Merge branch 'master' of https://github.com/ClickHouse/ClickHouse into add_bech32_enc_dec

Author: george-larionov

docs/en/operations/settings/constraints-on-settings.md

@@ -46,6 +46,14 @@ Constraints are defined as follows:
         <max>upper_boundary</max>
         <changeable_in_readonly/>
       </setting_name_5>
+      <setting_name_6>
+        <min>lower_boundary</min>
+        <max>upper_boundary</max>
+        <disallowed>value1</disallowed>
+        <disallowed>value2</disallowed>
+        <disallowed>value3</disallowed>
+        <changeable_in_readonly/>
+      </setting_name_6>
     </constraints>
   </user_name>
 </profiles>
@@ -59,12 +67,16 @@ setting remains unchanged.
 There are a few types of constraints supported in ClickHouse:
 - `min`
 - `max`
+- `disallowed`
 - `readonly` (with alias `const`)
 - `changeable_in_readonly`
 
 The `min` and `max` constraints specify upper and lower boundaries for a numeric 
 setting and can be used in combination with each other. 
 
+The `disallowed` constraint can be used to specify specific value(s) which should not
+be allowed for a specific setting.
+
 The `readonly` or `const` constraint specifies that the user cannot change the 
 corresponding setting at all. 
 

src/Access/SettingsConstraints.cpp

@@ -77,7 +77,7 @@ void SettingsConstraints::clear()
     settings_alias_cache.clear();
 }
 
-void SettingsConstraints::set(const String & full_name, const Field & min_value, const Field & max_value, SettingConstraintWritability writability)
+void SettingsConstraints::set(const String & full_name, const Field & min_value, const Field & max_value, const std::vector<Field> & disallowed_values, SettingConstraintWritability writability)
 {
     std::string resolved_name{resolveSettingName(full_name)};
 
@@ -90,23 +90,30 @@ void SettingsConstraints::set(const String & full_name, const Field & min_value,
         constraint.min_value = settingCastValueUtil(resolved_name, min_value);
     if (!max_value.isNull())
         constraint.max_value = settingCastValueUtil(resolved_name, max_value);
+    if (!disallowed_values.empty())
+    {
+        for (const auto & allowed_value : disallowed_values)
+            constraint.disallowed_values.emplace_back(settingCastValueUtil(resolved_name, allowed_value));
+    }
     constraint.writability = writability;
 }
 
-void SettingsConstraints::get(const Settings & current_settings, std::string_view short_name, Field & min_value, Field & max_value, SettingConstraintWritability & writability) const
+void SettingsConstraints::get(const Settings & current_settings, std::string_view short_name, Field & min_value, Field & max_value, std::vector<Field> & disallowed_values, SettingConstraintWritability & writability) const
 {
     // NOTE: for `Settings` short name is equal to full name
     auto checker = getChecker(current_settings, short_name);
     min_value = checker.constraint.min_value;
     max_value = checker.constraint.max_value;
+    disallowed_values = checker.constraint.disallowed_values;
     writability = checker.constraint.writability;
 }
 
-void SettingsConstraints::get(const MergeTreeSettings &, std::string_view short_name, Field & min_value, Field & max_value, SettingConstraintWritability & writability) const
+void SettingsConstraints::get(const MergeTreeSettings &, std::string_view short_name, Field & min_value, Field & max_value, std::vector<Field> & disallowed_values, SettingConstraintWritability & writability) const
 {
     auto checker = getMergeTreeChecker(short_name);
     min_value = checker.constraint.min_value;
     max_value = checker.constraint.max_value;
+    disallowed_values = checker.constraint.disallowed_values;
     writability = checker.constraint.writability;
 }
 
