Skip to content

Commit 9c75f0c

Browse files
n00bcrackern00bcracker
authored
System views creation in SchemeShard under FeatureFlag (#19377)
1 parent fd935ba commit 9c75f0c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+2079
-750
lines changed

‎ydb/core/kqp/ut/scheme/kqp_scheme_ut.cpp

Lines changed: 145 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1172,7 +1172,7 @@ Y_UNIT_TEST_SUITE(KqpScheme) {
11721172
Value String,
11731173
PRIMARY KEY (Key)
11741174
)
1175-
)")
1175+
)")
11761176
+ (СolumnTable ? TString("WITH (STORE = COLUMN)") : "");
11771177
auto result = session.ExecuteSchemeQuery(query).GetValueSync();
11781178
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
@@ -4850,6 +4850,150 @@ Y_UNIT_TEST_SUITE(KqpScheme) {
48504850
}
48514851
}
48524852

4853+
Y_UNIT_TEST(ModifySysViewDirPermissions) {
4854+
NKikimrConfig::TFeatureFlags featureFlags;
4855+
featureFlags.SetEnableRealSystemViewPaths(true);
4856+
TKikimrRunner kikimr(featureFlags);
4857+
kikimr.GetTestServer().GetRuntime()->GetAppData().AdministrationAllowedSIDs.push_back("root@builtin");
4858+
4859+
auto adminSession = kikimr.GetTableClient(NYdb::NTable::TClientSettings()
4860+
.AuthToken("root@builtin")).CreateSession().GetValueSync().GetSession();
4861+
4862+
{
4863+
auto query = TStringBuilder() << R"(
4864+
--!syntax_v1
4865+
GRANT 'ydb.granular.describe_schema' ON `/Root` TO `root@builtin`;
4866+
GRANT 'ydb.database.connect' ON `/Root` TO `user@builtin`;
4867+
)";
4868+
auto result = adminSession.ExecuteSchemeQuery(query).GetValueSync();
4869+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
4870+
}
4871+
4872+
auto driverConfig = kikimr.GetDriverConfig();
4873+
driverConfig.SetAuthToken("user@builtin");
4874+
const auto driver = TDriver(driverConfig);
4875+
auto userSchemeClient = NYdb::NScheme::TSchemeClient(driver);
4876+
4877+
auto userSession = kikimr.GetTableClient(NYdb::NTable::TClientSettings()
4878+
.AuthToken("user@builtin")).CreateSession().GetValueSync().GetSession();
4879+
4880+
{
4881+
auto result = userSchemeClient.ListDirectory("/Root/.sys").GetValueSync();
4882+
UNIT_ASSERT_VALUES_EQUAL(result.GetStatus(), EStatus::UNAUTHORIZED);
4883+
UNIT_ASSERT_STRING_CONTAINS_C(result.GetIssues().ToString(), "Access denied",
4884+
result.GetIssues().ToString()
4885+
);
4886+
}
4887+
{
4888+
auto query = TStringBuilder() << R"(
4889+
--!syntax_v1
4890+
GRANT 'ydb.granular.describe_schema' ON `/Root/.sys` TO `user@builtin`;
4891+
)";
4892+
auto result = adminSession.ExecuteSchemeQuery(query).GetValueSync();
4893+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
4894+
CheckPermissions(adminSession, {
4895+
{.Path = "/Root/.sys",
4896+
.Permissions = {
4897+
{"user@builtin", {"ydb.granular.describe_schema"}}
4898+
}
4899+
},
4900+
});
4901+
}
4902+
{
4903+
auto result = userSchemeClient.ListDirectory("/Root/.sys").GetValueSync();
4904+
UNIT_ASSERT_C(result.IsSuccess(), result.GetIssues().ToString());
4905+
4906+
auto children = result.GetChildren();
4907+
THashSet<TString> names;
4908+
for (const auto& child : children) {
4909+
names.insert(TString{child.Name});
4910+
UNIT_ASSERT_VALUES_EQUAL(child.Type, NYdb::NScheme::ESchemeEntryType::SysView);
4911+
}
4912+
UNIT_ASSERT(names.contains("partition_stats"));
4913+
}
