Skip to content

Commit 8e44ad4

Browse files
craig[bot]Dedej-Bergin
craig[bot]
and
Dedej-Bergin
committed
Merge #143391
143391: sql/delegate: rename policy_statements to rls_statements r=Dedej-Bergin a=Dedej-Bergin This commit renames the `policy_statements` column to `rls_statements` in the `crdb_internal.create_statements` table to be more consistent with the naming convention used elsewhere in the codebase. We no longer store the row level security statements in the `create_statement` column. This change also moves rls alter statements into the `rls_statements` column. Fixes: #141932 Epic: CRDB-11724 Release note: None Co-authored-by: Bergin Dedej <[email protected]>
2 parents b6e1332 + 67b781d commit 8e44ad4

File tree

8 files changed

+80
-71
lines changed

8 files changed

+80
-71
lines changed

‎pkg/ccl/logictestccl/testdata/logic_test/crdb_internal_tenant‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ function signature category details schema oid
190190
query ITTITTTTTTTTTBBBB colnames
191191
SELECT * FROM crdb_internal.create_statements WHERE database_name = ''
192192
----
193-
database_id database_name schema_name descriptor_id descriptor_type descriptor_name create_statement state create_nofks policy_statements alter_statements validate_statements create_redactable has_partitions is_multi_region is_virtual is_temporary
193+
database_id database_name schema_name descriptor_id descriptor_type descriptor_name create_statement state create_nofks rls_statements alter_statements validate_statements create_redactable has_partitions is_multi_region is_virtual is_temporary
194194

195195
query ITITTBTB colnames
196196
SELECT * FROM crdb_internal.table_columns WHERE descriptor_name = ''

‎pkg/ccl/logictestccl/testdata/logic_test/partitioning‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,46 @@ ok1 CREATE TABLE public.ok1 (
411411
)
412412
-- Warning: Partitioned table with no zone configurations.
413413

414+
subtest partition_with_rls
415+
416+
statement ok
417+
set enable_row_level_security=on;
418+
419+
statement ok
420+
ALTER TABLE ok1 ENABLE ROW LEVEL SECURITY;
421+
422+
statement ok
423+
CREATE POLICY test_policy ON ok1 FOR SELECT USING (true);
424+
425+
query TT
426+
SHOW CREATE TABLE ok1
427+
----
428+
ok1 CREATE TABLE public.ok1 (
429+
a INT8 NOT NULL,
430+
b INT8 NOT NULL,
431+
c INT8 NULL,
432+
CONSTRAINT ok1_pkey PRIMARY KEY (a ASC, b ASC)
433+
) PARTITION BY LIST (a) (
434+
PARTITION p1 VALUES IN ((1)),
435+
PARTITION p2 VALUES IN ((2))
436+
)
437+
-- Warning: Partitioned table with no zone configurations.
438+
;
439+
ALTER TABLE public.ok1 ENABLE ROW LEVEL SECURITY;
440+
CREATE POLICY test_policy ON public.ok1 AS PERMISSIVE FOR SELECT TO public USING (true)
441+
442+
# Clean up by dropping the policy and table after testing
443+
statement ok
444+
DROP POLICY test_policy ON ok1;
445+
446+
statement ok
447+
ALTER TABLE ok1 DISABLE ROW LEVEL SECURITY;
448+
449+
statement ok
450+
set enable_row_level_security=off;
451+
452+
subtest end
453+
414454
query T
415455
SELECT feature_name FROM crdb_internal.feature_usage WHERE feature_name='sql.show.create' AND usage_count > 0
416456
----