@@ -128,6 +135,8 @@ void SettingsConstraints::merge(const SettingsConstraints & other)
                 constraint.min_value = other_constraint.min_value;
             if (!other_constraint.max_value.isNull())
                 constraint.max_value = other_constraint.max_value;
+            if (!other_constraint.disallowed_values.empty())
+                constraint.disallowed_values = other_constraint.disallowed_values;
             if (other_constraint.writability == SettingConstraintWritability::CONST)
                 constraint.writability = SettingConstraintWritability::CONST; // NOTE: In this mode <readonly/> flag cannot be overridden to be false
         }
@@ -170,6 +179,10 @@ void SettingsConstraints::check(const Settings & current_settings, const Setting
             check(current_settings, value, source);
         }
 
+        /// Don't check disallowed_values here in the profile elements because they make constrains more restrictive
+        /// and don't allow to bypass constraints from config by creating a user with custom constraints. The check
+        /// for disallowed values are instead implemented in SettingsConstraints::Checker::check.
+
         SettingConstraintWritability new_value = SettingConstraintWritability::WRITABLE;
         SettingConstraintWritability old_value = SettingConstraintWritability::WRITABLE;
 
@@ -336,6 +349,20 @@ bool SettingsConstraints::Checker::check(SettingChange & change,
         }
     };
 
+    auto equals_or_cannot_compare = [=](const Field & left, const Field & right)
+    {
+        if (reaction == THROW_ON_VIOLATION)
+            return accurateEquals(left, right);
+        try
+        {
+            return accurateEquals(left, right);
+        }
+        catch (...)
+        {
+            return true;
+        }
+    };
+
 
     if (constraint.writability == SettingConstraintWritability::CONST)
     {
@@ -346,6 +373,7 @@ bool SettingsConstraints::Checker::check(SettingChange & change,
 
     const auto & min_value = constraint.min_value;
     const auto & max_value = constraint.max_value;
+    const auto & disallowed_values = constraint.disallowed_values;
 
     if (!min_value.isNull() && !max_value.isNull() && less_or_cannot_compare(max_value, min_value))
     {
@@ -379,6 +407,14 @@ bool SettingsConstraints::Checker::check(SettingChange & change,
         change.value = max_value;
     }
 
+    for (const auto & value : disallowed_values)
+    {
+        bool equals = equals_or_cannot_compare(value, new_value);
+        if (equals)
+            throw Exception(ErrorCodes::SETTING_CONSTRAINT_VIOLATION, "Setting {} shouldn't be {}",
+                setting_name, applyVisitor(FieldVisitorToString(), value));
+    }
+
     if (!getSettingSourceRestrictions(setting_name).isSourceAllowed(source))
     {
         if (reaction == THROW_ON_VIOLATION)
@@ -460,7 +496,7 @@ SettingsConstraints::Checker SettingsConstraints::getMergeTreeChecker(std::strin
 
 bool SettingsConstraints::Constraint::operator==(const Constraint & other) const
 {
-    return writability == other.writability && min_value == other.min_value && max_value == other.max_value;
+    return writability == other.writability && min_value == other.min_value && max_value == other.max_value && disallowed_values == other.disallowed_values;
 }
 
 bool operator ==(const SettingsConstraints & left, const SettingsConstraints & right)

src/Access/SettingsConstraints.h

@@ -71,9 +71,9 @@ class SettingsConstraints
     void clear();
     bool empty() const { return constraints.empty(); }
 
-    void set(const String & full_name, const Field & min_value, const Field & max_value, SettingConstraintWritability writability);
-    void get(const Settings & current_settings, std::string_view short_name, Field & min_value, Field & max_value, SettingConstraintWritability & writability) const;
-    void get(const MergeTreeSettings & current_settings, std::string_view short_name, Field & min_value, Field & max_value, SettingConstraintWritability & writability) const;
+    void set(const String & full_name, const Field & min_value, const Field & max_value, const std::vector<Field> & allowed_values, SettingConstraintWritability writability);
+    void get(const Settings & current_settings, std::string_view short_name, Field & min_value, Field & max_value, std::vector<Field> & allowed_values, SettingConstraintWritability & writability) const;
+    void get(const MergeTreeSettings & current_settings, std::string_view short_name, Field & min_value, Field & max_value, std::vector<Field> & allowed_values, SettingConstraintWritability & writability) const;
 
     void merge(const SettingsConstraints & other);
 
