();
+        const auto * x_arg = arguments.at(0).get();
-        const auto y_arg = arguments.at(1).get();
+        const auto * y_arg = arguments.at(1).get();
 
         if (!x_arg->isValueRepresentedByNumber() || !y_arg->isValueRepresentedByNumber())
             throw Exception("Illegal types of arguments of aggregate function " + getName() + ", must have number representation.",

src/AggregateFunctions/AggregateFunctionCategoricalInformationValue.h

@@ -63,12 +63,12 @@ public:
 
     void add(AggregateDataPtr place, const IColumn ** columns, size_t row_num, Arena *) const override
     {
-        auto y_col = static_cast<const ColumnUInt8 *>(columns[category_count]);
+        const auto * y_col = static_cast<const ColumnUInt8 *>(columns[category_count]);
         bool y = y_col->getData()[row_num];
 
         for (size_t i : collections::range(0, category_count))
         {
-            auto x_col = static_cast<const ColumnUInt8 *>(columns[i]);
+            const auto * x_col = static_cast<const ColumnUInt8 *>(columns[i]);
             bool x = x_col->getData()[row_num];
 
             if (x)
@@ -104,7 +104,7 @@ public:
         );
     }
 
-    void insertResultInto(AggregateDataPtr place, IColumn & to, Arena *) const override
+    void insertResultInto(AggregateDataPtr __restrict place, IColumn & to, Arena *) const override /// NOLINT
     {
         auto & col = static_cast<ColumnArray &>(to);
         auto & data_col = static_cast<ColumnFloat64 &>(col.getData());

src/AggregateFunctions/AggregateFunctionCount.h

@@ -37,7 +37,7 @@ namespace ErrorCodes
 class AggregateFunctionCount final : public IAggregateFunctionDataHelper<AggregateFunctionCountData, AggregateFunctionCount>
 {
 public:
-    AggregateFunctionCount(const DataTypes & argument_types_) : IAggregateFunctionDataHelper(argument_types_, {}) {}
+    explicit AggregateFunctionCount(const DataTypes & argument_types_) : IAggregateFunctionDataHelper(argument_types_, {}) {}
 
     String getName() const override { return "count"; }
 
@@ -107,7 +107,7 @@ public:
     }
 
     /// Reset the state to specified value. This function is not the part of common interface.
-    void set(AggregateDataPtr __restrict place, UInt64 new_count) const
+    static void set(AggregateDataPtr __restrict place, UInt64 new_count)
     {
         data(place).count = new_count;
     }
@@ -206,7 +206,7 @@ public:
     void addBatchSinglePlace(
         size_t batch_size, AggregateDataPtr place, const IColumn ** columns, Arena *, ssize_t if_argument_pos) const override
     {
-        auto & nc = assert_cast<const ColumnNullable &>(*columns[0]);
+        const auto & nc = assert_cast<const ColumnNullable &>(*columns[0]);
         if (if_argument_pos >= 0)
         {
             const auto & flags = assert_cast<const ColumnUInt8 &>(*columns[if_argument_pos]).getData();

src/AggregateFunctions/AggregateFunctionEntropy.h

@@ -91,7 +91,7 @@ private:
     size_t num_args;
 
 public:
-    AggregateFunctionEntropy(const DataTypes & argument_types_)
+    explicit AggregateFunctionEntropy(const DataTypes & argument_types_)
         : IAggregateFunctionDataHelper<EntropyData<Value>, AggregateFunctionEntropy<Value>>(argument_types_, {})
         , num_args(argument_types_.size())
     {

src/AggregateFunctions/AggregateFunctionFactory.h

@@ -39,7 +39,7 @@ struct AggregateFunctionWithProperties
     AggregateFunctionWithProperties & operator = (const AggregateFunctionWithProperties &) = default;
 
     template <typename Creator, std::enable_if_t<!std::is_same_v<Creator, AggregateFunctionWithProperties>> * = nullptr>
-    AggregateFunctionWithProperties(Creator creator_, AggregateFunctionProperties properties_ = {})
+    AggregateFunctionWithProperties(Creator creator_, AggregateFunctionProperties properties_ = {}) /// NOLINT
         : creator(std::forward<Creator>(creator_)), properties(std::move(properties_))
     {
     }

src/AggregateFunctions/AggregateFunctionGroupArray.h

@@ -144,7 +144,7 @@ public:
         }
     }
 
-    void create(AggregateDataPtr __restrict place) const override
+    void create(AggregateDataPtr __restrict place) const override /// NOLINT
     {
         [[maybe_unused]] auto a = new (place) Data;
         if constexpr (Trait::sampler == Sampler::RNG)
@@ -447,7 +447,7 @@ public:
         }
     }
 
-    void create(AggregateDataPtr __restrict place) const override
+    void create(AggregateDataPtr __restrict place) const override /// NOLINT
     {
         [[maybe_unused]] auto a = new (place) Data;
         if constexpr (Trait::sampler == Sampler::RNG)

src/AggregateFunctions/AggregateFunctionGroupArrayMoving.h

@@ -77,11 +77,11 @@ struct MovingAvgData : public MovingData<T>
 };
 
 
-template <typename T, typename Tlimit_num_elems, typename Data>
+template <typename T, typename LimitNumElements, typename Data>
 class MovingImpl final
-    : public IAggregateFunctionDataHelper<Data, MovingImpl<T, Tlimit_num_elems, Data>>
+    : public IAggregateFunctionDataHelper<Data, MovingImpl<T, LimitNumElements, Data>>
 {
-    static constexpr bool limit_num_elems = Tlimit_num_elems::value;
+    static constexpr bool limit_num_elems = LimitNumElements::value;
     UInt64 window_size;
 
 public:
@@ -93,7 +93,7 @@ public:
     using ColumnResult = ColumnVectorOrDecimal<ResultT>;
 
     explicit MovingImpl(const DataTypePtr & data_type_, UInt64 window_size_ = std::numeric_limits<UInt64>::max())
-        : IAggregateFunctionDataHelper<Data, MovingImpl<T, Tlimit_num_elems, Data>>({data_type_}, {})
+        : IAggregateFunctionDataHelper<Data, MovingImpl<T, LimitNumElements, Data>>({data_type_}, {})
         , window_size(window_size_) {}
 
     String getName() const override { return Data::name; }

src/AggregateFunctions/AggregateFunctionGroupBitmap.h

@@ -18,7 +18,7 @@ template <typename T, typename Data>
 class AggregateFunctionBitmap final : public IAggregateFunctionDataHelper<Data, AggregateFunctionBitmap<T, Data>>
 {
 public:
-    AggregateFunctionBitmap(const DataTypePtr & type)
+    explicit AggregateFunctionBitmap(const DataTypePtr & type)
         : IAggregateFunctionDataHelper<Data, AggregateFunctionBitmap<T, Data>>({type}, {})
     {
     }
@@ -55,9 +55,9 @@ template <typename T, typename Data, typename Policy>
 class AggregateFunctionBitmapL2 final : public IAggregateFunctionDataHelper<Data, AggregateFunctionBitmapL2<T, Data, Policy>>
 {
 private:
-    static constexpr auto STATE_VERSION_1_MIN_REVISION = 54455;
+    static constexpr size_t STATE_VERSION_1_MIN_REVISION = 54455;
 public:
-    AggregateFunctionBitmapL2(const DataTypePtr & type)
+    explicit AggregateFunctionBitmapL2(const DataTypePtr & type)
         : IAggregateFunctionDataHelper<Data, AggregateFunctionBitmapL2<T, Data, Policy>>({type}, {})
     {
     }

src/AggregateFunctions/AggregateFunctionGroupBitmapData.h

@@ -151,7 +151,7 @@ public:
     /**
      * Computes the intersection between two bitmaps
      */
-    void rb_and(const RoaringBitmapWithSmallSet & r1)
+    void rb_and(const RoaringBitmapWithSmallSet & r1) /// NOLINT
     {
         ValueBuffer buffer;
         if (isSmall() && r1.isSmall())
@@ -195,12 +195,12 @@ public:
     /**
      * Computes the union between two bitmaps.
      */
-    void rb_or(const RoaringBitmapWithSmallSet & r1) { merge(r1); }
+    void rb_or(const RoaringBitmapWithSmallSet & r1) { merge(r1); } /// NOLINT
 
