thevar1able/ClickHouse
1
0
Fork 0
mirror of https://github.com/ClickHouse/ClickHouse.git synced 2024-11-10 01:25:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

The command "SHOW CREATE ROW POLICY" now shows "AS permissive" or "AS restrictive" before "TO" clause.

Browse Source
This commit is contained in:
Vitaly Baranov 2022-02-17 00:20:26 +07:00
parent f4da321dbb
commit 4b9db33ad7
5 changed files with 70 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/Parsers/Access/ASTCreateRowPolicyQuery.cpp
View File

@ -156,11 +156,11 @@ void ASTCreateRowPolicyQuery::formatImpl(const FormatSettings & settings, Format
if (!new_short_name.empty())
formatRenameTo(new_short_name, settings);
formatForClauses(filters, alter, settings);
if (kind)
formatAsKind(*kind, settings);
formatForClauses(filters, alter, settings);
if (roles && (!roles->empty() || alter))
formatToRoles(*roles, settings);
}

2
tests/integration/test_disk_access_storage/test.py
View File

@ -42,7 +42,7 @@ def test_create():
assert instance.query(
"SHOW CREATE USER u2") == "CREATE USER u2 IDENTIFIED WITH sha256_password HOST LOCAL DEFAULT ROLE rx\n"
assert instance.query(
"SHOW CREATE ROW POLICY p ON mydb.mytable") == "CREATE ROW POLICY p ON mydb.mytable AS permissive FOR SELECT USING a < 1000 TO u1, u2\n"
"SHOW CREATE ROW POLICY p ON mydb.mytable") == "CREATE ROW POLICY p ON mydb.mytable FOR SELECT USING a < 1000 AS permissive TO u1, u2\n"
assert instance.query(
"SHOW CREATE QUOTA q") == "CREATE QUOTA q FOR INTERVAL 1 hour MAX queries = 100 TO ALL EXCEPT rx\n"
assert instance.query("SHOW GRANTS FOR u1") == ""