@@ -107,6 +107,7 @@ class SettingsConstraints
         SettingConstraintWritability writability = SettingConstraintWritability::WRITABLE;
         Field min_value{};
         Field max_value{};
+        std::vector<Field> disallowed_values{};
 
         bool operator ==(const Constraint & other) const;
         bool operator !=(const Constraint & other) const { return !(*this == other); }

src/Access/SettingsProfileElement.cpp

@@ -65,19 +65,22 @@ void SettingsProfileElement::init(const ASTSettingsProfileElement & ast, const A
         min_value = ast.min_value;
         max_value = ast.max_value;
         writability = ast.writability;
+        disallowed_values = ast.disallowed_values;
 
         if (value)
             value = Settings::castValueUtil(setting_name, *value);
         if (min_value)
             min_value = Settings::castValueUtil(setting_name, *min_value);
         if (max_value)
             max_value = Settings::castValueUtil(setting_name, *max_value);
+        for (auto & allowed_value : disallowed_values)
+            value = Settings::castValueUtil(setting_name, allowed_value);
     }
 }
 
 bool SettingsProfileElement::isConstraint() const
 {
-    return this->writability || this->min_value || this->max_value;
+    return this->writability || this->min_value || this->max_value || !this->disallowed_values.empty();
 }
 
 std::shared_ptr<ASTSettingsProfileElement> SettingsProfileElement::toAST() const
@@ -92,6 +95,7 @@ std::shared_ptr<ASTSettingsProfileElement> SettingsProfileElement::toAST() const
     ast->value = value;
     ast->min_value = min_value;
     ast->max_value = max_value;
+    ast->disallowed_values = disallowed_values;
     ast->writability = writability;
 
     return ast;
@@ -113,6 +117,7 @@ std::shared_ptr<ASTSettingsProfileElement> SettingsProfileElement::toASTWithName
     ast->value = value;
     ast->min_value = min_value;
     ast->max_value = max_value;
+    ast->disallowed_values = disallowed_values;
     ast->writability = writability;
 
     return ast;
@@ -277,6 +282,7 @@ SettingsConstraints SettingsProfileElements::toSettingsConstraints(const AccessC
                 elem.setting_name,
                 elem.min_value ? *elem.min_value : Field{},
                 elem.max_value ? *elem.max_value : Field{},
+                elem.disallowed_values,
                 elem.writability ? *elem.writability : SettingConstraintWritability::WRITABLE);
     return res;
 }
@@ -360,6 +366,8 @@ void SettingsProfileElements::normalize()
                     first_element.min_value = element.min_value;
                 if (element.max_value)
                     first_element.max_value = element.max_value;
+                if (!element.disallowed_values.empty())
+                    first_element.disallowed_values = element.disallowed_values;
                 if (element.writability)
                     first_element.writability = element.writability;
                 element.setting_name.clear();
@@ -484,6 +492,7 @@ void SettingsProfileElements::applyChanges(const AlterSettingsProfileElements &
         new_element.value = modify.value;
         new_element.min_value = modify.min_value;
         new_element.max_value = modify.max_value;
+        new_element.disallowed_values = modify.disallowed_values;
         new_element.writability = modify.writability;
         push_back(new_element); /// normalizeProfileElements() will merge this new element with the previous elements.
     };

src/Access/SettingsProfileElement.h

@@ -28,9 +28,10 @@ struct SettingsProfileElement
     std::optional<Field> value;
     std::optional<Field> min_value;
     std::optional<Field> max_value;
+    std::vector<Field> disallowed_values;
     std::optional<SettingConstraintWritability> writability;
 