‎pkg/sql/crdb_internal.go‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -3959,7 +3959,7 @@ CREATE TABLE crdb_internal.create_statements (
39593959
create_statement STRING NOT NULL,
39603960
state STRING NOT NULL,
39613961
create_nofks STRING NOT NULL,
3962-
policy_statements STRING[] NOT NULL,
3962+
rls_statements STRING[] NOT NULL,
39633963
alter_statements STRING[] NOT NULL,
39643964
validate_statements STRING[] NOT NULL,
39653965
create_redactable STRING NOT NULL,
@@ -3984,7 +3984,7 @@ CREATE TABLE crdb_internal.create_statements (
39843984
var descType tree.Datum
39853985
var stmt, createNofk, createRedactable string
39863986
alterStmts := tree.NewDArray(types.String)
3987-
policyStmts := tree.NewDArray(types.String)
3987+
rlsStmts := tree.NewDArray(types.String)
39883988
validateStmts := tree.NewDArray(types.String)
39893989
namePrefix := tree.ObjectNamePrefix{SchemaName: tree.Name(sc.GetName()), ExplicitSchema: true}
39903990
name := tree.MakeTableNameFromPrefix(namePrefix, tree.Name(table.GetName()))
@@ -4007,8 +4007,7 @@ CREATE TABLE crdb_internal.create_statements (
40074007
} else {
40084008
descType = typeTable
40094009
displayOptions := ShowCreateDisplayOptions{
4010-
FKDisplayMode: OmitFKClausesFromCreate,
4011-
IgnoreRLSStatements: true,
4010+
FKDisplayMode: OmitFKClausesFromCreate,
40124011
}
40134012
createNofk, err = ShowCreateTable(ctx, p, &name, contextName, table, lookup, displayOptions)
40144013
if err != nil {
@@ -4019,12 +4018,12 @@ CREATE TABLE crdb_internal.create_statements (
40194018
return err
40204019
}
40214020

4022-
if err = showPolicyStatements(ctx, &name, table, p.EvalContext(), &p.semaCtx, p.SessionData(), policyStmts); err != nil {
4021+
if err = showRowLevelSecurityStatements(ctx, &name, table, p.EvalContext(), &p.semaCtx, p.SessionData(), rlsStmts); err != nil {
40234022
return err
40244023
}
40254024

40264025
displayOptions.FKDisplayMode = IncludeFkClausesInCreate
4027-
displayOptions.IgnoreRLSStatements = false
4026+
40284027
stmt, err = ShowCreateTable(ctx, p, &name, contextName, table, lookup, displayOptions)
40294028
if err != nil {
40304029
return err
@@ -4056,7 +4055,7 @@ CREATE TABLE crdb_internal.create_statements (
40564055
tree.NewDString(stmt),
40574056
tree.NewDString(table.GetState().String()),
40584057
tree.NewDString(createNofk),
4059-
policyStmts,
4058+
rlsStmts,
40604059
alterStmts,
40614060
validateStmts,
40624061
tree.NewDString(createRedactable),
@@ -4068,21 +4067,31 @@ CREATE TABLE crdb_internal.create_statements (
40684067
},
40694068
nil)
40704069

4071-
// showPolicyStatements adds the RLS policy statements to the policy_statements column.
4072-
func showPolicyStatements(
4070+
// showRowLevelSecurityStatements adds the RLS policy statements to the rls_statements column.
4071+
func showRowLevelSecurityStatements(
40734072
ctx context.Context,
40744073
tn *tree.TableName,
40754074
table catalog.TableDescriptor,
40764075
evalCtx *eval.Context,
40774076
semaCtx *tree.SemaContext,
40784077
sessionData *sessiondata.SessionData,
4079-
policyStmts *tree.DArray,
4078+
rlsStmts *tree.DArray,
40804079
) error {
4080+
// Add the row level security ALTER statements to the rls_statements column.
4081+
if alterRLSStatements, err := showRLSAlterStatement(tn, table, false); err != nil {
4082+
return err
4083+
} else if len(alterRLSStatements) != 0 {
4084+
if err = rlsStmts.Append(tree.NewDString(alterRLSStatements)); err != nil {
4085+
return err
4086+
}
4087+
}
4088+
4089+
// Add the row level security policy statements to the rls_statements column.
40814090
for _, policy := range table.GetPolicies() {
40824091
if policyStatement, err := showPolicyStatement(ctx, tn, table, evalCtx, semaCtx, sessionData, policy, false); err != nil {
40834092
return err
40844093
} else if len(policyStatement) != 0 {
4085-
if err := policyStmts.Append(tree.NewDString(policyStatement)); err != nil {
4094+
if err := rlsStmts.Append(tree.NewDString(policyStatement)); err != nil {
40864095
return err
40874096
}
40884097
}
@@ -4135,15 +4144,6 @@ func showAlterStatement(
41354144
}
41364145
}
41374146

4138-
// Add the row level security ALTER statements to the alter_statements column.
4139-
if alterRLSStatements, err := showRLSAlterStatement(tn, table, false); err != nil {
4140-
return err
4141-
} else if len(alterRLSStatements) != 0 {
4142-
if err = alterStmts.Append(tree.NewDString(alterRLSStatements)); err != nil {
4143-
return err
4144-
}
4145-
}
4146-
41474147
return nil
41484148
}
41494149