     /**
      * Computes the symmetric difference (xor) between two bitmaps.
      */
-    void rb_xor(const RoaringBitmapWithSmallSet & r1)
+    void rb_xor(const RoaringBitmapWithSmallSet & r1) /// NOLINT
     {
         if (isSmall())
             toLarge();
@@ -212,7 +212,7 @@ public:
     /**
      * Computes the difference (andnot) between two bitmaps
      */
-    void rb_andnot(const RoaringBitmapWithSmallSet & r1)
+    void rb_andnot(const RoaringBitmapWithSmallSet & r1) /// NOLINT
     {
         ValueBuffer buffer;
         if (isSmall() && r1.isSmall())
@@ -256,7 +256,7 @@ public:
     /**
      * Computes the cardinality of the intersection between two bitmaps.
      */
-    UInt64 rb_and_cardinality(const RoaringBitmapWithSmallSet & r1) const
+    UInt64 rb_and_cardinality(const RoaringBitmapWithSmallSet & r1) const /// NOLINT
     {
         UInt64 ret = 0;
         if (isSmall() && r1.isSmall())
@@ -283,8 +283,8 @@ public:
 
     /**
      * Computes the cardinality of the union between two bitmaps.
-    */
+     */
-    UInt64 rb_or_cardinality(const RoaringBitmapWithSmallSet & r1) const
+    UInt64 rb_or_cardinality(const RoaringBitmapWithSmallSet & r1) const /// NOLINT
     {
         UInt64 c1 = size();
         UInt64 c2 = r1.size();
@@ -294,8 +294,8 @@ public:
 
     /**
      * Computes the cardinality of the symmetric difference (andnot) between two bitmaps.
-    */
+     */
-    UInt64 rb_xor_cardinality(const RoaringBitmapWithSmallSet & r1) const
+    UInt64 rb_xor_cardinality(const RoaringBitmapWithSmallSet & r1) const /// NOLINT
     {
         UInt64 c1 = size();
         UInt64 c2 = r1.size();
@@ -306,7 +306,7 @@ public:
     /**
      * Computes the cardinality of the difference (andnot) between two bitmaps.
      */
-    UInt64 rb_andnot_cardinality(const RoaringBitmapWithSmallSet & r1) const
+    UInt64 rb_andnot_cardinality(const RoaringBitmapWithSmallSet & r1) const /// NOLINT
     {
         UInt64 c1 = size();
         UInt64 inter = rb_and_cardinality(r1);
@@ -316,7 +316,7 @@ public:
     /**
      * Return 1 if the two bitmaps contain the same elements.
      */
-    UInt8 rb_equals(const RoaringBitmapWithSmallSet & r1)
+    UInt8 rb_equals(const RoaringBitmapWithSmallSet & r1) /// NOLINT
     {
         if (isSmall())
             toLarge();
@@ -329,7 +329,7 @@ public:
      * Check whether two bitmaps intersect.
      * Intersection with an empty set is always 0 (consistent with hasAny).
      */
-    UInt8 rb_intersect(const RoaringBitmapWithSmallSet & r1) const
+    UInt8 rb_intersect(const RoaringBitmapWithSmallSet & r1) const /// NOLINT
     {
         if (isSmall())
         {
@@ -370,7 +370,7 @@ public:
      * Empty set is a subset of any other set (consistent with hasAll).
      * It's used in subset and currently only support comparing same type
      */
-    UInt8 rb_is_subset(const RoaringBitmapWithSmallSet & r1) const
+    UInt8 rb_is_subset(const RoaringBitmapWithSmallSet & r1) const /// NOLINT
     {
         if (isSmall())
         {
@@ -420,7 +420,7 @@ public:
     /**
      * Check whether this bitmap contains the argument.
      */
-    UInt8 rb_contains(UInt64 x) const
+    UInt8 rb_contains(UInt64 x) const /// NOLINT
     {
         if (!std::is_same_v<T, UInt64> && x > rb_max())
             return 0;
@@ -434,7 +434,7 @@ public:
     /**
      * Remove value
      */
-    void rb_remove(UInt64 x)
+    void rb_remove(UInt64 x) /// NOLINT
     {
         if (!std::is_same_v<T, UInt64> && x > rb_max())
             return;
@@ -451,7 +451,7 @@ public:
      * range_end - range_start.
      * Areas outside the range are passed through unchanged.
      */
-    void rb_flip(UInt64 begin, UInt64 end)
+    void rb_flip(UInt64 begin, UInt64 end) /// NOLINT
     {
         if (isSmall())
             toLarge();
@@ -462,7 +462,7 @@ public:
     /**
      * returns the number of integers that are smaller or equal to offsetid.
      */
-    UInt64 rb_rank(UInt64 x)
+    UInt64 rb_rank(UInt64 x) /// NOLINT
     {
         if (isSmall())
             toLarge();
@@ -474,7 +474,7 @@ public:
      * Convert elements to integer array, return number of elements
      */
     template <typename Element>
-    UInt64 rb_to_array(PaddedPODArray<Element> & res) const
+    UInt64 rb_to_array(PaddedPODArray<Element> & res) const /// NOLINT
     {
         UInt64 count = 0;
         if (isSmall())
@@ -500,7 +500,7 @@ public:
      * Return new set with specified range (not include the range_end)
      * It's used in subset and currently only support UInt32
      */
-    UInt64 rb_range(UInt64 range_start, UInt64 range_end, RoaringBitmapWithSmallSet & r1) const
+    UInt64 rb_range(UInt64 range_start, UInt64 range_end, RoaringBitmapWithSmallSet & r1) const /// NOLINT
     {
         UInt64 count = 0;
         if (range_start >= range_end)
@@ -540,7 +540,7 @@ public:
      * Return new set of the smallest `limit` values in set which is no less than `range_start`.
      * It's used in subset and currently only support UInt32
      */
-    UInt64 rb_limit(UInt64 range_start, UInt64 limit, RoaringBitmapWithSmallSet & r1) const
+    UInt64 rb_limit(UInt64 range_start, UInt64 limit, RoaringBitmapWithSmallSet & r1) const /// NOLINT
     {
         if (limit == 0)
             return 0;
@@ -586,7 +586,7 @@ public:
         }
     }
 
-    UInt64 rb_offset_limit(UInt64 offset, UInt64 limit, RoaringBitmapWithSmallSet & r1) const
+    UInt64 rb_offset_limit(UInt64 offset, UInt64 limit, RoaringBitmapWithSmallSet & r1) const /// NOLINT
     {
         if (limit == 0 || offset >= size())
             return 0;
@@ -617,7 +617,7 @@ public:
         }
     }
 
-    UInt64 rb_min() const
+    UInt64 rb_min() const /// NOLINT
     {
         if (isSmall())
         {
@@ -636,7 +636,7 @@ public:
             return rb->minimum();
     }
 
-    UInt64 rb_max() const
+    UInt64 rb_max() const /// NOLINT
     {
         if (isSmall())
         {
@@ -659,7 +659,7 @@ public:
      * Replace value.
      * It's used in transform and currently can only support UInt32
      */
-    void rb_replace(const UInt64 * from_vals, const UInt64 * to_vals, size_t num)
+    void rb_replace(const UInt64 * from_vals, const UInt64 * to_vals, size_t num) /// NOLINT
     {
         if (isSmall())
             toLarge();

src/AggregateFunctions/AggregateFunctionGroupUniqArray.h

@@ -37,11 +37,11 @@ struct AggregateFunctionGroupUniqArrayData
 
 
 /// Puts all values to the hash set. Returns an array of unique values. Implemented for numeric types.
-template <typename T, typename Tlimit_num_elem>
+template <typename T, typename LimitNumElems>
 class AggregateFunctionGroupUniqArray
-    : public IAggregateFunctionDataHelper<AggregateFunctionGroupUniqArrayData<T>, AggregateFunctionGroupUniqArray<T, Tlimit_num_elem>>
+    : public IAggregateFunctionDataHelper<AggregateFunctionGroupUniqArrayData<T>, AggregateFunctionGroupUniqArray<T, LimitNumElems>>
 {
-    static constexpr bool limit_num_elems = Tlimit_num_elem::value;
+    static constexpr bool limit_num_elems = LimitNumElems::value;
     UInt64 max_elems;
 
 private:
@@ -50,7 +50,7 @@ private:
 public:
     AggregateFunctionGroupUniqArray(const DataTypePtr & argument_type, const Array & parameters_, UInt64 max_elems_ = std::numeric_limits<UInt64>::max())
         : IAggregateFunctionDataHelper<AggregateFunctionGroupUniqArrayData<T>,
-          AggregateFunctionGroupUniqArray<T, Tlimit_num_elem>>({argument_type}, parameters_),
+          AggregateFunctionGroupUniqArray<T, LimitNumElems>>({argument_type}, parameters_),
           max_elems(max_elems_) {}
 
