Spr 805 policy tables#543
Conversation
…re temporary tables.
SPR-805 Policy tables and trigger functions to support Row level security + policies
|
…son settings; add POLICY test_cases.
- Next thing to do is to reuse the test logic between nightly test and CI test so don't have to maintain two copies. Will do that in a separate PR. - Fix docker network
craigsoules
left a comment
craigsoules
left a comment
There was a problem hiding this comment.
Mostly minor comments.
| const std::unordered_map<uint64_t, std::unordered_map<uint64_t, | ||
| std::pair<std::string, std::string>>> &user_types); |
There was a problem hiding this comment.
Maybe define some types for these?
| * @param cmd SQL command | ||
| * @return true if result is successful; false otherwise; check result separately | ||
| */ | ||
| bool exec_no_throw(const std::string &cmd, bool use_savepoint = true); |
There was a problem hiding this comment.
If these can't throw exceptions, let's mark them as noexcept?
There was a problem hiding this comment.
Maybe it is badly named, but it won't throw an exception on a failed query, but other exceptions may be thrown. The normal version of exec() throws an exception on a query failure.
| static constexpr char CREATE_FDW_USER[] = | ||
| "CREATE USER {} WITH LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE PASSWORD '{}'"; | ||
| static constexpr char CREATE_USER[] = | ||
| "CREATE USER {} WITH LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE PASSWORD '{}' IN ROLE pg_read_all_data"; |
There was a problem hiding this comment.
Is pg_read_all_data a role that we create elsewhere? Or is it guaranteed to exist?
There was a problem hiding this comment.
it is a postgres system role; so it exists.
There was a problem hiding this comment.
I do need to verify that this works for new table creates. But will need the user mgmt through the proxy to verify, so will do that in a separate PR.
…ingtail into SPR-805-policy-tables
|
2 participants
Added row level security columns to table names system table rls_enabled and rls_forced
Added sync for roles, role membership and table policies
Added sync for table ownership only for tables that have row policies -- NO TEST FOR THIS YET.
Other cleanup to some of the other tests
Random other cleanup