Merge pull request #34596 from vitlibar/allow-restrictive-without-permissive

Allow restrictive row policies without permissive

src/Access/Common/RowPolicyDefs.cpp

@@ -78,4 +78,35 @@ const RowPolicyFilterTypeInfo & RowPolicyFilterTypeInfo::get(RowPolicyFilterType
     throw Exception("Unknown type: " + std::to_string(static_cast<size_t>(type_)), ErrorCodes::LOGICAL_ERROR);
 }
 
+String toString(RowPolicyKind kind)
+{
+    return RowPolicyKindInfo::get(kind).raw_name;
+}
+
+const RowPolicyKindInfo & RowPolicyKindInfo::get(RowPolicyKind kind_)
+{
+    static constexpr auto make_info = [](const char * raw_name_)
+    {
+        String init_name = raw_name_;
+        boost::to_lower(init_name);
+        return RowPolicyKindInfo{raw_name_, std::move(init_name)};
+    };
+
+    switch (kind_)
+    {
+        case RowPolicyKind::PERMISSIVE:
+        {
+            static const auto info = make_info("PERMISSIVE");
+            return info;
+        }
+        case RowPolicyKind::RESTRICTIVE:
+        {
+            static const auto info = make_info("RESTRICTIVE");
+            return info;
+        }
+        case RowPolicyKind::MAX: break;
+    }
+    throw Exception("Unknown kind: " + std::to_string(static_cast<size_t>(kind_)), ErrorCodes::LOGICAL_ERROR);
+}
+
 }

src/Access/Common/RowPolicyDefs.h

@@ -54,4 +54,25 @@ struct RowPolicyFilterTypeInfo
     static const RowPolicyFilterTypeInfo & get(RowPolicyFilterType type);
 };
 
+
+/// Kinds of row policies. It affects how row policies are applied.
+/// A row is only accessible if at least one of the permissive policies passes,
+/// in addition to all the restrictive policies.
+enum class RowPolicyKind
+{
+    PERMISSIVE,
+    RESTRICTIVE,
+
+    MAX,
+};
+
+String toString(RowPolicyKind kind);
+
+struct RowPolicyKindInfo
+{
+    const char * const raw_name;
+    const String name;    /// Lowercased with underscores, e.g. "permissive".
+    static const RowPolicyKindInfo & get(RowPolicyKind kind);
+};
+
 }

src/Access/RowPolicy.cpp

@@ -55,7 +55,7 @@ bool RowPolicy::equal(const IAccessEntity & other) const
         return false;
     const auto & other_policy = typeid_cast<const RowPolicy &>(other);
     return (full_name == other_policy.full_name) && boost::range::equal(filters, other_policy.filters)
-        && restrictive == other_policy.restrictive && (to_roles == other_policy.to_roles);
+        && (kind == other_policy.kind) && (to_roles == other_policy.to_roles);
 }
 
 }

src/Access/RowPolicy.h

@@ -29,17 +29,9 @@ struct RowPolicy : public IAccessEntity
     /// for user or available for modification.
     std::array<String, static_cast<size_t>(RowPolicyFilterType::MAX)> filters;
 
-    /// Sets that the policy is permissive.
+    /// Sets the kind of the policy, it affects how row policies are applied.
-    /// A row is only accessible if at least one of the permissive policies passes,
+    void setKind(RowPolicyKind kind_) { kind = kind_; }
-    /// in addition to all the restrictive policies.
+    RowPolicyKind getKind() const { return kind; }
-    void setPermissive(bool permissive_ = true) { setRestrictive(!permissive_); }
-    bool isPermissive() const { return !isRestrictive(); }
-
-    /// Sets that the policy is restrictive.
-    /// A row is only accessible if at least one of the permissive policies passes,
-    /// in addition to all the restrictive policies.
-    void setRestrictive(bool restrictive_ = true) { restrictive = restrictive_; }
-    bool isRestrictive() const { return restrictive; }
 
     bool equal(const IAccessEntity & other) const override;
     std::shared_ptr<IAccessEntity> clone() const override { return cloneImpl<RowPolicy>(); }
@@ -53,7 +45,7 @@ private:
     void setName(const String &) override;
 
     RowPolicyName full_name;
-    bool restrictive = false;
+    RowPolicyKind kind = RowPolicyKind::PERMISSIVE;
 };
 
 using RowPolicyPtr = std::shared_ptr<const RowPolicy>;

src/Access/RowPolicyCache.cpp

@@ -20,21 +20,34 @@ namespace
     class FiltersMixer
     {
     public:
-        void add(const ASTPtr & filter, bool is_restrictive)
+        void add(const ASTPtr & filter, RowPolicyKind kind)
         {
-            if (is_restrictive)
+            if (kind == RowPolicyKind::PERMISSIVE)
-                restrictions.push_back(filter);
+            {
+                setPermissiveFiltersExist();
+                permissive_filters.push_back(filter);
+            }
             else
-                permissions.push_back(filter);
+            {
+                restrictive_filters.push_back(filter);
+            }
+        }
+
+        void setPermissiveFiltersExist()
+        {
+            permissive_filters_exist = true;
         }
 
         ASTPtr getResult() &&
         {
-            /// Process permissive filters.
+            if (permissive_filters_exist)
-            restrictions.push_back(makeASTForLogicalOr(std::move(permissions)));
+            {
+                /// Process permissive filters.
+                restrictive_filters.push_back(makeASTForLogicalOr(std::move(permissive_filters)));
+            }
 
             /// Process restrictive filters.
-            auto result = makeASTForLogicalAnd(std::move(restrictions));
+            auto result = makeASTForLogicalAnd(std::move(restrictive_filters));
 
             bool value;
             if (tryGetLiteralBool(result.get(), value) && value)
@@ -44,8 +57,9 @@ namespace
         }
 
     private:
-        ASTs permissions;
+        ASTs permissive_filters;
-        ASTs restrictions;
+        bool permissive_filters_exist = false;
+        ASTs restrictive_filters;
     };
 }
 