     String getName() const override { return "groupUniqArray"; }
@@ -139,21 +139,21 @@ static void deserializeAndInsertImpl(StringRef str, IColumn & data_to);
 /** Template parameter with true value should be used for columns that store their elements in memory continuously.
  *  For such columns groupUniqArray() can be implemented more efficiently (especially for small numeric arrays).
  */
-template <bool is_plain_column = false, typename Tlimit_num_elem = std::false_type>
+template <bool is_plain_column = false, typename LimitNumElems = std::false_type>
 class AggregateFunctionGroupUniqArrayGeneric
     : public IAggregateFunctionDataHelper<AggregateFunctionGroupUniqArrayGenericData,
-        AggregateFunctionGroupUniqArrayGeneric<is_plain_column, Tlimit_num_elem>>
+        AggregateFunctionGroupUniqArrayGeneric<is_plain_column, LimitNumElems>>
 {
     DataTypePtr & input_data_type;
 
-    static constexpr bool limit_num_elems = Tlimit_num_elem::value;
+    static constexpr bool limit_num_elems = LimitNumElems::value;
     UInt64 max_elems;
 
     using State = AggregateFunctionGroupUniqArrayGenericData;
 
 public:
     AggregateFunctionGroupUniqArrayGeneric(const DataTypePtr & input_data_type_, const Array & parameters_, UInt64 max_elems_ = std::numeric_limits<UInt64>::max())
-        : IAggregateFunctionDataHelper<AggregateFunctionGroupUniqArrayGenericData, AggregateFunctionGroupUniqArrayGeneric<is_plain_column, Tlimit_num_elem>>({input_data_type_}, parameters_)
+        : IAggregateFunctionDataHelper<AggregateFunctionGroupUniqArrayGenericData, AggregateFunctionGroupUniqArrayGeneric<is_plain_column, LimitNumElems>>({input_data_type_}, parameters_)
         , input_data_type(this->argument_types[0])
         , max_elems(max_elems_) {}
 

src/AggregateFunctions/AggregateFunctionHistogram.h

@@ -54,13 +54,12 @@ private:
         Mean mean;
         Weight weight;
 
-        WeightedValue operator+ (const WeightedValue & other)
+        WeightedValue operator+(const WeightedValue & other) const
         {
             return {mean + other.weight * (other.mean - mean) / (other.weight + weight), other.weight + weight};
         }
     };
 
-private:
     // quantity of stored weighted-values
     UInt32 size;
 
@@ -71,7 +70,6 @@ private:
     // Weighted values representation of histogram.
     WeightedValue points[0];
 
-private:
     void sort()
     {
         ::sort(points, points + size,
@@ -87,18 +85,18 @@ private:
         size_t size = 0;
         T * data_ptr;
 
-        PriorityQueueStorage(T * value)
+        explicit PriorityQueueStorage(T * value)
             : data_ptr(value)
         {
         }
 
-        void push_back(T val)
+        void push_back(T val) /// NOLINT
         {
             data_ptr[size] = std::move(val);
             ++size;
         }
 
-        void pop_back() { --size; }
+        void pop_back() { --size; } /// NOLINT
         T * begin() { return data_ptr; }
         T * end() const { return data_ptr + size; }
         bool empty() const { return size == 0; }

src/AggregateFunctions/AggregateFunctionMLMethod.h

@@ -333,7 +333,7 @@ public:
         return std::make_shared<DataTypeNumber<Float64>>();
     }
 
-    void create(AggregateDataPtr __restrict place) const override
+    void create(AggregateDataPtr __restrict place) const override /// NOLINT
     {
         std::shared_ptr<IWeightsUpdater> new_weights_updater;
         if (weights_updater_name == "SGD")

src/AggregateFunctions/AggregateFunctionMannWhitney.h

@@ -149,7 +149,7 @@ public:
         if (params[0].getType() != Field::Types::String)
             throw Exception("Aggregate function " + getName() + " require first parameter to be a String", ErrorCodes::ILLEGAL_TYPE_OF_ARGUMENT);
 
-        auto param = params[0].get<String>();
+        const auto & param = params[0].get<String>();
         if (param == "two-sided")
             alternative = Alternative::TwoSided;
         else if (param == "less")

src/AggregateFunctions/AggregateFunctionMinMaxAny.h

@@ -1130,7 +1130,7 @@ private:
     SerializationPtr serialization;
 
 public:
-    AggregateFunctionsSingleValue(const DataTypePtr & type)
+    explicit AggregateFunctionsSingleValue(const DataTypePtr & type)
         : IAggregateFunctionDataHelper<Data, AggregateFunctionsSingleValue<Data>>({type}, {})
         , serialization(type->getDefaultSerialization())
     {
@@ -1188,7 +1188,7 @@ public:
         }
     }
 
-    void addBatchSinglePlaceNotNull(
+    void addBatchSinglePlaceNotNull( /// NOLINT
         size_t batch_size,
         AggregateDataPtr place,
         const IColumn ** columns,

src/AggregateFunctions/AggregateFunctionNull.h

@@ -77,7 +77,7 @@ protected:
 
     static bool getFlag(ConstAggregateDataPtr __restrict place) noexcept
     {
-        return result_is_nullable ? place[0] : 1;
+        return result_is_nullable ? place[0] : true;
     }
 
 public:
@@ -148,7 +148,7 @@ public:
 
     void deserialize(AggregateDataPtr __restrict place, ReadBuffer & buf, std::optional<size_t> version, Arena * arena) const override
     {
-        bool flag = 1;
+        bool flag = true;
         if constexpr (serialize_flag)
             readBinary(flag, buf);
         if (flag)
@@ -306,7 +306,7 @@ public:
         }
     }
 
-    void addBatchSinglePlace(
+    void addBatchSinglePlace( /// NOLINT
         size_t batch_size, AggregateDataPtr place, const IColumn ** columns, Arena * arena, ssize_t if_argument_pos = -1) const override
     {
         const ColumnNullable * column = assert_cast<const ColumnNullable *>(columns[0]);

src/AggregateFunctions/AggregateFunctionOrFill.h

@@ -108,7 +108,7 @@ public:
         place[size_of_data] = 1;
     }
 
-    void addBatch(
+    void addBatch( /// NOLINT
         size_t batch_size,
         AggregateDataPtr * places,
         size_t place_offset,
@@ -134,7 +134,7 @@ public:
         }
     }
 
-    void addBatchSinglePlace(
+    void addBatchSinglePlace( /// NOLINT
         size_t batch_size, AggregateDataPtr place, const IColumn ** columns, Arena * arena, ssize_t if_argument_pos = -1) const override
     {
         if (if_argument_pos >= 0)
@@ -160,7 +160,7 @@ public:
         }
     }
 
-    void addBatchSinglePlaceNotNull(
+    void addBatchSinglePlaceNotNull( /// NOLINT
         size_t batch_size,
         AggregateDataPtr place,
         const IColumn ** columns,

src/AggregateFunctions/AggregateFunctionRankCorrelation.h

@@ -77,7 +77,7 @@ public:
     void merge(AggregateDataPtr __restrict place, ConstAggregateDataPtr rhs, Arena * arena) const override
     {
         auto & a = this->data(place);
-        auto & b = this->data(rhs);
+        const auto & b = this->data(rhs);
 
         a.merge(b, arena);
     }

src/AggregateFunctions/AggregateFunctionResample.h

@@ -21,7 +21,7 @@ class AggregateFunctionResample final : public IAggregateFunctionHelper<Aggregat
 {
 private:
     /// Sanity threshold to avoid creation of too large arrays. The choice of this number is arbitrary.
-    const size_t MAX_ELEMENTS = 1048576;
+    static constexpr size_t max_elements = 1048576;
 
     AggregateFunctionPtr nested_function;
 
@@ -75,7 +75,7 @@ public:
             total = (sum - 1) / step; // total = (end - begin + step - 1) / step
         }
 
-        if (total > MAX_ELEMENTS)
+        if (total > max_elements)
             throw Exception("The range given in function "
                     + getName() + " contains too many elements",
                 ErrorCodes::ARGUMENT_OUT_OF_BOUND);

src/AggregateFunctions/AggregateFunctionRetention.h

@@ -75,12 +75,12 @@ public:
         return "retention";
     }
 
-    AggregateFunctionRetention(const DataTypes & arguments)
+    explicit AggregateFunctionRetention(const DataTypes & arguments)
         : IAggregateFunctionDataHelper<AggregateFunctionRetentionData, AggregateFunctionRetention>(arguments, {})
     {
         for (const auto i : collections::range(0, arguments.size()))
         {
-            auto cond_arg = arguments[i].get();
+            const auto * cond_arg = arguments[i].get();
             if (!isUInt8(cond_arg))
                 throw Exception{"Illegal type " + cond_arg->getName() + " of argument " + toString(i) + " of aggregate function "
                         + getName() + ", must be UInt8",

src/AggregateFunctions/AggregateFunctionSequenceMatch.h

@@ -37,7 +37,7 @@ struct ComparePairFirst final
     }
 };
 
