chore: support multiple columns (#147)

ecmadao · web-flow · commit ca3f0992d5af · 2025-08-25T17:55:03.000+08:00
* chore: dependency update

* fix: lint

* fix: lint

* chore: support multiple columns

* chore: support raw_expression
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-3.9.1
+3.9.2
diff --git a/docs/data-sources/policy.md b/docs/data-sources/policy.md
@@ -87,14 +87,15 @@ Optional:
 
 Required:
 
-- `action` (String)
-- `member` (String) The member in user:{email} or group:{email} format.
+- `actions` (Set of String)
+- `members` (Set of String)
 
 Optional:
 
-- `column` (String)
+- `columns` (Set of String)
 - `database` (String) The database full name in instances/{instance resource id}/databases/{database name} format
 - `expire_timestamp` (String) The expiration timestamp in YYYY-MM-DDThh:mm:ss.000Z format
+- `raw_expression` (String) The raw CEL expression. We will use it as the masking exception and ignore the "database"/"schema"/"table"/"columns"/"expire_timestamp" fields if you provide the raw expression.
 - `reason` (String) The reason for the masking exemption
 - `schema` (String)
 - `table` (String)
diff --git a/docs/data-sources/policy_list.md b/docs/data-sources/policy_list.md
@@ -29,13 +29,34 @@ The policy data source list.
 
 Read-Only:
 
+- `data_source_query_policy` (List of Object) (see [below for nested schema](#nestedobjatt--policies--data_source_query_policy))
+- `disable_copy_data_policy` (List of Object) (see [below for nested schema](#nestedobjatt--policies--disable_copy_data_policy))
 - `enforce` (Boolean)
 - `global_masking_policy` (List of Object) (see [below for nested schema](#nestedobjatt--policies--global_masking_policy))
 - `inherit_from_parent` (Boolean)
 - `masking_exception_policy` (List of Object) (see [below for nested schema](#nestedobjatt--policies--masking_exception_policy))
 - `name` (String)
+- `rollout_policy` (List of Object) (see [below for nested schema](#nestedobjatt--policies--rollout_policy))
 - `type` (String)
 
+<a id="nestedobjatt--policies--data_source_query_policy"></a>
+### Nested Schema for `policies.data_source_query_policy`
+
+Read-Only:
+
+- `disallow_ddl` (Boolean)
+- `disallow_dml` (Boolean)
+- `restriction` (String)
+
+
+<a id="nestedobjatt--policies--disable_copy_data_policy"></a>
+### Nested Schema for `policies.disable_copy_data_policy`
+
+Read-Only:
+
+- `enable` (Boolean)
+
+
 <a id="nestedobjatt--policies--global_masking_policy"></a>
 ### Nested Schema for `policies.global_masking_policy`
 
@@ -67,13 +88,24 @@ Read-Only:
 
 Read-Only:
 
-- `action` (String)
-- `column` (String)
+- `actions` (Set of String)
+- `columns` (Set of String)
 - `database` (String)
 - `expire_timestamp` (String)
-- `member` (String)
+- `members` (Set of String)
+- `raw_expression` (String)
 - `reason` (String)
 - `schema` (String)
 - `table` (String)
 
 
+
+<a id="nestedobjatt--policies--rollout_policy"></a>
+### Nested Schema for `policies.rollout_policy`
+
+Read-Only:
+
+- `automatic` (Boolean)
+- `roles` (Set of String)
+
+
diff --git a/docs/resources/policy.md b/docs/resources/policy.md
@@ -87,14 +87,15 @@ Optional:
 
 Required:
 
-- `action` (String)
-- `member` (String) The member in user:{email} or group:{email} format.
+- `actions` (Set of String)
+- `members` (Set of String)
 
 Optional:
 