4914+
{
4915+
auto query = TStringBuilder() << R"(
4916+
--!syntax_v1
4917+
GRANT 'ydb.granular.alter_schema' ON `/Root/.sys` TO `root@builtin`;
4918+
)";
4919+
auto result = userSession.ExecuteSchemeQuery(query).GetValueSync();
4920+
UNIT_ASSERT_VALUES_EQUAL(result.GetStatus(), EStatus::UNAUTHORIZED);
4921+
UNIT_ASSERT_STRING_CONTAINS_C(result.GetIssues().ToString(), "Access denied",
4922+
result.GetIssues().ToString()
4923+
);
4924+
}
4925+
{
4926+
auto query = TStringBuilder() << R"(
4927+
--!syntax_v1
4928+
GRANT 'ydb.access.grant', 'ydb.granular.alter_schema' ON `/Root/.sys` TO `user@builtin`;
4929+
)";
4930+
auto result = adminSession.ExecuteSchemeQuery(query).GetValueSync();
4931+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
4932+
CheckPermissions(adminSession, {{.Path = "/Root/.sys",
4933+
.Permissions = {
4934+
{"user@builtin", {"ydb.granular.describe_schema",
4935+
"ydb.granular.alter_schema",
4936+
"ydb.access.grant"}}
4937+
}
4938+
}});
4939+
}
4940+
{
4941+
auto query = TStringBuilder() << R"(
4942+
--!syntax_v1
4943+
GRANT 'ydb.granular.alter_schema' ON `/Root/.sys` TO `root@builtin`;
4944+
)";
4945+
auto result = userSession.ExecuteSchemeQuery(query).GetValueSync();
4946+
UNIT_ASSERT_C(result.IsSuccess(), result.GetIssues().ToString());
4947+
}
4948+
}
4949+
4950+
Y_UNIT_TEST(ModifySysViewPermissions) {
4951+
NKikimrConfig::TFeatureFlags featureFlags;
4952+
featureFlags.SetEnableRealSystemViewPaths(true);
4953+
TKikimrRunner kikimr(featureFlags, "root@builtin");
4954+
4955+
auto userSchemeClient = kikimr.GetSchemeClient();
4956+
auto db = kikimr.GetTableClient();
4957+
auto userSession = db.CreateSession().GetValueSync().GetSession();
4958+
auto querySelect = TStringBuilder() << R"(
4959+
--!syntax_v1
4960+
SELECT * FROM `/Root/.sys/partition_stats`;
4961+
)";
4962+
4963+
{
4964+
auto result = userSession.ExecuteDataQuery(querySelect, TTxControl::BeginTx().CommitTx()).ExtractValueSync();
4965+
UNIT_ASSERT_VALUES_EQUAL(result.GetStatus(), EStatus::SCHEME_ERROR);
4966+
UNIT_ASSERT_STRING_CONTAINS_C(result.GetIssues().ToString(),
4967+
"it does not exist or you do not have access permissions",
4968+
result.GetIssues().ToString()
4969+
);
4970+
}
4971+
{
4972+
auto query = TStringBuilder() << R"(
4973+
--!syntax_v1
4974+
GRANT 'ydb.generic.read' ON `/Root/.sys/partition_stats` TO `root@builtin`;
4975+
)";
4976+
auto result = userSession.ExecuteSchemeQuery(query).GetValueSync();
4977+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
4978+
CheckPermissions(userSession, {
4979+
{.Path = "/Root/.sys/partition_stats",
4980+
.Permissions = {
4981+
{"root@builtin", {"ydb.generic.read"}}
4982+
}
4983+
},
4984+
});
4985+
}
4986+
{
4987+
auto result = userSession.ExecuteDataQuery(querySelect, TTxControl::BeginTx().CommitTx()).ExtractValueSync();
4988+
UNIT_ASSERT_C(result.IsSuccess(), result.GetIssues().ToString());
4989+
UNIT_ASSERT_VALUES_EQUAL(result.GetResultSets().size(), 1);
4990+
4991+
auto rs = result.GetResultSet(0);
4992+
UNIT_ASSERT_VALUES_EQUAL(rs.RowsCount(), 34);
4993+
UNIT_ASSERT_VALUES_EQUAL(rs.ColumnsCount(), 30);
4994+
}
4995+
}
4996+
48534997
Y_UNIT_TEST(ModifyUnknownPermissions) {
48544998
TKikimrRunner kikimr;
48554999
auto db = kikimr.GetTableClient();

0 commit comments

Comments
 (0)