-static constexpr auto max_events = 32;
+static constexpr size_t max_events = 32;
 
 template <typename T>
 struct AggregateFunctionSequenceMatchData final
@@ -187,7 +187,7 @@ private:
         std::uint64_t extra;
 
         PatternAction() = default;
-        PatternAction(const PatternActionType type_, const std::uint64_t extra_ = 0) : type{type_}, extra{extra_} {}
+        explicit PatternAction(const PatternActionType type_, const std::uint64_t extra_ = 0) : type{type_}, extra{extra_} {}
     };
 
     using PatternActions = PODArrayWithStackMemory<PatternAction, 64>;
@@ -246,7 +246,7 @@ private:
                         throw_exception("Unknown time condition");
 
                     UInt64 duration = 0;
-                    auto prev_pos = pos;
+                    const auto * prev_pos = pos;
                     pos = tryReadIntText(duration, pos, end);
                     if (pos == prev_pos)
                         throw_exception("Could not parse number");
@@ -262,7 +262,7 @@ private:
                 else
                 {
                     UInt64 event_number = 0;
-                    auto prev_pos = pos;
+                    const auto * prev_pos = pos;
                     pos = tryReadIntText(event_number, pos, end);
                     if (pos == prev_pos)
                         throw_exception("Could not parse number");
@@ -580,7 +580,7 @@ private:
 
     struct DFAState
     {
-        DFAState(bool has_kleene_ = false)
+        explicit DFAState(bool has_kleene_ = false)
             : has_kleene{has_kleene_}, event{0}, transition{DFATransition::None}
         {}
 

src/AggregateFunctions/AggregateFunctionSequenceNextNode.h

@@ -216,7 +216,7 @@ public:
         a.value.push_back(v->clone(arena), arena);
     }
 
-    void create(AggregateDataPtr place) const override
+    void create(AggregateDataPtr place) const override /// NOLINT
     {
         new (place) Data;
     }

src/AggregateFunctions/AggregateFunctionSparkbar.h

@@ -185,18 +185,18 @@ private:
             std::optional<Float64> max_y;
 
             std::optional<Float64> new_y;
-            std::vector<std::optional<Float64>> newPoints;
+            std::vector<std::optional<Float64>> new_points;
-            newPoints.reserve(width);
+            new_points.reserve(width);
 
             std::pair<size_t, Float64> bound{0, 0.0};
             size_t cur_bucket_num = 0;
             // upper bound for bucket
-            auto upperBound = [&](size_t bucket_num)
+            auto upper_bound = [&](size_t bucket_num)
             {
                 bound.second = (bucket_num + 1) * multiple_d;
                 bound.first = std::floor(bound.second);
             };
-            upperBound(cur_bucket_num);
+            upper_bound(cur_bucket_num);
             for (size_t i = 0; i <= (diff_x + 1); ++i)
             {
                 if (i == bound.first) // is bound
@@ -211,7 +211,7 @@ private:
                     {
                         Float64 avg_y = new_y.value() / multiple_d;
 
-                        newPoints.emplace_back(avg_y);
+                        new_points.emplace_back(avg_y);
                         // If min_y has no value, or if the avg_y of the current bucket is less than min_y, update it.
                         if (!min_y || avg_y < min_y)
                             min_y = avg_y;
@@ -220,12 +220,12 @@ private:
                     }
                     else
                     {
-                        newPoints.emplace_back();
+                        new_points.emplace_back();
                     }
 
                     // next bucket
                     new_y = found ? ((1 - proportion) * it->getMapped()) : std::optional<Float64>();
-                    upperBound(++cur_bucket_num);
+                    upper_bound(++cur_bucket_num);
                 }
                 else
                 {
@@ -240,19 +240,19 @@ private:
 
             Float64 diff_y = max_y.value() - min_y.value();
 
-            auto getBars = [&] (const std::optional<Float64> & point_y)
+            auto get_bars = [&] (const std::optional<Float64> & point_y)
             {
                 value += getBar(point_y ? std::round(((point_y.value() - min_y.value()) / diff_y) * 7) + 1 : 0);
             };
-            auto getBarsForConstant = [&] (const std::optional<Float64> & point_y)
+            auto get_bars_for_constant = [&] (const std::optional<Float64> & point_y)
             {
                 value += getBar(point_y ? 1 : 0);
             };
 
             if (diff_y)
-                std::for_each(newPoints.begin(), newPoints.end(), getBars);
+                std::for_each(new_points.begin(), new_points.end(), get_bars);
             else
-                std::for_each(newPoints.begin(), newPoints.end(), getBarsForConstant);
+                std::for_each(new_points.begin(), new_points.end(), get_bars_for_constant);
         }
         return value;
     }

src/AggregateFunctions/AggregateFunctionStatistics.h

@@ -114,7 +114,7 @@ class AggregateFunctionVariance final
     : public IAggregateFunctionDataHelper<AggregateFunctionVarianceData<T, Op>, AggregateFunctionVariance<T, Op>>
 {
 public:
-    AggregateFunctionVariance(const DataTypePtr & arg)
+    explicit AggregateFunctionVariance(const DataTypePtr & arg)
         : IAggregateFunctionDataHelper<AggregateFunctionVarianceData<T, Op>, AggregateFunctionVariance<T, Op>>({arg}, {}) {}
 
     String getName() const override { return Op::name; }
@@ -249,7 +249,6 @@ protected:
         readBinary(right_m2, buf);
     }
 
-protected:
     Float64 left_m2 = 0.0;
     Float64 right_m2 = 0.0;
 };
@@ -367,7 +366,7 @@ class AggregateFunctionCovariance final
         AggregateFunctionCovariance<T, U, Op, compute_marginal_moments>>
 {
 public:
-    AggregateFunctionCovariance(const DataTypes & args) : IAggregateFunctionDataHelper<
+    explicit AggregateFunctionCovariance(const DataTypes & args) : IAggregateFunctionDataHelper<
         CovarianceData<T, U, Op, compute_marginal_moments>,
         AggregateFunctionCovariance<T, U, Op, compute_marginal_moments>>(args, {}) {}
 

src/AggregateFunctions/AggregateFunctionStatisticsSimple.h

@@ -80,7 +80,7 @@ public:
     using ResultType = typename StatFunc::ResultType;
     using ColVecResult = ColumnVector<ResultType>;
 
-    AggregateFunctionVarianceSimple(const DataTypes & argument_types_)
+    explicit AggregateFunctionVarianceSimple(const DataTypes & argument_types_)
         : IAggregateFunctionDataHelper<typename StatFunc::Data, AggregateFunctionVarianceSimple<StatFunc>>(argument_types_, {})
         , src_scale(0)
     {}

src/AggregateFunctions/AggregateFunctionSum.h

@@ -97,7 +97,7 @@ struct AggregateFunctionSumData
 
     template <typename Value, bool add_if_zero>
     void NO_SANITIZE_UNDEFINED NO_INLINE
-    addManyConditional_internal(const Value * __restrict ptr, const UInt8 * __restrict condition_map, size_t count)
+    addManyConditionalInternal(const Value * __restrict ptr, const UInt8 * __restrict condition_map, size_t count)
     {
         const auto * end = ptr + count;
 
@@ -124,7 +124,8 @@ struct AggregateFunctionSumData
             /// For floating point we use a similar trick as above, except that now we  reinterpret the floating point number as an unsigned
             /// integer of the same size and use a mask instead (0 to discard, 0xFF..FF to keep)
             static_assert(sizeof(Value) == 4 || sizeof(Value) == 8);
-            typedef typename std::conditional_t<sizeof(Value) == 4, UInt32, UInt64> equivalent_integer;
+            using equivalent_integer = typename std::conditional_t<sizeof(Value) == 4, UInt32, UInt64>;
+
             constexpr size_t unroll_count = 128 / sizeof(T);
             T partial_sums[unroll_count]{};
 