@@ -223,8 +237,13 @@ void RowPolicyCache::mixFiltersFor(EnabledRowPolicies & enabled)
                 key.filter_type = filter_type;
                 auto & mixer = mixers[key];
                 mixer.database_and_table_name = info.database_and_table_name;
+                if (policy.getKind() == RowPolicyKind::PERMISSIVE)
+                {
+                    /// We call setPermissiveFiltersExist() even if the current user doesn't match to the current policy's TO clause.
+                    mixer.mixer.setPermissiveFiltersExist();
+                }
                 if (match)
-                    mixer.mixer.add(info.parsed_filters[filter_type_i], policy.isRestrictive());
+                    mixer.mixer.add(info.parsed_filters[filter_type_i], policy.getKind());
             }
         }
     }

src/Interpreters/Access/InterpreterCreateRowPolicyQuery.cpp

@@ -29,8 +29,8 @@ namespace
         else if (query.names->full_names.size() == 1)
             policy.setFullName(query.names->full_names.front());
 
-        if (query.is_restrictive)
+        if (query.kind)
-            policy.setRestrictive(*query.is_restrictive);
+            policy.setKind(*query.kind);
 
         for (const auto & [filter_type, filter] : query.filters)
             policy.filters[static_cast<size_t>(filter_type)] = filter ? serializeAST(*filter) : String{};

src/Interpreters/Access/InterpreterShowCreateAccessEntityQuery.cpp

@@ -189,9 +189,7 @@ namespace
         query->names = std::make_shared<ASTRowPolicyNames>();
         query->names->full_names.emplace_back(policy.getFullName());
         query->attach = attach_mode;
-
+        query->kind = policy.getKind();
-        if (policy.isRestrictive())
-            query->is_restrictive = policy.isRestrictive();
 
         for (auto type : collections::range(RowPolicyFilterType::MAX))
         {

src/Parsers/Access/ASTCreateRowPolicyQuery.cpp

@@ -20,10 +20,10 @@ namespace
     }
 
 
-    void formatAsRestrictiveOrPermissive(bool is_restrictive, const IAST::FormatSettings & settings)
+    void formatAsKind(RowPolicyKind kind, const IAST::FormatSettings & settings)
     {
         settings.ostr << (settings.hilite ? IAST::hilite_keyword : "") << " AS " << (settings.hilite ? IAST::hilite_none : "")
-                      << (is_restrictive ? "restrictive" : "permissive");
+                      << RowPolicyKindInfo::get(kind).name;
     }
 
 
@@ -156,11 +156,11 @@ void ASTCreateRowPolicyQuery::formatImpl(const FormatSettings & settings, Format
     if (!new_short_name.empty())
         formatRenameTo(new_short_name, settings);
 
-    if (is_restrictive)
-        formatAsRestrictiveOrPermissive(*is_restrictive, settings);
-
     formatForClauses(filters, alter, settings);
 
+    if (kind)
+        formatAsKind(*kind, settings);
+
     if (roles && (!roles->empty() || alter))
         formatToRoles(*roles, settings);
 }

src/Parsers/Access/ASTCreateRowPolicyQuery.h

@@ -39,7 +39,7 @@ public:
     std::shared_ptr<ASTRowPolicyNames> names;
     String new_short_name;
 
-    std::optional<bool> is_restrictive;
+    std::optional<RowPolicyKind> kind;
     std::vector<std::pair<RowPolicyFilterType, ASTPtr>> filters; /// `nullptr` means set to NONE.
 
     std::shared_ptr<ASTRolesOrUsersSet> roles;

src/Parsers/Access/ParserCreateRowPolicyQuery.cpp

@@ -29,24 +29,24 @@ namespace
         });
     }
 
-    bool parseAsRestrictiveOrPermissive(IParserBase::Pos & pos, Expected & expected, bool & is_restrictive)
+    bool parseAsKind(IParserBase::Pos & pos, Expected & expected, RowPolicyKind & kind)
     {
         return IParserBase::wrapParseImpl(pos, [&]
         {
             if (!ParserKeyword{"AS"}.ignore(pos, expected))
                 return false;
 
-            if (ParserKeyword{"RESTRICTIVE"}.ignore(pos, expected))
+            for (auto current_kind : collections::range(RowPolicyKind::MAX))
             {
-                is_restrictive = true;
+                const std::string_view & kind_name = RowPolicyKindInfo::get(current_kind).name;
-                return true;
+                if (ParserKeyword{kind_name.data()}.ignore(pos, expected))
+                {
+                    kind = current_kind;
+                    return true;
+                }
             }
 
-            if (!ParserKeyword{"PERMISSIVE"}.ignore(pos, expected))
+            return false;
-                return false;
-
-            is_restrictive = false;
-            return true;
         });
     }
 
@@ -243,7 +243,7 @@ bool ParserCreateRowPolicyQuery::parseImpl(Pos & pos, ASTPtr & node, Expected &
     String cluster = std::exchange(names->cluster, "");
 
     String new_short_name;
-    std::optional<bool> is_restrictive;
+    std::optional<RowPolicyKind> kind;
     std::vector<std::pair<RowPolicyFilterType, ASTPtr>> filters;
 
     while (true)
@@ -251,12 +251,12 @@ bool ParserCreateRowPolicyQuery::parseImpl(Pos & pos, ASTPtr & node, Expected &
         if (alter && (names->full_names.size() == 1) && new_short_name.empty() && parseRenameTo(pos, expected, new_short_name))
             continue;
 
-        if (!is_restrictive)
+        if (!kind)
         {
-            bool new_is_restrictive;
+            RowPolicyKind new_kind;
-            if (parseAsRestrictiveOrPermissive(pos, expected, new_is_restrictive))
+            if (parseAsKind(pos, expected, new_kind))
             {
-                is_restrictive = new_is_restrictive;
+                kind = new_kind;
                 continue;
             }
         }
@@ -291,7 +291,7 @@ bool ParserCreateRowPolicyQuery::parseImpl(Pos & pos, ASTPtr & node, Expected &
     query->cluster = std::move(cluster);
     query->names = std::move(names);
     query->new_short_name = std::move(new_short_name);
-    query->is_restrictive = is_restrictive;
+    query->kind = kind;
     query->filters = std::move(filters);
     query->roles = std::move(roles);
 

src/Storages/System/StorageSystemRowPolicies.cpp

@@ -10,6 +10,7 @@
 #include <DataTypes/DataTypesNumber.h>
 #include <DataTypes/DataTypeUUID.h>
 #include <DataTypes/DataTypeNullable.h>
+#include <DataTypes/DataTypeEnum.h>
 #include <DataTypes/DataTypeArray.h>
 #include <Interpreters/Context.h>
 #include <Parsers/Access/ASTRolesOrUsersSet.h>
@@ -19,6 +20,26 @@
 