90
tests/integration/test_row_policy/test.py
View File

@ -292,49 +292,49 @@ def test_dcl_introspection():
"default ON mydb.local"])
assert node.query(
"SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 AS permissive FOR SELECT USING a = 1 TO default\n"
"SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default\n"
assert node.query(
"SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 AS permissive FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) TO default\n"
"SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) AS permissive TO default\n"
assert node.query(
"SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 AS permissive FOR SELECT USING c = 1 TO default\n"
"SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 AS permissive TO default\n"
assert node.query(
"SHOW CREATE POLICY default ON mydb.local") == "CREATE ROW POLICY default ON mydb.local AS permissive FOR SELECT USING 1 TO default\n"
"SHOW CREATE POLICY default ON mydb.local") == "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 AS permissive TO default\n"
assert node.query("SHOW CREATE POLICY default") == TSV(
["CREATE ROW POLICY default ON mydb.filtered_table1 AS permissive FOR SELECT USING a = 1 TO default",
"CREATE ROW POLICY default ON mydb.filtered_table2 AS permissive FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) TO default",
"CREATE ROW POLICY default ON mydb.filtered_table3 AS permissive FOR SELECT USING c = 1 TO default",
"CREATE ROW POLICY default ON mydb.local AS permissive FOR SELECT USING 1 TO default"])
["CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default",
"CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) AS permissive TO default",
"CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 AS permissive TO default",
"CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 AS permissive TO default"])
assert node.query("SHOW CREATE POLICIES ON mydb.filtered_table1") == TSV(
["CREATE ROW POLICY another ON mydb.filtered_table1 AS permissive FOR SELECT USING 1 TO another",
"CREATE ROW POLICY default ON mydb.filtered_table1 AS permissive FOR SELECT USING a = 1 TO default"])
["CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 AS permissive TO another",
"CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default"])
assert node.query("SHOW CREATE POLICIES ON mydb.*") == TSV(
["CREATE ROW POLICY another ON mydb.filtered_table1 AS permissive FOR SELECT USING 1 TO another",
"CREATE ROW POLICY another ON mydb.filtered_table2 AS permissive FOR SELECT USING 1 TO another",
"CREATE ROW POLICY another ON mydb.filtered_table3 AS permissive FOR SELECT USING 1 TO another",
"CREATE ROW POLICY another ON mydb.local AS permissive FOR SELECT USING a = 1 TO another",
"CREATE ROW POLICY default ON mydb.filtered_table1 AS permissive FOR SELECT USING a = 1 TO default",
"CREATE ROW POLICY default ON mydb.filtered_table2 AS permissive FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) TO default",
"CREATE ROW POLICY default ON mydb.filtered_table3 AS permissive FOR SELECT USING c = 1 TO default",
"CREATE ROW POLICY default ON mydb.local AS permissive FOR SELECT USING 1 TO default"])
["CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 AS permissive TO another",
"CREATE ROW POLICY another ON mydb.filtered_table2 FOR SELECT USING 1 AS permissive TO another",
"CREATE ROW POLICY another ON mydb.filtered_table3 FOR SELECT USING 1 AS permissive TO another",
"CREATE ROW POLICY another ON mydb.local FOR SELECT USING a = 1 AS permissive TO another",
"CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default",
"CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) AS permissive TO default",
"CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 AS permissive TO default",
"CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 AS permissive TO default"])
assert node.query("SHOW CREATE POLICIES") == TSV(
["CREATE ROW POLICY another ON mydb.filtered_table1 AS permissive FOR SELECT USING 1 TO another",
"CREATE ROW POLICY another ON mydb.filtered_table2 AS permissive FOR SELECT USING 1 TO another",
"CREATE ROW POLICY another ON mydb.filtered_table3 AS permissive FOR SELECT USING 1 TO another",
"CREATE ROW POLICY another ON mydb.local AS permissive FOR SELECT USING a = 1 TO another",
"CREATE ROW POLICY default ON mydb.filtered_table1 AS permissive FOR SELECT USING a = 1 TO default",
"CREATE ROW POLICY default ON mydb.filtered_table2 AS permissive FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) TO default",
"CREATE ROW POLICY default ON mydb.filtered_table3 AS permissive FOR SELECT USING c = 1 TO default",
"CREATE ROW POLICY default ON mydb.local AS permissive FOR SELECT USING 1 TO default"])
["CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 AS permissive TO another",
"CREATE ROW POLICY another ON mydb.filtered_table2 FOR SELECT USING 1 AS permissive TO another",
"CREATE ROW POLICY another ON mydb.filtered_table3 FOR SELECT USING 1 AS permissive TO another",
"CREATE ROW POLICY another ON mydb.local FOR SELECT USING a = 1 AS permissive TO another",
"CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default",
"CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) AS permissive TO default",
"CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 AS permissive TO default",
"CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 AS permissive TO default"])
expected_access = "CREATE ROW POLICY another ON mydb.filtered_table1 AS permissive FOR SELECT USING 1 TO another\n" \
"CREATE ROW POLICY another ON mydb.filtered_table2 AS permissive FOR SELECT USING 1 TO another\n" \
"CREATE ROW POLICY another ON mydb.filtered_table3 AS permissive FOR SELECT USING 1 TO another\n" \
"CREATE ROW POLICY another ON mydb.local AS permissive FOR SELECT USING a = 1 TO another\n" \
"CREATE ROW POLICY default ON mydb.filtered_table1 AS permissive FOR SELECT USING a = 1 TO default\n" \
"CREATE ROW POLICY default ON mydb.filtered_table2 AS permissive FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) TO default\n" \
"CREATE ROW POLICY default ON mydb.filtered_table3 AS permissive FOR SELECT USING c = 1 TO default\n" \
"CREATE ROW POLICY default ON mydb.local AS permissive FOR SELECT USING 1 TO default\n"
expected_access = "CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 AS permissive TO another\n" \
"CREATE ROW POLICY another ON mydb.filtered_table2 FOR SELECT USING 1 AS permissive TO another\n" \
"CREATE ROW POLICY another ON mydb.filtered_table3 FOR SELECT USING 1 AS permissive TO another\n" \
"CREATE ROW POLICY another ON mydb.local FOR SELECT USING a = 1 AS permissive TO another\n" \
"CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default\n" \
"CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) AS permissive TO default\n" \
"CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 AS permissive TO default\n" \
"CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 AS permissive TO default\n"
assert expected_access in node.query("SHOW ACCESS")
copy_policy_xml('all_rows.xml')
@ -342,22 +342,22 @@ def test_dcl_introspection():
["another ON mydb.filtered_table1", "another ON mydb.filtered_table2", "another ON mydb.filtered_table3",
"default ON mydb.filtered_table1", "default ON mydb.filtered_table2", "default ON mydb.filtered_table3"])
assert node.query(
"SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 AS permissive FOR SELECT USING 1 TO default\n"
"SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING 1 AS permissive TO default\n"
assert node.query(
"SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 AS permissive FOR SELECT USING 1 TO default\n"
"SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING 1 AS permissive TO default\n"
assert node.query(
"SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 AS permissive FOR SELECT USING 1 TO default\n"
"SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING 1 AS permissive TO default\n"
copy_policy_xml('no_rows.xml')
assert node.query("SHOW POLICIES") == TSV(
["another ON mydb.filtered_table1", "another ON mydb.filtered_table2", "another ON mydb.filtered_table3",
"default ON mydb.filtered_table1", "default ON mydb.filtered_table2", "default ON mydb.filtered_table3"])
assert node.query(
"SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 AS permissive FOR SELECT USING NULL TO default\n"
"SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING NULL AS permissive TO default\n"
assert node.query(
"SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 AS permissive FOR SELECT USING NULL TO default\n"
"SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING NULL AS permissive TO default\n"
assert node.query(
"SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 AS permissive FOR SELECT USING NULL TO default\n"
"SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING NULL AS permissive TO default\n"
copy_policy_xml('no_filters.xml')
assert node.query("SHOW POLICIES") == ""
@ -382,7 +382,7 @@ def test_dcl_management():
assert node.query("SELECT * FROM mydb.filtered_table1") == TSV([[1, 0]])
assert node.query("SHOW POLICIES ON mydb.filtered_table1") == "pB\n"
assert node.query(
"SHOW CREATE POLICY pB ON mydb.filtered_table1") == "CREATE ROW POLICY pB ON mydb.filtered_table1 AS permissive FOR SELECT USING a > b TO default\n"
"SHOW CREATE POLICY pB ON mydb.filtered_table1") == "CREATE ROW POLICY pB ON mydb.filtered_table1 FOR SELECT USING a > b AS permissive TO default\n"
node.query("DROP POLICY pB ON mydb.filtered_table1")
assert node.query("SELECT * FROM mydb.filtered_table1") == TSV([[0, 0], [0, 1], [1, 0], [1, 1]])
@ -448,10 +448,10 @@ def test_tags_with_db_and_table_names():
assert node.query("SELECT * FROM mydb.`.filtered_table4`") == TSV([[1, 1]])
assert node.query("SHOW CREATE POLICIES default") == TSV(
["CREATE ROW POLICY default ON mydb.`.filtered_table4` AS permissive FOR SELECT USING c = 2 TO default",
"CREATE ROW POLICY default ON mydb.filtered_table2 AS permissive FOR SELECT USING c > (d + 5) TO default",
"CREATE ROW POLICY default ON mydb.filtered_table3 AS permissive FOR SELECT USING c = 0 TO default",
"CREATE ROW POLICY default ON mydb.table AS permissive FOR SELECT USING a = 0 TO default"])
["CREATE ROW POLICY default ON mydb.`.filtered_table4` FOR SELECT USING c = 2 AS permissive TO default",
"CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING c > (d + 5) AS permissive TO default",
"CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 0 AS permissive TO default",
"CREATE ROW POLICY default ON mydb.table FOR SELECT USING a = 0 AS permissive TO default"])
def test_miscellaneous_engines():