@@ -163,13 +164,13 @@ struct AggregateFunctionSumData
     template <typename Value>
     void ALWAYS_INLINE addManyNotNull(const Value * __restrict ptr, const UInt8 * __restrict null_map, size_t count)
     {
-        return addManyConditional_internal<Value, true>(ptr, null_map, count);
+        return addManyConditionalInternal<Value, true>(ptr, null_map, count);
     }
 
     template <typename Value>
     void ALWAYS_INLINE addManyConditional(const Value * __restrict ptr, const UInt8 * __restrict cond_map, size_t count)
     {
-        return addManyConditional_internal<Value, false>(ptr, cond_map, count);
+        return addManyConditionalInternal<Value, false>(ptr, cond_map, count);
     }
 
     void NO_SANITIZE_UNDEFINED merge(const AggregateFunctionSumData & rhs)
@@ -248,7 +249,7 @@ struct AggregateFunctionSumKahanData
     }
 
     template <typename Value, bool add_if_zero>
-    void NO_INLINE addManyConditional_internal(const Value * __restrict ptr, const UInt8 * __restrict condition_map, size_t count)
+    void NO_INLINE addManyConditionalInternal(const Value * __restrict ptr, const UInt8 * __restrict condition_map, size_t count)
     {
         constexpr size_t unroll_count = 4;
         T partial_sums[unroll_count]{};
@@ -281,13 +282,13 @@ struct AggregateFunctionSumKahanData
     template <typename Value>
     void ALWAYS_INLINE addManyNotNull(const Value * __restrict ptr, const UInt8 * __restrict null_map, size_t count)
     {
-        return addManyConditional_internal<Value, true>(ptr, null_map, count);
+        return addManyConditionalInternal<Value, true>(ptr, null_map, count);
     }
 
     template <typename Value>
     void ALWAYS_INLINE addManyConditional(const Value * __restrict ptr, const UInt8 * __restrict cond_map, size_t count)
     {
-        return addManyConditional_internal<Value, false>(ptr, cond_map, count);
+        return addManyConditionalInternal<Value, false>(ptr, cond_map, count);
     }
 
     void ALWAYS_INLINE mergeImpl(T & to_sum, T & to_compensation, T from_sum, T from_compensation)
@@ -351,7 +352,7 @@ public:
         __builtin_unreachable();
     }
 
-    AggregateFunctionSum(const DataTypes & argument_types_)
+    explicit AggregateFunctionSum(const DataTypes & argument_types_)
         : IAggregateFunctionDataHelper<Data, AggregateFunctionSum<T, TResult, Data, Type>>(argument_types_, {})
         , scale(0)
     {}

src/AggregateFunctions/AggregateFunctionSumMap.h

@@ -489,15 +489,15 @@ public:
                 "Aggregate function '{}' requires exactly one parameter "
                 "of Array type", getName());
 
-        Array keys_to_keep_;
+        Array keys_to_keep_values;
-        if (!params_.front().tryGet<Array>(keys_to_keep_))
+        if (!params_.front().tryGet<Array>(keys_to_keep_values))
             throw Exception(ErrorCodes::ILLEGAL_TYPE_OF_ARGUMENT,
                 "Aggregate function {} requires an Array as a parameter",
                 getName());
 
-        keys_to_keep.reserve(keys_to_keep_.size());
+        keys_to_keep.reserve(keys_to_keep_values.size());
 
-        for (const Field & f : keys_to_keep_)
+        for (const Field & f : keys_to_keep_values)
             keys_to_keep.emplace(f.safeGet<T>());
     }
 

src/AggregateFunctions/AggregateFunctionTTest.h

@@ -64,7 +64,7 @@ namespace ErrorCodes
  * Both WelchTTest and StudentTTest have t-statistric with Student distribution but with different degrees of freedom.
  * So the procedure of computing p-value is the same.
 */
-static inline Float64 getPValue(Float64 degrees_of_freedom, Float64 t_stat2)
+static inline Float64 getPValue(Float64 degrees_of_freedom, Float64 t_stat2) /// NOLINT
 {
     Float64 numerator = integrateSimpson(0, degrees_of_freedom / (t_stat2 + degrees_of_freedom),
         [degrees_of_freedom](double x) { return std::pow(x, degrees_of_freedom / 2 - 1) / std::sqrt(1 - x); });
@@ -92,7 +92,7 @@ public:
     AggregateFunctionTTest(const DataTypes & arguments, const Array & params)
         : IAggregateFunctionDataHelper<Data, AggregateFunctionTTest<Data>>({arguments}, params)
     {
-        if (params.size() > 0)
+        if (!params.empty())
         {
             need_confidence_interval = true;
             confidence_level = params.at(0).safeGet<Float64>();

src/AggregateFunctions/AggregateFunctionWindowFunnel.h

@@ -20,7 +20,7 @@ namespace ErrorCodes
     extern const int BAD_ARGUMENTS;
 }
 
-static constexpr auto max_events = 32;
+static constexpr size_t max_events = 32;
 
 template <typename T>
 struct AggregateFunctionWindowFunnelData

src/AggregateFunctions/CrossTab.h

@@ -117,7 +117,7 @@ template <typename Data>
 class AggregateFunctionCrossTab : public IAggregateFunctionDataHelper<Data, AggregateFunctionCrossTab<Data>>
 {
 public:
-    AggregateFunctionCrossTab(const DataTypes & arguments)
+    explicit AggregateFunctionCrossTab(const DataTypes & arguments)
         : IAggregateFunctionDataHelper<Data, AggregateFunctionCrossTab<Data>>({arguments}, {})
     {
     }

src/AggregateFunctions/Helpers.h

@@ -55,7 +55,7 @@ static IAggregateFunction * createWithNumericType(const IDataType & argument_typ
 {
     WhichDataType which(argument_type);
 #define DISPATCH(TYPE) \
-    if (which.idx == TypeIndex::TYPE) return new AggregateFunctionTemplate<Data<TYPE>>(std::forward<TArgs>(args)...);
+    if (which.idx == TypeIndex::TYPE) return new AggregateFunctionTemplate<Data<TYPE>>(std::forward<TArgs>(args)...); /// NOLINT
     FOR_NUMERIC_TYPES(DISPATCH)
 #undef DISPATCH
     if (which.idx == TypeIndex::Enum8) return new AggregateFunctionTemplate<Data<Int8>>(std::forward<TArgs>(args)...);
@@ -94,7 +94,7 @@ static IAggregateFunction * createWithNumericType(const IDataType & argument_typ
 {
     WhichDataType which(argument_type);
 #define DISPATCH(TYPE) \
-    if (which.idx == TypeIndex::TYPE) return new AggregateFunctionTemplate<TYPE, Data<TYPE>>(std::forward<TArgs>(args)...);
+    if (which.idx == TypeIndex::TYPE) return new AggregateFunctionTemplate<TYPE, Data<TYPE>>(std::forward<TArgs>(args)...); /// NOLINT
     FOR_NUMERIC_TYPES(DISPATCH)
 #undef DISPATCH
     if (which.idx == TypeIndex::Enum8) return new AggregateFunctionTemplate<Int8, Data<Int8>>(std::forward<TArgs>(args)...);
@@ -121,7 +121,7 @@ static IAggregateFunction * createWithBasicNumberOrDateOrDateTime(const IDataTyp
     WhichDataType which(argument_type);
 #define DISPATCH(TYPE) \
     if (which.idx == TypeIndex::TYPE) \
-        return new AggregateFunctionTemplate<TYPE, Data<TYPE>>(std::forward<TArgs>(args)...);
+        return new AggregateFunctionTemplate<TYPE, Data<TYPE>>(std::forward<TArgs>(args)...); /// NOLINT
     FOR_BASIC_NUMERIC_TYPES(DISPATCH)
 #undef DISPATCH
 

src/AggregateFunctions/HelpersMinMaxAny.h

@@ -25,7 +25,7 @@ static IAggregateFunction * createAggregateFunctionSingleValue(const String & na
 
     WhichDataType which(argument_type);
 #define DISPATCH(TYPE) \
-    if (which.idx == TypeIndex::TYPE) return new AggregateFunctionTemplate<Data<SingleValueDataFixed<TYPE>>>(argument_type);
+    if (which.idx == TypeIndex::TYPE) return new AggregateFunctionTemplate<Data<SingleValueDataFixed<TYPE>>>(argument_type); /// NOLINT
     FOR_NUMERIC_TYPES(DISPATCH)
 #undef DISPATCH
 
@@ -56,7 +56,7 @@ static IAggregateFunction * createAggregateFunctionArgMinMaxSecond(const DataTyp
 
 #define DISPATCH(TYPE) \
     if (which.idx == TypeIndex::TYPE) \
-        return new AggregateFunctionArgMinMax<AggregateFunctionArgMinMaxData<ResData, MinMaxData<SingleValueDataFixed<TYPE>>>>(res_type, val_type);
+        return new AggregateFunctionArgMinMax<AggregateFunctionArgMinMaxData<ResData, MinMaxData<SingleValueDataFixed<TYPE>>>>(res_type, val_type); /// NOLINT
     FOR_NUMERIC_TYPES(DISPATCH)
 #undef DISPATCH
 