 namespace DB
 {
+
+namespace
+{
+    const std::vector<std::pair<String, Int8>> & getRowPolicyKindEnumValues()
+    {
+        static const std::vector<std::pair<String, Int8>> values = []
+        {
+            std::vector<std::pair<String, Int8>> res;
+            for (auto kind : collections::range(RowPolicyKind::MAX))
+            {
+                const std::string_view & kind_name = RowPolicyKindInfo::get(kind).name;
+                res.emplace_back(kind_name, static_cast<Int8>(kind));
+            }
+            return res;
+        }();
+        return values;
+    }
+}
+
+
 NamesAndTypesList StorageSystemRowPolicies::getNamesAndTypes()
 {
     NamesAndTypesList names_and_types{
@@ -37,7 +58,7 @@ NamesAndTypesList StorageSystemRowPolicies::getNamesAndTypes()
     }
 
     NamesAndTypesList extra_names_and_types{
-        {"is_restrictive", std::make_shared<DataTypeUInt8>()},
+        {"kind", std::make_shared<DataTypeEnum8>(getRowPolicyKindEnumValues())},
         {"apply_to_all", std::make_shared<DataTypeUInt8>()},
         {"apply_to_list", std::make_shared<DataTypeArray>(std::make_shared<DataTypeString>())},
         {"apply_to_except", std::make_shared<DataTypeArray>(std::make_shared<DataTypeString>())}
@@ -71,7 +92,7 @@ void StorageSystemRowPolicies::fillData(MutableColumns & res_columns, ContextPtr
         column_filter_null_map[filter_type_i] = &assert_cast<ColumnNullable &>(*res_columns[column_index++]).getNullMapData();
     }
 
-    auto & column_is_restrictive = assert_cast<ColumnUInt8 &>(*res_columns[column_index++]).getData();
+    auto & column_kind = assert_cast<ColumnInt8 &>(*res_columns[column_index++]).getData();
     auto & column_apply_to_all = assert_cast<ColumnUInt8 &>(*res_columns[column_index++]).getData();
     auto & column_apply_to_list = assert_cast<ColumnString &>(assert_cast<ColumnArray &>(*res_columns[column_index]).getData());
     auto & column_apply_to_list_offsets = assert_cast<ColumnArray &>(*res_columns[column_index++]).getOffsets();
@@ -83,7 +104,7 @@ void StorageSystemRowPolicies::fillData(MutableColumns & res_columns, ContextPtr
                        const UUID & id,
                        const String & storage_name,
                        const std::array<String, static_cast<size_t>(RowPolicyFilterType::MAX)> & filters,
-                       bool is_restrictive,
+                       RowPolicyKind kind,
                        const RolesOrUsersSet & apply_to)
     {
         column_name.insertData(name.data(), name.length());
@@ -109,7 +130,7 @@ void StorageSystemRowPolicies::fillData(MutableColumns & res_columns, ContextPtr
             }
         }
 
-        column_is_restrictive.push_back(is_restrictive);
+        column_kind.push_back(static_cast<Int8>(kind));
 
         auto apply_to_ast = apply_to.toASTWithNames(access_control);
         column_apply_to_all.push_back(apply_to_ast->all);
@@ -132,7 +153,7 @@ void StorageSystemRowPolicies::fillData(MutableColumns & res_columns, ContextPtr
         if (!storage)
             continue;
 
-        add_row(policy->getName(), policy->getFullName(), id, storage->getStorageName(), policy->filters, policy->isRestrictive(), policy->to_roles);
+        add_row(policy->getName(), policy->getFullName(), id, storage->getStorageName(), policy->filters, policy->getKind(), policy->to_roles);
     }
 }
 }

tests/integration/test_disk_access_storage/test.py

@@ -42,7 +42,7 @@ def test_create():
         assert instance.query(
             "SHOW CREATE USER u2") == "CREATE USER u2 IDENTIFIED WITH sha256_password HOST LOCAL DEFAULT ROLE rx\n"
         assert instance.query(
-            "SHOW CREATE ROW POLICY p ON mydb.mytable") == "CREATE ROW POLICY p ON mydb.mytable FOR SELECT USING a < 1000 TO u1, u2\n"
+            "SHOW CREATE ROW POLICY p ON mydb.mytable") == "CREATE ROW POLICY p ON mydb.mytable FOR SELECT USING a < 1000 AS permissive TO u1, u2\n"
         assert instance.query(
             "SHOW CREATE QUOTA q") == "CREATE QUOTA q FOR INTERVAL 1 hour MAX queries = 100 TO ALL EXCEPT rx\n"
         assert instance.query("SHOW GRANTS FOR u1") == ""