-    auto toTuple() const { return std::tie(parent_profile, setting_name, value, min_value, max_value, writability); }
+    auto toTuple() const { return std::tie(parent_profile, setting_name, value, min_value, max_value, disallowed_values, writability); }
     friend bool operator==(const SettingsProfileElement & lhs, const SettingsProfileElement & rhs) { return lhs.toTuple() == rhs.toTuple(); }
     friend bool operator!=(const SettingsProfileElement & lhs, const SettingsProfileElement & rhs) { return !(lhs == rhs); }
     friend bool operator <(const SettingsProfileElement & lhs, const SettingsProfileElement & rhs) { return lhs.toTuple() < rhs.toTuple(); }
@@ -46,7 +47,7 @@ struct SettingsProfileElement
     std::shared_ptr<ASTSettingsProfileElement> toAST() const;
     std::shared_ptr<ASTSettingsProfileElement> toASTWithNames(const AccessControl & access_control) const;
 
-    bool empty() const { return !parent_profile && (setting_name.empty() || (!value && !min_value && !max_value && !writability)); }
+    bool empty() const { return !parent_profile && (setting_name.empty() || (!value && !min_value && !max_value && disallowed_values.empty() && !writability)); }
 
     bool isConstraint() const;
 

src/Access/UsersConfigAccessStorage.cpp

@@ -699,6 +699,19 @@ namespace
                     profile_element.min_value = settingStringToValueUtil(setting_name, config.getString(path_to_name + "." + constraint_type));
                 else if (constraint_type == "max")
                     profile_element.max_value = settingStringToValueUtil(setting_name, config.getString(path_to_name + "." + constraint_type));
+                /// When the xml config is parsed, the first constraint_type is parsed as `disallowed` and the subsequent ones are parsed as
+                /// disallowed[1], disallowed[2] and so on. So, both `disallowed` and `disallowed[` should be considered as valid constraint types.
+                /// Example:
+                ///   <constraints>
+                ///     <max_execution_time>
+                ///         <max>50</max>
+                ///         <disallowed>3</disallowed>
+                ///         <disallowed>4</disallowed>
+                ///         <disallowed>5</disallowed>
+                ///     </max_execution_time>
+                /// </constraints>
+                else if (constraint_type == "disallowed" || constraint_type.starts_with("disallowed["))
+                    profile_element.disallowed_values.push_back(settingStringToValueUtil(setting_name, config.getString(path_to_name + "." + constraint_type)));
                 else if (constraint_type == "readonly" || constraint_type == "const")
                 {
                     writability_count++;

src/Core/Settings.cpp

@@ -7168,22 +7168,28 @@ void Settings::dumpToSystemSettingsColumns(MutableColumnsAndConstraints & params
 
         Field min;
         Field max;
+        std::vector<Field> disallowed_values;
         SettingConstraintWritability writability = SettingConstraintWritability::WRITABLE;
-        params.constraints.get(*this, setting_name, min, max, writability);
+        params.constraints.get(*this, setting_name, min, max, disallowed_values, writability);
 
         /// These two columns can accept strings only.
         if (!min.isNull())
             min = Settings::valueToStringUtil(setting_name, min);
         if (!max.isNull())
             max = Settings::valueToStringUtil(setting_name, max);
 
+        Array disallowed_array;
+        for (const auto & value : disallowed_values)
+            disallowed_array.emplace_back(Settings::valueToStringUtil(setting_name, value));
+
         res_columns[4]->insert(min);
         res_columns[5]->insert(max);
-        res_columns[6]->insert(writability == SettingConstraintWritability::CONST);
-        res_columns[7]->insert(setting.getTypeName());
-        res_columns[8]->insert(setting.getDefaultValueString());
-        res_columns[10]->insert(setting.getTier() == SettingsTierType::OBSOLETE);
-        res_columns[11]->insert(setting.getTier());
+        res_columns[6]->insert(disallowed_array);
+        res_columns[7]->insert(writability == SettingConstraintWritability::CONST);
+        res_columns[8]->insert(setting.getTypeName());
+        res_columns[9]->insert(setting.getDefaultValueString());
+        res_columns[11]->insert(setting.getTier() == SettingsTierType::OBSOLETE);
+        res_columns[12]->insert(setting.getTier());
     };
 