@@ -90,7 +90,7 @@ static IAggregateFunction * createAggregateFunctionArgMinMax(const String & name
     WhichDataType which(res_type);
 #define DISPATCH(TYPE) \
     if (which.idx == TypeIndex::TYPE) \
-        return createAggregateFunctionArgMinMaxSecond<MinMaxData, SingleValueDataFixed<TYPE>>(res_type, val_type);
+        return createAggregateFunctionArgMinMaxSecond<MinMaxData, SingleValueDataFixed<TYPE>>(res_type, val_type); /// NOLINT
     FOR_NUMERIC_TYPES(DISPATCH)
 #undef DISPATCH
 

src/AggregateFunctions/IAggregateFunction.h

@@ -127,10 +127,10 @@ public:
     virtual void merge(AggregateDataPtr __restrict place, ConstAggregateDataPtr rhs, Arena * arena) const = 0;
 
     /// Serializes state (to transmit it over the network, for example).
-    virtual void serialize(ConstAggregateDataPtr __restrict place, WriteBuffer & buf, std::optional<size_t> version = std::nullopt) const = 0;
+    virtual void serialize(ConstAggregateDataPtr __restrict place, WriteBuffer & buf, std::optional<size_t> version = std::nullopt) const = 0; /// NOLINT
 
     /// Deserializes state. This function is called only for empty (just created) states.
-    virtual void deserialize(AggregateDataPtr __restrict place, ReadBuffer & buf, std::optional<size_t> version = std::nullopt, Arena * arena = nullptr) const = 0;
+    virtual void deserialize(AggregateDataPtr __restrict place, ReadBuffer & buf, std::optional<size_t> version = std::nullopt, Arena * arena = nullptr) const = 0; /// NOLINT
 
     /// Returns true if a function requires Arena to handle own states (see add(), merge(), deserialize()).
     virtual bool allocatesMemoryInArena() const = 0;
@@ -174,7 +174,7 @@ public:
     /** Contains a loop with calls to "add" function. You can collect arguments into array "places"
       *  and do a single call to "addBatch" for devirtualization and inlining.
       */
-    virtual void addBatch(
+    virtual void addBatch( /// NOLINT
         size_t batch_size,
         AggregateDataPtr * places,
         size_t place_offset,
@@ -198,7 +198,7 @@ public:
 
     /** The same for single place.
       */
-    virtual void addBatchSinglePlace(
+    virtual void addBatchSinglePlace( /// NOLINT
         size_t batch_size, AggregateDataPtr place, const IColumn ** columns, Arena * arena, ssize_t if_argument_pos = -1) const = 0;
 
     /// The version of "addBatchSinglePlace", that handle sparse columns as arguments.
@@ -208,7 +208,7 @@ public:
     /** The same for single place when need to aggregate only filtered data.
       * Instead of using an if-column, the condition is combined inside the null_map
       */
-    virtual void addBatchSinglePlaceNotNull(
+    virtual void addBatchSinglePlaceNotNull( /// NOLINT
         size_t batch_size,
         AggregateDataPtr place,
         const IColumn ** columns,
@@ -216,7 +216,7 @@ public:
         Arena * arena,
         ssize_t if_argument_pos = -1) const = 0;
 
-    virtual void addBatchSinglePlaceFromInterval(
+    virtual void addBatchSinglePlaceFromInterval( /// NOLINT
         size_t batch_begin, size_t batch_end, AggregateDataPtr place, const IColumn ** columns, Arena * arena, ssize_t if_argument_pos = -1)
         const = 0;
 
@@ -354,7 +354,7 @@ public:
 
     AddFunc getAddressOfAddFunction() const override { return &addFree; }
 
-    void addBatch(
+    void addBatch( /// NOLINT
         size_t batch_size,
         AggregateDataPtr * places,
         size_t place_offset,
@@ -407,7 +407,7 @@ public:
                 static_cast<const Derived *>(this)->merge(places[i] + place_offset, rhs[i], arena);
     }
 
-    void addBatchSinglePlace(
+    void addBatchSinglePlace( /// NOLINT
         size_t batch_size, AggregateDataPtr place, const IColumn ** columns, Arena * arena, ssize_t if_argument_pos = -1) const override
     {
         if (if_argument_pos >= 0)
@@ -439,7 +439,7 @@ public:
             static_cast<const Derived *>(this)->add(place, &values, offset_it.getValueIndex(), arena);
     }
 
-    void addBatchSinglePlaceNotNull(
+    void addBatchSinglePlaceNotNull( /// NOLINT
         size_t batch_size,
         AggregateDataPtr place,
         const IColumn ** columns,
@@ -462,7 +462,7 @@ public:
         }
     }
 
-    void addBatchSinglePlaceFromInterval(
+    void addBatchSinglePlaceFromInterval( /// NOLINT
         size_t batch_begin, size_t batch_end, AggregateDataPtr place, const IColumn ** columns, Arena * arena, ssize_t if_argument_pos = -1)
         const override
     {
@@ -586,7 +586,7 @@ public:
     IAggregateFunctionDataHelper(const DataTypes & argument_types_, const Array & parameters_)
         : IAggregateFunctionHelper<Derived>(argument_types_, parameters_) {}
 
-    void create(AggregateDataPtr place) const override
+    void create(AggregateDataPtr place) const override /// NOLINT
     {
         new (place) Data;
     }

src/AggregateFunctions/IAggregateFunctionCombinator.h

@@ -68,7 +68,7 @@ public:
         const DataTypes & arguments,
         const Array & params) const = 0;
 
-    virtual ~IAggregateFunctionCombinator() {}
+    virtual ~IAggregateFunctionCombinator() = default;
 };
 
 using AggregateFunctionCombinatorPtr = std::shared_ptr<const IAggregateFunctionCombinator>;

src/AggregateFunctions/ReservoirSampler.h

@@ -65,7 +65,7 @@ template <typename T, ReservoirSamplerOnEmpty::Enum OnEmpty = ReservoirSamplerOn
 class ReservoirSampler
 {
 public:
-    ReservoirSampler(size_t sample_count_ = DEFAULT_SAMPLE_COUNT)
+    explicit ReservoirSampler(size_t sample_count_ = DEFAULT_SAMPLE_COUNT)
         : sample_count(sample_count_)
     {
         rng.seed(123456);
@@ -111,7 +111,7 @@ public:
         sortIfNeeded();
 
         double index = level * (samples.size() - 1);
-        size_t int_index = static_cast<size_t>(index + 0.5);
+        size_t int_index = static_cast<size_t>(index + 0.5); /// NOLINT
         int_index = std::max(0LU, std::min(samples.size() - 1, int_index));
         return samples[int_index];
     }
@@ -190,7 +190,7 @@ public:
             }
             else
             {
-                for (double i = 0; i < sample_count; i += frequency)
+                for (double i = 0; i < sample_count; i += frequency) /// NOLINT
                     samples[i] = b.samples[i];
             }
         }

src/AggregateFunctions/ReservoirSamplerDeterministic.h

@@ -67,7 +67,7 @@ private:
     }
 
 public:
-    ReservoirSamplerDeterministic(const size_t max_sample_size_ = detail::DEFAULT_MAX_SAMPLE_SIZE)
+    explicit ReservoirSamplerDeterministic(const size_t max_sample_size_ = detail::DEFAULT_MAX_SAMPLE_SIZE)
         : max_sample_size{max_sample_size_}
     {
     }
@@ -103,7 +103,7 @@ public:
         sortIfNeeded();
 
         double index = level * (samples.size() - 1);
-        size_t int_index = static_cast<size_t>(index + 0.5);
+        size_t int_index = static_cast<size_t>(index + 0.5); /// NOLINT
         int_index = std::max(0LU, std::min(samples.size() - 1, int_index));
         return samples[int_index].first;
     }

src/AggregateFunctions/ThetaSketchData.h

@@ -6,6 +6,7 @@
 
 #include <boost/noncopyable.hpp>
 #include <memory>
+#include <base/StringRef.h>
 #include <theta_sketch.hpp>
 #include <theta_union.hpp>
 

src/AggregateFunctions/UniquesHashSet.h

@@ -105,8 +105,8 @@ private:
         }
     }
 
-    inline size_t buf_size() const           { return 1ULL << size_degree; }
+    inline size_t buf_size() const           { return 1ULL << size_degree; } /// NOLINT
-    inline size_t max_fill() const           { return 1ULL << (size_degree - 1); }
+    inline size_t max_fill() const           { return 1ULL << (size_degree - 1); } /// NOLINT
     inline size_t mask() const               { return buf_size() - 1; }
     inline size_t place(HashValue x) const { return (x >> UNIQUES_HASH_BITS_FOR_SKIP) & mask(); }
 
@@ -304,8 +304,11 @@ public:
         memcpy(buf, rhs.buf, buf_size() * sizeof(buf[0]));
     }
 