tests/integration/test_row_policy/test.py

@@ -256,21 +256,21 @@ def test_reload_users_xml_by_timer():
 def test_introspection():
     policies = [
         ["another ON mydb.filtered_table1", "another", "mydb", "filtered_table1",
-         "6068883a-0e9d-f802-7e22-0144f8e66d3c", "users.xml", "1", 0, 0, "['another']", "[]"],
+         "6068883a-0e9d-f802-7e22-0144f8e66d3c", "users.xml", "1", "permissive", 0, "['another']", "[]"],
         ["another ON mydb.filtered_table2", "another", "mydb", "filtered_table2",
-         "c019e957-c60b-d54e-cc52-7c90dac5fb01", "users.xml", "1", 0, 0, "['another']", "[]"],
+         "c019e957-c60b-d54e-cc52-7c90dac5fb01", "users.xml", "1", "permissive", 0, "['another']", "[]"],
         ["another ON mydb.filtered_table3", "another", "mydb", "filtered_table3",
-         "4cb080d0-44e8-dbef-6026-346655143628", "users.xml", "1", 0, 0, "['another']", "[]"],
+         "4cb080d0-44e8-dbef-6026-346655143628", "users.xml", "1", "permissive", 0, "['another']", "[]"],
         ["another ON mydb.local", "another", "mydb", "local", "5b23c389-7e18-06bf-a6bc-dd1afbbc0a97", "users.xml",
-         "a = 1", 0, 0, "['another']", "[]"],
+         "a = 1", "permissive", 0, "['another']", "[]"],
         ["default ON mydb.filtered_table1", "default", "mydb", "filtered_table1",
-         "9e8a8f62-4965-2b5e-8599-57c7b99b3549", "users.xml", "a = 1", 0, 0, "['default']", "[]"],
+         "9e8a8f62-4965-2b5e-8599-57c7b99b3549", "users.xml", "a = 1", "permissive", 0, "['default']", "[]"],
         ["default ON mydb.filtered_table2", "default", "mydb", "filtered_table2",
-         "cffae79d-b9bf-a2ef-b798-019c18470b25", "users.xml", "a + b < 1 or c - d > 5", 0, 0, "['default']", "[]"],
+         "cffae79d-b9bf-a2ef-b798-019c18470b25", "users.xml", "a + b < 1 or c - d > 5", "permissive", 0, "['default']", "[]"],
         ["default ON mydb.filtered_table3", "default", "mydb", "filtered_table3",
-         "12fc5cef-e3da-3940-ec79-d8be3911f42b", "users.xml", "c = 1", 0, 0, "['default']", "[]"],
+         "12fc5cef-e3da-3940-ec79-d8be3911f42b", "users.xml", "c = 1", "permissive", 0, "['default']", "[]"],
         ["default ON mydb.local", "default", "mydb", "local", "cdacaeb5-1d97-f99d-2bb0-4574f290629c", "users.xml", "1",
-         0, 0, "['default']", "[]"]
+         "permissive", 0, "['default']", "[]"]
     ]
     assert node.query("SELECT * from system.row_policies ORDER BY short_name, database, table") == TSV(policies)
 
@@ -292,49 +292,49 @@ def test_dcl_introspection():
          "default ON mydb.local"])
 
     assert node.query(
-        "SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 TO default\n"
+        "SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default\n"
     assert node.query(
-        "SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) TO default\n"
+        "SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) AS permissive TO default\n"
     assert node.query(
-        "SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 TO default\n"
+        "SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 AS permissive TO default\n"
     assert node.query(
-        "SHOW CREATE POLICY default ON mydb.local") == "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 TO default\n"
+        "SHOW CREATE POLICY default ON mydb.local") == "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 AS permissive TO default\n"
 
     assert node.query("SHOW CREATE POLICY default") == TSV(
-        ["CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 TO default",
+        ["CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) TO default",
+         "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 TO default",
+         "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 TO default"])
+         "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 AS permissive TO default"])
     assert node.query("SHOW CREATE POLICIES ON mydb.filtered_table1") == TSV(
-        ["CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 TO another",
+        ["CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 AS permissive TO another",
-         "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 TO default"])
+         "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default"])
     assert node.query("SHOW CREATE POLICIES ON mydb.*") == TSV(
-        ["CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 TO another",
+        ["CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 AS permissive TO another",
-         "CREATE ROW POLICY another ON mydb.filtered_table2 FOR SELECT USING 1 TO another",
+         "CREATE ROW POLICY another ON mydb.filtered_table2 FOR SELECT USING 1 AS permissive TO another",
-         "CREATE ROW POLICY another ON mydb.filtered_table3 FOR SELECT USING 1 TO another",
+         "CREATE ROW POLICY another ON mydb.filtered_table3 FOR SELECT USING 1 AS permissive TO another",
-         "CREATE ROW POLICY another ON mydb.local FOR SELECT USING a = 1 TO another",
+         "CREATE ROW POLICY another ON mydb.local FOR SELECT USING a = 1 AS permissive TO another",
-         "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 TO default",
+         "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) TO default",
+         "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 TO default",
+         "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 TO default"])
+         "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 AS permissive TO default"])
     assert node.query("SHOW CREATE POLICIES") == TSV(
-        ["CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 TO another",
+        ["CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 AS permissive TO another",
-         "CREATE ROW POLICY another ON mydb.filtered_table2 FOR SELECT USING 1 TO another",
+         "CREATE ROW POLICY another ON mydb.filtered_table2 FOR SELECT USING 1 AS permissive TO another",
-         "CREATE ROW POLICY another ON mydb.filtered_table3 FOR SELECT USING 1 TO another",
+         "CREATE ROW POLICY another ON mydb.filtered_table3 FOR SELECT USING 1 AS permissive TO another",
-         "CREATE ROW POLICY another ON mydb.local FOR SELECT USING a = 1 TO another",
+         "CREATE ROW POLICY another ON mydb.local FOR SELECT USING a = 1 AS permissive TO another",
-         "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 TO default",
+         "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) TO default",
+         "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 TO default",
+         "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 TO default"])
+         "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 AS permissive TO default"])
 
-    expected_access = "CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 TO another\n" \
+    expected_access = "CREATE ROW POLICY another ON mydb.filtered_table1 FOR SELECT USING 1 AS permissive TO another\n" \
-                      "CREATE ROW POLICY another ON mydb.filtered_table2 FOR SELECT USING 1 TO another\n" \
+                      "CREATE ROW POLICY another ON mydb.filtered_table2 FOR SELECT USING 1 AS permissive TO another\n" \
-                      "CREATE ROW POLICY another ON mydb.filtered_table3 FOR SELECT USING 1 TO another\n" \
+                      "CREATE ROW POLICY another ON mydb.filtered_table3 FOR SELECT USING 1 AS permissive TO another\n" \
-                      "CREATE ROW POLICY another ON mydb.local FOR SELECT USING a = 1 TO another\n" \
+                      "CREATE ROW POLICY another ON mydb.local FOR SELECT USING a = 1 AS permissive TO another\n" \
-                      "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 TO default\n" \
+                      "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING a = 1 AS permissive TO default\n" \
-                      "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) TO default\n" \
+                      "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING ((a + b) < 1) OR ((c - d) > 5) AS permissive TO default\n" \
-                      "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 TO default\n" \
+                      "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 1 AS permissive TO default\n" \
-                      "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 TO default\n"
+                      "CREATE ROW POLICY default ON mydb.local FOR SELECT USING 1 AS permissive TO default\n"
     assert expected_access in node.query("SHOW ACCESS")
 