‎pkg/sql/delegate/show_table.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,11 @@ SELECT
9292
THEN NULL
9393
ELSE
9494
e'\n-- Warning: Partitioned table with no zone configurations.\n'
95+
END,
96+
CASE
97+
WHEN array_length(rls_statements, 1) > 0 THEN
98+
concat(e';\n', array_to_string(rls_statements, e';\n'))
99+
ELSE NULL
95100
END
96101
) AS create_statement
97102
FROM
@@ -253,7 +258,7 @@ func (d *delegator) delegateShowConstraints(n *tree.ShowConstraints) (tree.State
253258
obj_description(c.oid) AS comment`
254259
}
255260
getConstraintsQuery += `
256-
FROM
261+
FROM
257262
%[4]s.pg_catalog.pg_class t,
258263
%[4]s.pg_catalog.pg_namespace n,
259264
%[4]s.pg_catalog.pg_constraint c

‎pkg/sql/logictest/testdata/logic_test/crdb_internal‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -377,7 +377,7 @@ function signature category details schema oid
377377
query ITTITTTTTTTTTBBBB colnames
378378
SELECT * FROM crdb_internal.create_statements WHERE database_name = ''
379379
----
380-
database_id database_name schema_name descriptor_id descriptor_type descriptor_name create_statement state create_nofks policy_statements alter_statements validate_statements create_redactable has_partitions is_multi_region is_virtual is_temporary
380+
database_id database_name schema_name descriptor_id descriptor_type descriptor_name create_statement state create_nofks rls_statements alter_statements validate_statements create_redactable has_partitions is_multi_region is_virtual is_temporary
381381

382382
query ITITTBTB colnames
383383
SELECT * FROM crdb_internal.table_columns WHERE descriptor_name = ''

‎pkg/sql/logictest/testdata/logic_test/row_level_security‎

Lines changed: 10 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -644,11 +644,10 @@ CREATE TABLE public.flying_roaches (
644644
rowid INT8 NOT VISIBLE NOT NULL DEFAULT unique_rowid(),
645645
CONSTRAINT flying_roaches_pkey PRIMARY KEY (rowid ASC),
646646
CONSTRAINT "check" CHECK ('flying':::public.roach_type = 'crawling':::public.roach_type)
647-
);
648-
CREATE POLICY p1 ON public.flying_roaches AS PERMISSIVE FOR ALL TO public USING ('flying':::public.roach_type = 'crawling':::public.roach_type)
647+
)
649648

650649
query T
651-
select policy_statements from crdb_internal.create_statements where descriptor_name='flying_roaches'
650+
select rls_statements from crdb_internal.create_statements where descriptor_name='flying_roaches'
652651
----
653652
{"CREATE POLICY p1 ON public.flying_roaches AS PERMISSIVE FOR ALL TO public USING ('flying':::public.roach_type = 'crawling':::public.roach_type)"}
654653

@@ -767,21 +766,15 @@ select create_statement from crdb_internal.create_statements where descriptor_na
767766
CREATE TABLE public.roaches (
768767
rowid INT8 NOT VISIBLE NOT NULL DEFAULT unique_rowid(),
769768
CONSTRAINT roaches_pkey PRIMARY KEY (rowid ASC)
770-
);
771-
ALTER TABLE public.roaches ENABLE ROW LEVEL SECURITY, FORCE ROW LEVEL SECURITY
772-
773-
query TT
774-
select policy_statements, create_nofks from crdb_internal.create_statements where descriptor_name='roaches'
775-
----
776-
{} CREATE TABLE public.roaches (
777-
rowid INT8 NOT VISIBLE NOT NULL DEFAULT unique_rowid(),
778-
CONSTRAINT roaches_pkey PRIMARY KEY (rowid ASC)
779-
)
769+
)
780770

781-
query T
782-
select alter_statements from crdb_internal.create_statements where descriptor_name='roaches'
771+
query TTT
772+
select rls_statements, alter_statements, create_nofks from crdb_internal.create_statements where descriptor_name='roaches'
783773
----
784-
{"ALTER TABLE public.roaches ENABLE ROW LEVEL SECURITY, FORCE ROW LEVEL SECURITY"}
774+
{"ALTER TABLE public.roaches ENABLE ROW LEVEL SECURITY, FORCE ROW LEVEL SECURITY"} {} CREATE TABLE public.roaches (
775+
rowid INT8 NOT VISIBLE NOT NULL DEFAULT unique_rowid(),
776+
CONSTRAINT roaches_pkey PRIMARY KEY (rowid ASC)
777+
)
785778