-    UniquesHashSet & operator= (const UniquesHashSet & rhs)
+    UniquesHashSet & operator=(const UniquesHashSet & rhs)
     {
+        if (&rhs == this)
+            return *this;
+
         if (size_degree != rhs.size_degree)
         {
             free();

src/Backups/BackupEntryFromAppendOnlyFile.h

@@ -12,7 +12,7 @@ class BackupEntryFromAppendOnlyFile : public BackupEntryFromImmutableFile
 {
 public:
     /// The constructor is allowed to not set `file_size_` or `checksum_`, in that case it will be calculated from the data.
-    BackupEntryFromAppendOnlyFile(
+    explicit BackupEntryFromAppendOnlyFile(
         const String & file_path_,
         const std::optional<UInt64> & file_size_ = {},
         const std::optional<UInt128> & checksum_ = {},

src/Backups/BackupEntryFromImmutableFile.h

@@ -16,7 +16,7 @@ class BackupEntryFromImmutableFile : public IBackupEntry
 {
 public:
     /// The constructor is allowed to not set `file_size_` or `checksum_`, in that case it will be calculated from the data.
-    BackupEntryFromImmutableFile(
+    explicit BackupEntryFromImmutableFile(
         const String & file_path_,
         const std::optional<UInt64> & file_size_ = {},
         const std::optional<UInt128> & checksum_ = {},

src/Backups/BackupEntryFromMemory.h

@@ -13,7 +13,7 @@ class BackupEntryFromMemory : public IBackupEntry
 public:
     /// The constructor is allowed to not set `checksum_`, in that case it will be calculated from the data.
     BackupEntryFromMemory(const void * data_, size_t size_, const std::optional<UInt128> & checksum_ = {});
-    BackupEntryFromMemory(String data_, const std::optional<UInt128> & checksum_ = {});
+    explicit BackupEntryFromMemory(String data_, const std::optional<UInt128> & checksum_ = {});
 
     UInt64 getSize() const override { return data.size(); }
     std::optional<UInt128> getChecksum() const override { return checksum; }

src/Backups/BackupEntryFromSmallFile.h

@@ -14,7 +14,7 @@ class BackupEntryFromSmallFile : public BackupEntryFromMemory
 {
 public:
     /// The constructor is allowed to not set `checksum_`, in that case it will be calculated from the data.
-    BackupEntryFromSmallFile(
+    explicit BackupEntryFromSmallFile(
         const String & file_path_,
         const std::optional<UInt128> & checksum_ = {});
 

src/Backups/IBackup.h

@@ -16,7 +16,7 @@ using BackupEntryPtr = std::unique_ptr<IBackupEntry>;
 class IBackup : public std::enable_shared_from_this<IBackup>, public TypePromotion<IBackup>
 {
 public:
-    IBackup() {}
+    IBackup() = default;
     virtual ~IBackup() = default;
 
     /// Name of the backup.
@@ -44,7 +44,7 @@ public:
     /// before the terminator. For example, list("", "") returns names of all the entries
     /// in the backup; and list("data/", "/") return kind of a list of folders and
     /// files stored in the "data/" directory inside the backup.
-    virtual Strings listFiles(const String & prefix = "", const String & terminator = "/") const = 0;
+    virtual Strings listFiles(const String & prefix = "", const String & terminator = "/") const = 0; /// NOLINT
 
     /// Checks if an entry with a specified name exists.
     virtual bool fileExists(const String & file_name) const = 0;

src/Client/ClientBase.h

@@ -103,7 +103,6 @@ protected:
                                 const std::vector<Arguments> & hosts_and_ports_arguments) = 0;
     virtual void processConfig() = 0;
 
-protected:
     bool processQueryText(const String & text);
 
 private:

src/Client/ConnectionParameters.h

@@ -22,8 +22,8 @@ struct ConnectionParameters
     Protocol::Compression compression = Protocol::Compression::Enable;
     ConnectionTimeouts timeouts;
 
-    ConnectionParameters() {}
+    ConnectionParameters() = default;
-    ConnectionParameters(const Poco::Util::AbstractConfiguration & config);
+    explicit ConnectionParameters(const Poco::Util::AbstractConfiguration & config);
     ConnectionParameters(const Poco::Util::AbstractConfiguration & config, std::string host, int port);
 
     static int getPortFromConfig(const Poco::Util::AbstractConfiguration & config);

src/Client/ConnectionPool.h

@@ -25,12 +25,11 @@ class IConnectionPool : private boost::noncopyable
 public:
     using Entry = PoolBase<Connection>::Entry;
 
-public:
     virtual ~IConnectionPool() = default;
 
     /// Selects the connection to work.
     /// If force_connected is false, the client must manually ensure that returned connection is good.
-    virtual Entry get(const ConnectionTimeouts & timeouts,
+    virtual Entry get(const ConnectionTimeouts & timeouts, /// NOLINT
                       const Settings * settings = nullptr,
                       bool force_connected = true) = 0;
 
@@ -76,7 +75,7 @@ public:
     {
     }
 
-    Entry get(const ConnectionTimeouts & timeouts,
+    Entry get(const ConnectionTimeouts & timeouts, /// NOLINT
               const Settings * settings = nullptr,
               bool force_connected = true) override
     {

src/Client/ConnectionPoolWithFailover.h

@@ -109,7 +109,6 @@ private:
 
     GetPriorityFunc makeGetPriorityFunc(const Settings * settings);
 
-private:
     std::vector<size_t> hostname_differences; /// Distances from name of this host to the names of hosts of pools.
     size_t last_used = 0; /// Last used for round_robin policy.
     LoadBalancing default_load_balancing;

src/Client/IConnections.cpp

@@ -22,7 +22,7 @@ struct PocoSocketWrapper : public Poco::Net::SocketImpl
     ~PocoSocketWrapper() override { reset(-1); }
 };
 
-void IConnections::DrainCallback::operator()(int fd, Poco::Timespan, const std::string fd_description) const
+void IConnections::DrainCallback::operator()(int fd, Poco::Timespan, const std::string & fd_description) const
 {
     if (!PocoSocketWrapper(fd).poll(drain_timeout, Poco::Net::Socket::SELECT_READ))
     {

src/Client/IConnections.h

@@ -16,7 +16,7 @@ public:
     struct DrainCallback
     {
         Poco::Timespan drain_timeout;
-        void operator()(int fd, Poco::Timespan, const std::string fd_description = "") const;
+        void operator()(int fd, Poco::Timespan, const std::string & fd_description = "") const;
     };
 
     /// Send all scalars to replicas.

src/Client/IServerConnection.h

@@ -14,7 +14,6 @@
 
 #include <Storages/MergeTree/RequestResponse.h>
 
-
 #include <boost/noncopyable.hpp>
 
 

src/Client/QueryFuzzer.cpp

@@ -546,7 +546,7 @@ void QueryFuzzer::fuzz(ASTPtr & ast)
  * small probability. Do this after we add this fuzzer to CI and fix all the
  * problems it can routinely find even in this boring version.
  */
-void QueryFuzzer::collectFuzzInfoMain(const ASTPtr ast)
+void QueryFuzzer::collectFuzzInfoMain(ASTPtr ast)
 {
     collectFuzzInfoRecurse(ast);
 
@@ -569,7 +569,7 @@ void QueryFuzzer::collectFuzzInfoMain(const ASTPtr ast)
     }
 }
 
-void QueryFuzzer::addTableLike(const ASTPtr ast)
+void QueryFuzzer::addTableLike(ASTPtr ast)
 {
     if (table_like_map.size() > 1000)
     {
@@ -583,7 +583,7 @@ void QueryFuzzer::addTableLike(const ASTPtr ast)
     }
 }
 
-void QueryFuzzer::addColumnLike(const ASTPtr ast)
+void QueryFuzzer::addColumnLike(ASTPtr ast)
 {
     if (column_like_map.size() > 1000)
     {
@@ -606,7 +606,7 @@ void QueryFuzzer::addColumnLike(const ASTPtr ast)
     }
 }
 
-void QueryFuzzer::collectFuzzInfoRecurse(const ASTPtr ast)
+void QueryFuzzer::collectFuzzInfoRecurse(ASTPtr ast)
 {
     if (auto * impl = dynamic_cast<ASTWithAlias *>(ast.get()))
     {

src/Client/QueryFuzzer.h

@@ -71,10 +71,10 @@ struct QueryFuzzer
     void fuzzWindowFrame(ASTWindowDefinition & def);
     void fuzz(ASTs & asts);
     void fuzz(ASTPtr & ast);
-    void collectFuzzInfoMain(const ASTPtr ast);
+    void collectFuzzInfoMain(ASTPtr ast);
-    void addTableLike(const ASTPtr ast);
+    void addTableLike(ASTPtr ast);
-    void addColumnLike(const ASTPtr ast);
+    void addColumnLike(ASTPtr ast);
-    void collectFuzzInfoRecurse(const ASTPtr ast);
+    void collectFuzzInfoRecurse(ASTPtr ast);
 };
 