     copy_policy_xml('all_rows.xml')
@@ -342,22 +342,22 @@ def test_dcl_introspection():
         ["another ON mydb.filtered_table1", "another ON mydb.filtered_table2", "another ON mydb.filtered_table3",
          "default ON mydb.filtered_table1", "default ON mydb.filtered_table2", "default ON mydb.filtered_table3"])
     assert node.query(
-        "SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING 1 TO default\n"
+        "SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING 1 AS permissive TO default\n"
     assert node.query(
-        "SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING 1 TO default\n"
+        "SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING 1 AS permissive TO default\n"
     assert node.query(
-        "SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING 1 TO default\n"
+        "SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING 1 AS permissive TO default\n"
 
     copy_policy_xml('no_rows.xml')
     assert node.query("SHOW POLICIES") == TSV(
         ["another ON mydb.filtered_table1", "another ON mydb.filtered_table2", "another ON mydb.filtered_table3",
          "default ON mydb.filtered_table1", "default ON mydb.filtered_table2", "default ON mydb.filtered_table3"])
     assert node.query(
-        "SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING NULL TO default\n"
+        "SHOW CREATE POLICY default ON mydb.filtered_table1") == "CREATE ROW POLICY default ON mydb.filtered_table1 FOR SELECT USING NULL AS permissive TO default\n"
     assert node.query(
-        "SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING NULL TO default\n"
+        "SHOW CREATE POLICY default ON mydb.filtered_table2") == "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING NULL AS permissive TO default\n"
     assert node.query(
-        "SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING NULL TO default\n"
+        "SHOW CREATE POLICY default ON mydb.filtered_table3") == "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING NULL AS permissive TO default\n"
 
     copy_policy_xml('no_filters.xml')
     assert node.query("SHOW POLICIES") == ""
@@ -382,7 +382,7 @@ def test_dcl_management():
     assert node.query("SELECT * FROM mydb.filtered_table1") == TSV([[1, 0]])
     assert node.query("SHOW POLICIES ON mydb.filtered_table1") == "pB\n"
     assert node.query(
-        "SHOW CREATE POLICY pB ON mydb.filtered_table1") == "CREATE ROW POLICY pB ON mydb.filtered_table1 FOR SELECT USING a > b TO default\n"
+        "SHOW CREATE POLICY pB ON mydb.filtered_table1") == "CREATE ROW POLICY pB ON mydb.filtered_table1 FOR SELECT USING a > b AS permissive TO default\n"
 
     node.query("DROP POLICY pB ON mydb.filtered_table1")
     assert node.query("SELECT * FROM mydb.filtered_table1") == TSV([[0, 0], [0, 1], [1, 0], [1, 1]])
@@ -435,6 +435,23 @@ def test_grant_create_row_policy():
     node.query("DROP USER X")
 
 
+def test_some_users_without_policies():
+    copy_policy_xml('no_filters.xml')
+    assert node.query("SHOW POLICIES") == ""
+    node.query("CREATE USER X, Y")
+    node.query("GRANT SELECT ON mydb.filtered_table1 TO X, Y")
+
+    node.query("CREATE POLICY pA ON mydb.filtered_table1 FOR SELECT USING a<b AS permissive TO X")
+    assert node.query("SELECT * FROM mydb.filtered_table1", user='X') == TSV([[0, 1]])
+    assert node.query("SELECT * FROM mydb.filtered_table1", user='Y') == ""
+
+    node.query("ALTER POLICY pA ON mydb.filtered_table1 AS restrictive")
+    assert node.query("SELECT * FROM mydb.filtered_table1", user='X') == TSV([[0, 1]])
+    assert node.query("SELECT * FROM mydb.filtered_table1", user='Y') == TSV([[0, 0], [0, 1], [1, 0], [1, 1]])
+
+    node.query("DROP USER X, Y")
+
+
 def test_users_xml_is_readonly():
     assert re.search("storage is readonly", node.query_and_get_error("DROP POLICY default ON mydb.filtered_table1"))
 
@@ -448,10 +465,10 @@ def test_tags_with_db_and_table_names():
     assert node.query("SELECT * FROM mydb.`.filtered_table4`") == TSV([[1, 1]])
 
     assert node.query("SHOW CREATE POLICIES default") == TSV(
-        ["CREATE ROW POLICY default ON mydb.`.filtered_table4` FOR SELECT USING c = 2 TO default",
+        ["CREATE ROW POLICY default ON mydb.`.filtered_table4` FOR SELECT USING c = 2 AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING c > (d + 5) TO default",
+         "CREATE ROW POLICY default ON mydb.filtered_table2 FOR SELECT USING c > (d + 5) AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 0 TO default",
+         "CREATE ROW POLICY default ON mydb.filtered_table3 FOR SELECT USING c = 0 AS permissive TO default",
-         "CREATE ROW POLICY default ON mydb.table FOR SELECT USING a = 0 TO default"])
+         "CREATE ROW POLICY default ON mydb.table FOR SELECT USING a = 0 AS permissive TO default"])
 
 
 def test_miscellaneous_engines():