786779
statement ok
787780
ALTER TABLE roaches DISABLE ROW LEVEL SECURITY, NO FORCE ROW LEVEL SECURITY;
@@ -795,15 +788,7 @@ roaches CREATE TABLE public.roaches (
795788
)
796789

797790
query T
798-
select create_statement from crdb_internal.create_statements where descriptor_name='roaches'
799-
----
800-
CREATE TABLE public.roaches (
801-
rowid INT8 NOT VISIBLE NOT NULL DEFAULT unique_rowid(),
802-
CONSTRAINT roaches_pkey PRIMARY KEY (rowid ASC)
803-
)
804-
805-
query T
806-
select policy_statements from crdb_internal.create_statements where descriptor_name='roaches'
791+
select rls_statements from crdb_internal.create_statements where descriptor_name='roaches'
807792
----
808793
{}
809794

‎pkg/sql/logictest/testdata/logic_test/sequences‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,8 +136,8 @@ CREATE SEQUENCE show_create_test
136136
query ITTITTTTTTTTTBBBB colnames
137137
SELECT * FROM crdb_internal.create_statements WHERE descriptor_name = 'show_create_test'
138138
----
139-
database_id database_name schema_name descriptor_id descriptor_type descriptor_name create_statement state create_nofks policy_statements alter_statements validate_statements create_redactable has_partitions is_multi_region is_virtual is_temporary
140-
104 test public 111 sequence show_create_test CREATE SEQUENCE public.show_create_test MINVALUE 1 MAXVALUE 9223372036854775807 INCREMENT 1 START 1 PUBLIC CREATE SEQUENCE public.show_create_test MINVALUE 1 MAXVALUE 9223372036854775807 INCREMENT 1 START 1 {} {} {} CREATE SEQUENCE public.show_create_test MINVALUE 1 MAXVALUE 9223372036854775807 INCREMENT 1 START 1 false false false false
139+
database_id database_name schema_name descriptor_id descriptor_type descriptor_name create_statement state create_nofks rls_statements alter_statements validate_statements create_redactable has_partitions is_multi_region is_virtual is_temporary
140+
104 test public 111 sequence show_create_test CREATE SEQUENCE public.show_create_test MINVALUE 1 MAXVALUE 9223372036854775807 INCREMENT 1 START 1 PUBLIC CREATE SEQUENCE public.show_create_test MINVALUE 1 MAXVALUE 9223372036854775807 INCREMENT 1 START 1 {} {} {} CREATE SEQUENCE public.show_create_test MINVALUE 1 MAXVALUE 9223372036854775807 INCREMENT 1 START 1 false false false false
141141

142142
query TT colnames
143143
SHOW CREATE SEQUENCE show_create_test

‎pkg/sql/show_create.go‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,6 @@ type ShowCreateDisplayOptions struct {
5757
// RedactableValues causes all constants, literals, and other user-provided
5858
// values to be surrounded with redaction markers.
5959
RedactableValues bool
60-
// IgnoreRLSStatements causes all row level security related statements to
61-
// not show up in the SHOW CREATE TABLE output.
62-
IgnoreRLSStatements bool
6360
}
6461

6562
// ShowCreateTable returns a valid SQL representation of the CREATE
@@ -201,24 +198,6 @@ func ShowCreateTable(
201198
return "", err
202199
}
203200

204-
if !displayOptions.IgnoreRLSStatements {
205-
if alterRLSStatements, err := showRLSAlterStatement(tn, desc, true); err != nil {
206-
return "", err
207-
} else {
208-
buf := &f.Buffer
209-
buf.WriteString(alterRLSStatements)
210-
}
211-
212-
for _, policyDesc := range desc.GetPolicies() {
213-
if policyStatements, err := showPolicyStatement(ctx, tn, desc, p.EvalContext(), &p.semaCtx, p.SessionData(), policyDesc, true); err != nil {
214-
return "", err
215-
} else {
216-
buf := &f.Buffer
217-
buf.WriteString(policyStatements)
218-
}
219-
}
220-
}
221-
222201
if !displayOptions.IgnoreComments {
223202
if err := showComments(tn, desc, selectComment(ctx, p, desc.GetID()), &f.Buffer); err != nil {
224203
return "", err

0 commit comments

Comments
 (0)