 }

src/Columns/Collator.h

@@ -33,7 +33,7 @@ public:
 
 private:
     AvailableCollationLocales();
-private:
+
     AvailableLocalesMap locales_map;
 };
 

src/Columns/ColumnAggregateFunction.h

@@ -92,7 +92,7 @@ private:
     /// Create a new column that has another column as a source.
     MutablePtr createView() const;
 
-    ColumnAggregateFunction(const AggregateFunctionPtr & func_, std::optional<size_t> version_ = std::nullopt);
+    explicit ColumnAggregateFunction(const AggregateFunctionPtr & func_, std::optional<size_t> version_ = std::nullopt);
 
     ColumnAggregateFunction(const AggregateFunctionPtr & func_, const ConstArenas & arenas_);
 

src/Columns/ColumnArray.h

@@ -158,7 +158,7 @@ public:
 
     bool structureEquals(const IColumn & rhs) const override
     {
-        if (auto rhs_concrete = typeid_cast<const ColumnArray *>(&rhs))
+        if (const auto * rhs_concrete = typeid_cast<const ColumnArray *>(&rhs))
             return data->structureEquals(*rhs_concrete->data);
         return false;
     }

src/Columns/ColumnCompressed.h

@@ -126,7 +126,7 @@ protected:
     Lazy lazy;
 
 private:
-    [[noreturn]] void throwMustBeDecompressed() const
+    [[noreturn]] static void throwMustBeDecompressed()
     {
         throw Exception("ColumnCompressed must be decompressed before use", ErrorCodes::LOGICAL_ERROR);
     }

src/Columns/ColumnConst.h

@@ -163,7 +163,7 @@ public:
 
     const char * deserializeAndInsertFromArena(const char * pos) override
     {
-        auto res = data->deserializeAndInsertFromArena(pos);
+        const auto * res = data->deserializeAndInsertFromArena(pos);
         data->popBack(1);
         ++s;
         return res;
@@ -242,7 +242,7 @@ public:
 
     bool structureEquals(const IColumn & rhs) const override
     {
-        if (auto rhs_concrete = typeid_cast<const ColumnConst *>(&rhs))
+        if (const auto * rhs_concrete = typeid_cast<const ColumnConst *>(&rhs))
             return data->structureEquals(*rhs_concrete->data);
         return false;
     }

src/Columns/ColumnFixedString.h

@@ -41,9 +41,9 @@ private:
     using ComparatorEqual = ComparatorEqualImpl<ComparatorBase>;
 
     /** Create an empty column of strings of fixed-length `n` */
-    ColumnFixedString(size_t n_) : n(n_) {}
+    explicit ColumnFixedString(size_t n_) : n(n_) {}
 
-    ColumnFixedString(const ColumnFixedString & src) : chars(src.chars.begin(), src.chars.end()), n(src.n) {}
+    ColumnFixedString(const ColumnFixedString & src) : chars(src.chars.begin(), src.chars.end()), n(src.n) {} /// NOLINT
 
 public:
     std::string getName() const override { return "FixedString(" + std::to_string(n) + ")"; }
@@ -190,7 +190,7 @@ public:
 
     bool structureEquals(const IColumn & rhs) const override
     {
-        if (auto rhs_concrete = typeid_cast<const ColumnFixedString *>(&rhs))
+        if (const auto * rhs_concrete = typeid_cast<const ColumnFixedString *>(&rhs))
             return n == rhs_concrete->n;
         return false;
     }

src/Columns/ColumnFunction.cpp

@@ -24,7 +24,7 @@ namespace ErrorCodes
 }
 
 ColumnFunction::ColumnFunction(size_t size, FunctionBasePtr function_, const ColumnsWithTypeAndName & columns_to_capture, bool is_short_circuit_argument_, bool is_function_compiled_)
-        : size_(size), function(function_), is_short_circuit_argument(is_short_circuit_argument_), is_function_compiled(is_function_compiled_)
+        : elements_size(size), function(function_), is_short_circuit_argument(is_short_circuit_argument_), is_function_compiled(is_function_compiled_)
 {
     appendArguments(columns_to_capture);
 }
@@ -40,15 +40,15 @@ MutableColumnPtr ColumnFunction::cloneResized(size_t size) const
 
 ColumnPtr ColumnFunction::replicate(const Offsets & offsets) const
 {
-    if (size_ != offsets.size())
+    if (elements_size != offsets.size())
         throw Exception("Size of offsets (" + toString(offsets.size()) + ") doesn't match size of column ("
-                        + toString(size_) + ")", ErrorCodes::SIZES_OF_COLUMNS_DOESNT_MATCH);
+                        + toString(elements_size) + ")", ErrorCodes::SIZES_OF_COLUMNS_DOESNT_MATCH);
 
     ColumnsWithTypeAndName capture = captured_columns;
     for (auto & column : capture)
         column.column = column.column->replicate(offsets);
 
-    size_t replicated_size = 0 == size_ ? 0 : offsets.back();
+    size_t replicated_size = 0 == elements_size ? 0 : offsets.back();
     return ColumnFunction::create(replicated_size, function, capture, is_short_circuit_argument, is_function_compiled);
 }
 
@@ -75,7 +75,7 @@ void ColumnFunction::insertFrom(const IColumn & src, size_t n)
         captured_columns[i].column = std::move(mut_column);
     }
 
-    ++size_;
+    ++elements_size;
 }
 
 void ColumnFunction::insertRangeFrom(const IColumn & src, size_t start, size_t length)
@@ -92,14 +92,14 @@ void ColumnFunction::insertRangeFrom(const IColumn & src, size_t start, size_t l
         captured_columns[i].column = std::move(mut_column);
     }
 
-    size_ += length;
+    elements_size += length;
 }
 
 ColumnPtr ColumnFunction::filter(const Filter & filt, ssize_t result_size_hint) const
 {
-    if (size_ != filt.size())
+    if (elements_size != filt.size())
         throw Exception("Size of filter (" + toString(filt.size()) + ") doesn't match size of column ("
-                        + toString(size_) + ")", ErrorCodes::SIZES_OF_COLUMNS_DOESNT_MATCH);
+                        + toString(elements_size) + ")", ErrorCodes::SIZES_OF_COLUMNS_DOESNT_MATCH);
 
     ColumnsWithTypeAndName capture = captured_columns;
     for (auto & column : capture)
@@ -124,7 +124,7 @@ void ColumnFunction::expand(const Filter & mask, bool inverted)
         column.column->assumeMutable()->expand(mask, inverted);
     }
 
-    size_ = mask.size();
+    elements_size = mask.size();
 }
 
 ColumnPtr ColumnFunction::permute(const Permutation & perm, size_t limit) const
@@ -150,9 +150,9 @@ ColumnPtr ColumnFunction::index(const IColumn & indexes, size_t limit) const
 std::vector<MutableColumnPtr> ColumnFunction::scatter(IColumn::ColumnIndex num_columns,
                                                       const IColumn::Selector & selector) const
 {
-    if (size_ != selector.size())
+    if (elements_size != selector.size())
         throw Exception("Size of selector (" + toString(selector.size()) + ") doesn't match size of column ("
-                        + toString(size_) + ")", ErrorCodes::SIZES_OF_COLUMNS_DOESNT_MATCH);
+                        + toString(elements_size) + ")", ErrorCodes::SIZES_OF_COLUMNS_DOESNT_MATCH);
 
     std::vector<size_t> counts;
     if (captured_columns.empty())
@@ -266,7 +266,7 @@ ColumnWithTypeAndName ColumnFunction::reduce() const
     if (is_function_compiled)
         ProfileEvents::increment(ProfileEvents::CompiledFunctionExecute);
 
-    res.column = function->execute(columns, res.type, size_);
+    res.column = function->execute(columns, res.type, elements_size);
     return res;
 }
 

src/Columns/ColumnFunction.h

@@ -37,7 +37,7 @@ public:
 
     MutableColumnPtr cloneResized(size_t size) const override;
 
-    size_t size() const override { return size_; }
+    size_t size() const override { return elements_size; }
 
     ColumnPtr cut(size_t start, size_t length) const override;
     ColumnPtr replicate(const Offsets & offsets) const override;
@@ -178,7 +178,7 @@ public:
     DataTypePtr getResultType() const;
 
 private:
-    size_t size_;
+    size_t elements_size;
     FunctionBasePtr function;
     ColumnsWithTypeAndName captured_columns;