tests/queries/0_stateless/01295_create_row_policy.reference

@@ -1,35 +1,35 @@
 -- default
-CREATE ROW POLICY p1_01295 ON db.table
+CREATE ROW POLICY p1_01295 ON db.table AS permissive
 -- same as default
-CREATE ROW POLICY p2_01295 ON db.table
+CREATE ROW POLICY p2_01295 ON db.table AS permissive
-CREATE ROW POLICY p3_01295 ON db.table
+CREATE ROW POLICY p3_01295 ON db.table AS permissive
 -- rename
-CREATE ROW POLICY p2_01295_renamed ON db.table
+CREATE ROW POLICY p2_01295_renamed ON db.table AS permissive
 -- filter
-CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING (a < b) AND (c > d)
+CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING (a < b) AND (c > d) AS permissive
-CREATE ROW POLICY p2_01295 ON db.table AS restrictive FOR SELECT USING id = currentUser()
+CREATE ROW POLICY p2_01295 ON db.table FOR SELECT USING id = currentUser() AS restrictive
-CREATE ROW POLICY p3_01295 ON db.table FOR SELECT USING 1
+CREATE ROW POLICY p3_01295 ON db.table FOR SELECT USING 1 AS permissive
-CREATE ROW POLICY p1_01295 ON db.table AS restrictive FOR SELECT USING 0
+CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING 0 AS restrictive
 -- to roles
-CREATE ROW POLICY p1_01295 ON db.table
+CREATE ROW POLICY p1_01295 ON db.table AS permissive
-CREATE ROW POLICY p2_01295 ON db.table TO ALL
+CREATE ROW POLICY p2_01295 ON db.table AS permissive TO ALL
-CREATE ROW POLICY p3_01295 ON db.table TO r1_01295
+CREATE ROW POLICY p3_01295 ON db.table AS permissive TO r1_01295
-CREATE ROW POLICY p4_01295 ON db.table TO u1_01295
+CREATE ROW POLICY p4_01295 ON db.table AS permissive TO u1_01295
-CREATE ROW POLICY p5_01295 ON db.table TO r1_01295, u1_01295
+CREATE ROW POLICY p5_01295 ON db.table AS permissive TO r1_01295, u1_01295
-CREATE ROW POLICY p6_01295 ON db.table TO ALL EXCEPT r1_01295
+CREATE ROW POLICY p6_01295 ON db.table AS permissive TO ALL EXCEPT r1_01295
-CREATE ROW POLICY p7_01295 ON db.table TO ALL EXCEPT r1_01295, u1_01295
+CREATE ROW POLICY p7_01295 ON db.table AS permissive TO ALL EXCEPT r1_01295, u1_01295
-CREATE ROW POLICY p1_01295 ON db.table TO u1_01295
+CREATE ROW POLICY p1_01295 ON db.table AS permissive TO u1_01295
-CREATE ROW POLICY p2_01295 ON db.table
+CREATE ROW POLICY p2_01295 ON db.table AS permissive
 -- multiple policies in one command
-CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING 1
+CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING 1 AS permissive
-CREATE ROW POLICY p2_01295 ON db.table FOR SELECT USING 1
+CREATE ROW POLICY p2_01295 ON db.table FOR SELECT USING 1 AS permissive
-CREATE ROW POLICY p3_01295 ON db.table TO u1_01295
+CREATE ROW POLICY p3_01295 ON db.table AS permissive TO u1_01295
-CREATE ROW POLICY p3_01295 ON db2.table2 TO u1_01295
+CREATE ROW POLICY p3_01295 ON db2.table2 AS permissive TO u1_01295
-CREATE ROW POLICY p4_01295 ON db.table FOR SELECT USING a = b
+CREATE ROW POLICY p4_01295 ON db.table FOR SELECT USING a = b AS permissive
-CREATE ROW POLICY p5_01295 ON db2.table2 FOR SELECT USING a = b
+CREATE ROW POLICY p5_01295 ON db2.table2 FOR SELECT USING a = b AS permissive
-CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING 1 TO ALL
+CREATE ROW POLICY p1_01295 ON db.table FOR SELECT USING 1 AS permissive TO ALL
-CREATE ROW POLICY p2_01295 ON db.table FOR SELECT USING 1 TO ALL
+CREATE ROW POLICY p2_01295 ON db.table FOR SELECT USING 1 AS permissive TO ALL
 -- system.row_policies
-p1_01295 ON db.table	p1_01295	db	table	local directory	(a < b) AND (c > d)	0	0	[]	[]
+p1_01295 ON db.table	p1_01295	db	table	local directory	(a < b) AND (c > d)	permissive	0	[]	[]
-p2_01295 ON db.table	p2_01295	db	table	local directory	id = currentUser()	1	0	['u1_01295']	[]
+p2_01295 ON db.table	p2_01295	db	table	local directory	id = currentUser()	restrictive	0	['u1_01295']	[]
-p3_01295 ON db.table	p3_01295	db	table	local directory	1	0	1	[]	['r1_01295']
+p3_01295 ON db.table	p3_01295	db	table	local directory	1	permissive	1	[]	['r1_01295']

tests/queries/0_stateless/01295_create_row_policy.sql

@@ -72,7 +72,7 @@ SELECT '-- system.row_policies';
 CREATE ROW POLICY p1_01295 ON db.table USING a<b AND c>d;
 CREATE ROW POLICY p2_01295 ON db.table USING id=currentUser() AS RESTRICTIVE TO u1_01295;
 CREATE ROW POLICY p3_01295 ON db.table USING 1 AS PERMISSIVE TO ALL EXCEPT r1_01295;
-SELECT name, short_name, database, table, storage, select_filter, is_restrictive, apply_to_all, apply_to_list, apply_to_except from system.row_policies WHERE short_name LIKE 'p%\_01295' ORDER BY name;
+SELECT name, short_name, database, table, storage, select_filter, kind, apply_to_all, apply_to_list, apply_to_except from system.row_policies WHERE short_name LIKE 'p%\_01295' ORDER BY name;
 DROP ROW POLICY p1_01295, p2_01295, p3_01295 ON db.table;
 
 DROP ROLE r1_01295;