     const auto & settings_to_aliases = SettingsImpl::Traits::settingsToAliases();
@@ -7193,15 +7199,15 @@ void Settings::dumpToSystemSettingsColumns(MutableColumnsAndConstraints & params
         res_columns[0]->insert(setting_name);
 
         fill_data_for_setting(setting_name, setting);
-        res_columns[9]->insert("");
+        res_columns[10]->insert("");
 
         if (auto it = settings_to_aliases.find(setting_name); it != settings_to_aliases.end())
         {
             for (const auto alias : it->second)
             {
                 res_columns[0]->insert(alias);
                 fill_data_for_setting(alias, setting);
-                res_columns[9]->insert(setting_name);
+                res_columns[10]->insert(setting_name);
             }
         }
     }

src/Parsers/Access/ASTSettingsProfileElement.h

@@ -17,6 +17,7 @@ class ASTSettingsProfileElement : public IAST
     std::optional<Field> value;
     std::optional<Field> min_value;
     std::optional<Field> max_value;
+    std::vector<Field> disallowed_values;
     std::optional<SettingConstraintWritability> writability;
     bool id_mode = false;  /// If true then `parent_profile` keeps UUID, not a name.
     bool use_inherit_keyword = false;  /// If true then this element is a part of ASTCreateSettingsProfileQuery.

src/Storages/MergeTree/MergeTreeSettings.cpp

@@ -2281,29 +2281,35 @@ void MergeTreeSettings::dumpToSystemMergeTreeSettingsColumns(MutableColumnsAndCo
     for (const auto & setting : impl->all())
     {
         const auto & setting_name = setting.getName();
-        res_columns[0]->insert(setting_name);
-        res_columns[1]->insert(setting.getValueString());
-        res_columns[2]->insert(setting.getDefaultValueString());
-        res_columns[3]->insert(setting.isValueChanged());
-        res_columns[4]->insert(setting.getDescription());
-
+        size_t col = 0;
+        res_columns[col++]->insert(setting_name);
+        res_columns[col++]->insert(setting.getValueString());
+        res_columns[col++]->insert(setting.getDefaultValueString());
+        res_columns[col++]->insert(setting.isValueChanged());
+        res_columns[col++]->insert(setting.getDescription());
         Field min;
         Field max;
+        std::vector<Field> disallowed_values;
         SettingConstraintWritability writability = SettingConstraintWritability::WRITABLE;
-        constraints.get(*this, setting_name, min, max, writability);
+        constraints.get(*this, setting_name, min, max, disallowed_values, writability);
 
         /// These two columns can accept strings only.
         if (!min.isNull())
             min = MergeTreeSettings::valueToStringUtil(setting_name, min);
         if (!max.isNull())
             max = MergeTreeSettings::valueToStringUtil(setting_name, max);
 
-        res_columns[5]->insert(min);
-        res_columns[6]->insert(max);
-        res_columns[7]->insert(writability == SettingConstraintWritability::CONST);
-        res_columns[8]->insert(setting.getTypeName());
-        res_columns[9]->insert(setting.getTier() == SettingsTierType::OBSOLETE);
-        res_columns[10]->insert(setting.getTier());
+        Array disallowed_array;
+        for (const auto & value : disallowed_values)
+                disallowed_array.emplace_back(MergeTreeSettings::valueToStringUtil(setting_name, value));
+
+        res_columns[col++]->insert(min);
+        res_columns[col++]->insert(max);
+        res_columns[col++]->insert(disallowed_array);
+        res_columns[col++]->insert(writability == SettingConstraintWritability::CONST);
+        res_columns[col++]->insert(setting.getTypeName());
+        res_columns[col++]->insert(setting.getTier() == SettingsTierType::OBSOLETE);
+        res_columns[col++]->insert(setting.getTier());
     }
 }