-- `column` (String)
+- `columns` (Set of String)
 - `database` (String) The database full name in instances/{instance resource id}/databases/{database name} format
 - `expire_timestamp` (String) The expiration timestamp in YYYY-MM-DDThh:mm:ss.000Z format
+- `raw_expression` (String) The raw CEL expression. We will use it as the masking exception and ignore the "database"/"schema"/"table"/"columns"/"expire_timestamp" fields if you provide the raw expression.
 - `reason` (String) The reason for the masking exemption
 - `schema` (String)
 - `table` (String)
diff --git a/examples/database/main.tf b/examples/database/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/database_group/main.tf b/examples/database_group/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/environments/main.tf b/examples/environments/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/groups/main.tf b/examples/groups/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
@@ -30,7 +30,7 @@ data "bytebase_project" "sample_project" {
 
 data "bytebase_group_list" "groups_in_project" {
   project = data.bytebase_project.sample_project.name
-  query = "Bytebase"
+  query   = "Bytebase"
 }
 
 output "groups_in_project" {
diff --git a/examples/iamPolicy/main.tf b/examples/iamPolicy/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/instances/main.tf b/examples/instances/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/policies/main.tf b/examples/policies/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/projects/main.tf b/examples/projects/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/risk/main.tf b/examples/risk/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/roles/main.tf b/examples/roles/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/settings/main.tf b/examples/settings/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/setup/data_masking.tf b/examples/setup/data_masking.tf
@@ -100,7 +100,9 @@ resource "bytebase_setting" "semantic_types" {
 resource "bytebase_policy" "masking_exception_policy" {
   depends_on = [
     bytebase_project.sample_project,
-    bytebase_instance.test
+    bytebase_instance.test,
+    bytebase_user.project_developer,
+    bytebase_user.workspace_dba
   ]
 
   parent              = bytebase_project.sample_project.name
@@ -112,17 +114,33 @@ resource "bytebase_policy" "masking_exception_policy" {
     exceptions {
       database = "instances/test-sample-instance/databases/employee"
       table    = "salary"
-      column   = "amount"
-      member   = "user:ed@bytebase.com"
-      action   = "EXPORT"
-      reason   = "Grant access to ed for export"
+      columns  = ["amount", "emp_no"]
+      members = [
+        format("user:%s", bytebase_user.project_developer.email),
+        format("user:%s", bytebase_user.workspace_dba.email),
+      ]
+      actions = ["QUERY", "EXPORT"]
+      reason  = "Grant access"
     }
+
     exceptions {
       database = "instances/test-sample-instance/databases/employee"
-      table    = "salary"
-      column   = "amount"
-      member   = "user:ed@bytebase.com"
-      action   = "QUERY"
+      table    = "employee"
+      columns  = ["emp_no"]
+      members = [
+        format("user:%s", bytebase_user.workspace_dba.email),
+      ]
+      actions = ["EXPORT"]
+      reason  = "Grant export access"
+    }
+
+    exceptions {
+      members = [
+        format("user:%s", bytebase_user.project_developer.email),
+      ]
+      actions        = ["QUERY"]
+      reason         = "Grant query access"
+      raw_expression = "resource.instance_id == \"test-sample-instance\" && resource.database_name == \"employee\" && resource.table_name == \"employee\" && resource.column_name in [\"first_name\", \"last_name\", \"gender\"]"
     }
   }
 }
diff --git a/examples/setup/main.tf b/examples/setup/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/sql_review/main.tf b/examples/sql_review/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/users/main.tf b/examples/users/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.9.1"
+      version = "3.9.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/provider/data_source_policy.go b/provider/data_source_policy.go
diff --git a/provider/data_source_policy_list.go b/provider/data_source_policy_list.go
diff --git a/provider/data_source_policy_test.go b/provider/data_source_policy_test.go
diff --git a/provider/resource_policy.go b/provider/resource_policy.go
diff --git a/provider/resource_policy_test.go b/provider/resource_policy_test.go
diff --git a/tutorials/0-provider.tf b/tutorials/0-provider.tf
diff --git a/tutorials/8-5-masking-exception.tf b/tutorials/8-5-masking-exception.tf

Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@`
`2`	`2`	`terraform {`
`3`	`3`	`required_providers {`
`4`	`4`	`bytebase = {`
`5`		`- version = "3.9.1"`
	`5`	`+ version = "3.9.2"`
`6`	`6`	`# For local development, please use "terraform.local/bytebase/bytebase" instead`
`7`	`7`	`source = "registry.terraform.io/bytebase/bytebase"`
`8`	`8`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`terraform {`
`2`	`2`	`required_providers {`
`3`	`3`	`bytebase = {`
`4`		`- version = "3.9.1"`
	`4`	`+ version = "3.9.2"`
`5`	`5`	`# For local development, please use "terraform.local/bytebase/bytebase" instead`
`6`	`6`	`source = "registry.terraform.io/bytebase/bytebase"`
`7`	`7`	`}`