tests/queries/0_stateless/01296_create_row_policy_in_current_database.reference

@@ -1,20 +1,20 @@
 -- one policy
-CREATE ROW POLICY p1_01296 ON db_01296.table
+CREATE ROW POLICY p1_01296 ON db_01296.table AS permissive
-CREATE ROW POLICY p1_01296 ON db_01296.table
+CREATE ROW POLICY p1_01296 ON db_01296.table AS permissive
-CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1
+CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
-CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1
+CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
 -- multiple policies
-CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1
+CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
-CREATE ROW POLICY p2_01296 ON db_01296.table FOR SELECT USING 1
+CREATE ROW POLICY p2_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
-CREATE ROW POLICY p3_01296 ON db_01296.table TO u1_01296
+CREATE ROW POLICY p3_01296 ON db_01296.table AS permissive TO u1_01296
-CREATE ROW POLICY p3_01296 ON db_01296.table2 TO u1_01296
+CREATE ROW POLICY p3_01296 ON db_01296.table2 AS permissive TO u1_01296
-CREATE ROW POLICY p4_01296 ON db_01296.table FOR SELECT USING a = b
+CREATE ROW POLICY p4_01296 ON db_01296.table FOR SELECT USING a = b AS permissive
-CREATE ROW POLICY p5_01296 ON db_01296.table2 FOR SELECT USING a = b
+CREATE ROW POLICY p5_01296 ON db_01296.table2 FOR SELECT USING a = b AS permissive
-CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1
+CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
-CREATE ROW POLICY p2_01296 ON db_01296.table FOR SELECT USING 1
+CREATE ROW POLICY p2_01296 ON db_01296.table FOR SELECT USING 1 AS permissive
-CREATE ROW POLICY p3_01296 ON db_01296.table TO u1_01296
+CREATE ROW POLICY p3_01296 ON db_01296.table AS permissive TO u1_01296
-CREATE ROW POLICY p3_01296 ON db_01296.table2 TO u1_01296
+CREATE ROW POLICY p3_01296 ON db_01296.table2 AS permissive TO u1_01296
-CREATE ROW POLICY p4_01296 ON db_01296.table FOR SELECT USING a = b
+CREATE ROW POLICY p4_01296 ON db_01296.table FOR SELECT USING a = b AS permissive
-CREATE ROW POLICY p5_01296 ON db_01296.table2 FOR SELECT USING a = b
+CREATE ROW POLICY p5_01296 ON db_01296.table2 FOR SELECT USING a = b AS permissive
-CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 TO ALL
+CREATE ROW POLICY p1_01296 ON db_01296.table FOR SELECT USING 1 AS permissive TO ALL
-CREATE ROW POLICY p2_01296 ON db_01296.table FOR SELECT USING 1 TO ALL
+CREATE ROW POLICY p2_01296 ON db_01296.table FOR SELECT USING 1 AS permissive TO ALL

tests/queries/0_stateless/02117_show_create_table_system.reference

@@ -49,7 +49,7 @@ CREATE TABLE system.replicated_merge_tree_settings\n(\n    `name` String,\n    `
 CREATE TABLE system.replication_queue\n(\n    `database` String,\n    `table` String,\n    `replica_name` String,\n    `position` UInt32,\n    `node_name` String,\n    `type` String,\n    `create_time` DateTime,\n    `required_quorum` UInt32,\n    `source_replica` String,\n    `new_part_name` String,\n    `parts_to_merge` Array(String),\n    `is_detach` UInt8,\n    `is_currently_executing` UInt8,\n    `num_tries` UInt32,\n    `last_exception` String,\n    `last_attempt_time` DateTime,\n    `num_postponed` UInt32,\n    `postpone_reason` String,\n    `last_postpone_time` DateTime,\n    `merge_type` String\n)\nENGINE = SystemReplicationQueue()\nCOMMENT \'SYSTEM TABLE is built on the fly.\'
 CREATE TABLE system.role_grants\n(\n    `user_name` Nullable(String),\n    `role_name` Nullable(String),\n    `granted_role_name` String,\n    `granted_role_is_default` UInt8,\n    `with_admin_option` UInt8\n)\nENGINE = SystemRoleGrants()\nCOMMENT \'SYSTEM TABLE is built on the fly.\'
 CREATE TABLE system.roles\n(\n    `name` String,\n    `id` UUID,\n    `storage` String\n)\nENGINE = SystemRoles()\nCOMMENT \'SYSTEM TABLE is built on the fly.\'
-CREATE TABLE system.row_policies\n(\n    `name` String,\n    `short_name` String,\n    `database` String,\n    `table` String,\n    `id` UUID,\n    `storage` String,\n    `select_filter` Nullable(String),\n    `is_restrictive` UInt8,\n    `apply_to_all` UInt8,\n    `apply_to_list` Array(String),\n    `apply_to_except` Array(String)\n)\nENGINE = SystemRowPolicies()\nCOMMENT \'SYSTEM TABLE is built on the fly.\'
+CREATE TABLE system.row_policies\n(\n    `name` String,\n    `short_name` String,\n    `database` String,\n    `table` String,\n    `id` UUID,\n    `storage` String,\n    `select_filter` Nullable(String),\n    `kind` Enum8(\'permissive\' = 0, \'restrictive\' = 1),\n    `apply_to_all` UInt8,\n    `apply_to_list` Array(String),\n    `apply_to_except` Array(String)\n)\nENGINE = SystemRowPolicies()\nCOMMENT \'SYSTEM TABLE is built on the fly.\'
 CREATE TABLE system.settings\n(\n    `name` String,\n    `value` String,\n    `changed` UInt8,\n    `description` String,\n    `min` Nullable(String),\n    `max` Nullable(String),\n    `readonly` UInt8,\n    `type` String\n)\nENGINE = SystemSettings()\nCOMMENT \'SYSTEM TABLE is built on the fly.\'
 CREATE TABLE system.settings_profile_elements\n(\n    `profile_name` Nullable(String),\n    `user_name` Nullable(String),\n    `role_name` Nullable(String),\n    `index` UInt64,\n    `setting_name` Nullable(String),\n    `value` Nullable(String),\n    `min` Nullable(String),\n    `max` Nullable(String),\n    `readonly` Nullable(UInt8),\n    `inherit_profile` Nullable(String)\n)\nENGINE = SystemSettingsProfileElements()\nCOMMENT \'SYSTEM TABLE is built on the fly.\'
 CREATE TABLE system.settings_profiles\n(\n    `name` String,\n    `id` UUID,\n    `storage` String,\n    `num_elements` UInt64,\n    `apply_to_all` UInt8,\n    `apply_to_list` Array(String),\n    `apply_to_except` Array(String)\n)\nENGINE = SystemSettingsProfiles()\nCOMMENT \'SYSTEM TABLE is built on the fly.\'

tests/queries/0_stateless/02131_multiple_row_policies_on_same_column.reference

@@ -0,0 +1,33 @@
+None
+1
+2
+3
+4
+R1: x == 1
+1
+R1, R2: (x == 1) OR (x == 2)
+1
+2
+R1, R2, R3: (x == 1) OR (x == 2) OR (x == 3)
+1
+2
+3
+R1, R2, R3, R4: ((x == 1) OR (x == 2) OR (x == 3)) AND (x <= 2)
+1
+2
+R1, R2, R3, R4, R5: ((x == 1) OR (x == 2) OR (x == 3)) AND (x <= 2) AND (x >= 2)
+2
+R2, R3, R4, R5: ((x == 2) OR (x == 3)) AND (x <= 2) AND (x >= 2)
+2
+R3, R4, R5: (x == 3) AND (x <= 2) AND (x >= 2)
+R4, R5: (x <= 2) AND (x >= 2)
+2
+R5: (x >= 2)
+2
+3
+4
+None
+1
+2
+3
+4