20
tests/queries/0_stateless/01295_create_row_policy.reference
View File

@ -6,10 +6,10 @@ CREATE ROW POLICY p3_01295 ON db.table AS permissive
-- rename
CREATE ROW POLICY p2_01295_renamed ON db.table AS permissive
-- filter
CREATE ROW POLICY p1_01295 ON db.table AS permissive FOR SELECT USING (a < b) AND (c > d)
CREATE ROW POLICY p2_01295 ON db.table AS restrictive FOR SELECT USING id = currentUser()
CREATE ROW POLICY p3_01295 ON db.table AS permissive FOR SELECT USING 1
CREATE ROW POLICY p1_01295 ON db.table AS restrictive FOR SELECT USING 0
CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING (a < b) AND (c > d) AS permissive
CREATE ROW POLICY p2_01295 ON db.table FOR SELECT USING id = currentUser() AS restrictive
CREATE ROW POLICY p3_01295 ON db.table FOR SELECT USING 1 AS permissive
CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING 0 AS restrictive
-- to roles
CREATE ROW POLICY p1_01295 ON db.table AS permissive
CREATE ROW POLICY p2_01295 ON db.table AS permissive TO ALL
@ -21,14 +21,14 @@ CREATE ROW POLICY p7_01295 ON db.table AS permissive TO ALL EXCEPT r1_01295, u1_
CREATE ROW POLICY p1_01295 ON db.table AS permissive TO u1_01295
CREATE ROW POLICY p2_01295 ON db.table AS permissive
-- multiple policies in one command
CREATE ROW POLICY p1_01295 ON db.table AS permissive FOR SELECT USING 1
CREATE ROW POLICY p2_01295 ON db.table AS permissive FOR SELECT USING 1
CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING 1 AS permissive
CREATE ROW POLICY p2_01295 ON db.table FOR SELECT USING 1 AS permissive
CREATE ROW POLICY p3_01295 ON db.table AS permissive TO u1_01295
CREATE ROW POLICY p3_01295 ON db2.table2 AS permissive TO u1_01295
CREATE ROW POLICY p4_01295 ON db.table AS permissive FOR SELECT USING a = b
CREATE ROW POLICY p5_01295 ON db2.table2 AS permissive FOR SELECT USING a = b
CREATE ROW POLICY p1_01295 ON db.table AS permissive FOR SELECT USING 1 TO ALL
CREATE ROW POLICY p2_01295 ON db.table AS permissive FOR SELECT USING 1 TO ALL
CREATE ROW POLICY p4_01295 ON db.table FOR SELECT USING a = b AS permissive
CREATE ROW POLICY p5_01295 ON db2.table2 FOR SELECT USING a = b AS permissive
CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING 1 AS permissive TO ALL
CREATE ROW POLICY p2_01295 ON db.table FOR SELECT USING 1 AS permissive TO ALL
-- system.row_policies
p1_01295 ON db.table p1_01295 db table local directory (a < b) AND (c > d) permissive 0 [] []
p2_01295 ON db.table p2_01295 db table local directory id = currentUser() restrictive 0 ['u1_01295'] []

24
tests/queries/0_stateless/01296_create_row_policy_in_current_database.reference
View File

@ -1,20 +1,20 @@
-- one policy
CREATE ROW POLICY p1_01296 ON db_01296.table AS permissive
CREATE ROW POLICY p1_01296 ON db_01296.table AS permissive
CREATE ROW POLICY p1_01296 ON db_01296.table AS permissive FOR SELECT USING 1
CREATE ROW POLICY p1_01296 ON db_01296.table AS permissive FOR SELECT USING 1
CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
-- multiple policies
CREATE ROW POLICY p1_01296 ON db_01296.table AS permissive FOR SELECT USING 1
CREATE ROW POLICY p2_01296 ON db_01296.table AS permissive FOR SELECT USING 1
CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
CREATE ROW POLICY p2_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
CREATE ROW POLICY p3_01296 ON db_01296.table AS permissive TO u1_01296
CREATE ROW POLICY p3_01296 ON db_01296.table2 AS permissive TO u1_01296
CREATE ROW POLICY p4_01296 ON db_01296.table AS permissive FOR SELECT USING a = b
CREATE ROW POLICY p5_01296 ON db_01296.table2 AS permissive FOR SELECT USING a = b
CREATE ROW POLICY p1_01296 ON db_01296.table AS permissive FOR SELECT USING 1
CREATE ROW POLICY p2_01296 ON db_01296.table AS permissive FOR SELECT USING 1
CREATE ROW POLICY p4_01296 ON db_01296.table FOR SELECT USING a = b AS permissive
CREATE ROW POLICY p5_01296 ON db_01296.table2 FOR SELECT USING a = b AS permissive
CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
CREATE ROW POLICY p2_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
CREATE ROW POLICY p3_01296 ON db_01296.table AS permissive TO u1_01296
CREATE ROW POLICY p3_01296 ON db_01296.table2 AS permissive TO u1_01296
CREATE ROW POLICY p4_01296 ON db_01296.table AS permissive FOR SELECT USING a = b
CREATE ROW POLICY p5_01296 ON db_01296.table2 AS permissive FOR SELECT USING a = b
CREATE ROW POLICY p1_01296 ON db_01296.table AS permissive FOR SELECT USING 1 TO ALL
CREATE ROW POLICY p2_01296 ON db_01296.table AS permissive FOR SELECT USING 1 TO ALL
CREATE ROW POLICY p4_01296 ON db_01296.table FOR SELECT USING a = b AS permissive
CREATE ROW POLICY p5_01296 ON db_01296.table2 FOR SELECT USING a = b AS permissive
CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 AS permissive TO ALL
CREATE ROW POLICY p2_01296 ON db_01296.table FOR SELECT USING 1 AS permissive TO ALL