tests/queries/0_stateless/02131_multiple_row_policies_on_same_column.sql

@@ -0,0 +1,55 @@
+DROP TABLE IF EXISTS 02131_multiple_row_policies_on_same_column;
+CREATE TABLE 02131_multiple_row_policies_on_same_column (x UInt8) ENGINE = MergeTree ORDER BY x;
+INSERT INTO 02131_multiple_row_policies_on_same_column VALUES (1), (2), (3), (4);
+
+
+DROP ROW POLICY IF EXISTS 02131_filter_1 ON 02131_multiple_row_policies_on_same_column;
+DROP ROW POLICY IF EXISTS 02131_filter_2 ON 02131_multiple_row_policies_on_same_column;
+DROP ROW POLICY IF EXISTS 02131_filter_3 ON 02131_multiple_row_policies_on_same_column;
+DROP ROW POLICY IF EXISTS 02131_filter_4 ON 02131_multiple_row_policies_on_same_column;
+DROP ROW POLICY IF EXISTS 02131_filter_5 ON 02131_multiple_row_policies_on_same_column;
+
+SELECT 'None';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+CREATE ROW POLICY 02131_filter_1 ON 02131_multiple_row_policies_on_same_column USING x=1 AS permissive TO ALL;
+SELECT 'R1: x == 1';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+CREATE ROW POLICY 02131_filter_2 ON 02131_multiple_row_policies_on_same_column USING x=2 AS permissive TO ALL;
+SELECT 'R1, R2: (x == 1) OR (x == 2)';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+CREATE ROW POLICY 02131_filter_3 ON 02131_multiple_row_policies_on_same_column USING x=3 AS permissive TO ALL;
+SELECT 'R1, R2, R3: (x == 1) OR (x == 2) OR (x == 3)';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+CREATE ROW POLICY 02131_filter_4 ON 02131_multiple_row_policies_on_same_column USING x<=2 AS restrictive TO ALL;
+SELECT 'R1, R2, R3, R4: ((x == 1) OR (x == 2) OR (x == 3)) AND (x <= 2)';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+CREATE ROW POLICY 02131_filter_5 ON 02131_multiple_row_policies_on_same_column USING x>=2 AS restrictive TO ALL;
+SELECT 'R1, R2, R3, R4, R5: ((x == 1) OR (x == 2) OR (x == 3)) AND (x <= 2) AND (x >= 2)';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+DROP ROW POLICY 02131_filter_1 ON 02131_multiple_row_policies_on_same_column;
+SELECT 'R2, R3, R4, R5: ((x == 2) OR (x == 3)) AND (x <= 2) AND (x >= 2)';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+DROP ROW POLICY 02131_filter_2 ON 02131_multiple_row_policies_on_same_column;
+SELECT 'R3, R4, R5: (x == 3) AND (x <= 2) AND (x >= 2)';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+DROP ROW POLICY 02131_filter_3 ON 02131_multiple_row_policies_on_same_column;
+SELECT 'R4, R5: (x <= 2) AND (x >= 2)';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+DROP ROW POLICY 02131_filter_4 ON 02131_multiple_row_policies_on_same_column;
+SELECT 'R5: (x >= 2)';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+DROP ROW POLICY 02131_filter_5 ON 02131_multiple_row_policies_on_same_column;
+SELECT 'None';
+SELECT * FROM 02131_multiple_row_policies_on_same_column;
+
+DROP TABLE 02131_multiple_row_policies_on_same_column;

tests/queries/0_stateless/02131_multiply_row_policies_on_same_column.reference

@@ -1,8 +0,0 @@
-4
-1
-2
-3
-3
-3
-3
-4

tests/queries/0_stateless/02131_multiply_row_policies_on_same_column.sql

@@ -1,30 +0,0 @@
-DROP TABLE IF EXISTS 02131_multiply_row_policies_on_same_column;
-CREATE TABLE 02131_multiply_row_policies_on_same_column (x UInt8) ENGINE = MergeTree ORDER BY x;
-INSERT INTO 02131_multiply_row_policies_on_same_column VALUES (1), (2), (3), (4);
-
-
-DROP ROW POLICY IF EXISTS 02131_filter_1 ON 02131_multiply_row_policies_on_same_column;
-DROP ROW POLICY IF EXISTS 02131_filter_2 ON 02131_multiply_row_policies_on_same_column;
-DROP ROW POLICY IF EXISTS 02131_filter_3 ON 02131_multiply_row_policies_on_same_column;
-SELECT count() FROM 02131_multiply_row_policies_on_same_column;
-
-
-CREATE ROW POLICY 02131_filter_1 ON 02131_multiply_row_policies_on_same_column USING x=1 TO ALL;
-SELECT count() FROM 02131_multiply_row_policies_on_same_column;
-CREATE ROW POLICY 02131_filter_2 ON 02131_multiply_row_policies_on_same_column USING x=2 TO ALL;
-SELECT count() FROM 02131_multiply_row_policies_on_same_column;
-CREATE ROW POLICY 02131_filter_3 ON 02131_multiply_row_policies_on_same_column USING x=3 TO ALL;
-SELECT count() FROM 02131_multiply_row_policies_on_same_column;
-SELECT count() FROM 02131_multiply_row_policies_on_same_column;
-
-
-CREATE ROW POLICY 02131_filter_4 ON 02131_multiply_row_policies_on_same_column USING x<4 AS RESTRICTIVE TO ALL;
-SELECT count() FROM 02131_multiply_row_policies_on_same_column;
-SELECT count() FROM 02131_multiply_row_policies_on_same_column;
-
-DROP ROW POLICY 02131_filter_1 ON 02131_multiply_row_policies_on_same_column;
-DROP ROW POLICY 02131_filter_2 ON 02131_multiply_row_policies_on_same_column;
-DROP ROW POLICY 02131_filter_3 ON 02131_multiply_row_policies_on_same_column;
-DROP ROW POLICY 02131_filter_4 ON 02131_multiply_row_policies_on_same_column;
-SELECT count() FROM 02131_multiply_row_policies_on_same_column;
-DROP TABLE 02131_multiply_row_policies_on_same_column;