Skip to content

Commit e6331e9

Browse files
nikvas0nikvas0
authored
Test for olap ACL (#12202)
1 parent cdcd6b8 commit e6331e9

File tree

1 file changed

+148
-0
lines changed

1 file changed

+148
-0
lines changed

‎ydb/core/kqp/ut/scheme/kqp_acl_ut.cpp

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,154 @@ Y_UNIT_TEST_SUITE(KqpAcl) {
212212

213213
driver.Stop(true);
214214
}
215+
216+
Y_UNIT_TEST_TWIN(AclForOltpAndOlap, isOlap) {
217+
const TString query = Sprintf(R"(
218+
CREATE TABLE `/Root/test_acl` (
219+
id Int64 NOT NULL,
220+
name String,
221+
primary key (id)
222+
) WITH (STORE=%s);
223+
)", isOlap ? "COLUMN" : "ROW");
224+
225+
TKikimrRunner kikimr;
226+
227+
{
228+
auto driverConfig = TDriverConfig()
229+
.SetEndpoint(kikimr.GetEndpoint())
230+
.SetAuthToken("root@builtin");
231+
auto driver = TDriver(driverConfig);
232+
auto client = NYdb::NQuery::TQueryClient(driver);
233+
234+
AssertSuccessResult(client.ExecuteQuery(query, NYdb::NQuery::TTxControl::NoTx()).ExtractValueSync());
235+
236+
driver.Stop(true);
237+
}
238+
239+
{
240+
auto schemeClient = kikimr.GetSchemeClient();
241+
NYdb::NScheme::TPermissions permissions("user0@builtin", {});
242+
AssertSuccessResult(schemeClient.ModifyPermissions("/Root/test_acl",
243+
NYdb::NScheme::TModifyPermissionsSettings().AddGrantPermissions(permissions)
244+
).ExtractValueSync()
245+
);
246+
}
247+
248+
{
249+
auto driverConfig = TDriverConfig()
250+
.SetEndpoint(kikimr.GetEndpoint())
251+
.SetAuthToken("user0@builtin");
252+
auto driver = TDriver(driverConfig);
253+
auto client = NYdb::NQuery::TQueryClient(driver);
254+
255+
auto result = client.ExecuteQuery(R"(
256+
SELECT * FROM `/Root/test_acl`;
257+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
258+
UNIT_ASSERT_C(!result.IsSuccess(), result.GetIssues().ToString());
259+
const auto expectedIssueMessage = "Cannot find table 'db.[/Root/test_acl]' because it does not exist or you do not have access permissions.";
260+
UNIT_ASSERT_C(result.GetIssues().ToString().Contains(expectedIssueMessage), result.GetIssues().ToString());
261+
262+
auto resultWrite = client.ExecuteQuery(R"(
263+
REPLACE INTO `/Root/test_acl` (id, name) VALUES (1, 'test');
264+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
265+
UNIT_ASSERT_C(!resultWrite.IsSuccess(), resultWrite.GetIssues().ToString());
266+
UNIT_ASSERT_C(resultWrite.GetIssues().ToString().Contains(expectedIssueMessage), resultWrite.GetIssues().ToString());
267+
268+
driver.Stop(true);
269+
}
270+
271+
{
272+
auto schemeClient = kikimr.GetSchemeClient();
273+
NYdb::NScheme::TPermissions permissions("user0@builtin", {"ydb.deprecated.describe_schema"});
274+
AssertSuccessResult(schemeClient.ModifyPermissions("/Root/test_acl",
275+
NYdb::NScheme::TModifyPermissionsSettings().AddGrantPermissions(permissions)
276+
).ExtractValueSync()
277+
);
278+
}
279+
280+
{
281+
auto driverConfig = TDriverConfig()
282+
.SetEndpoint(kikimr.GetEndpoint())
283+
.SetAuthToken("user0@builtin");
284+
auto driver = TDriver(driverConfig);
285+
auto client = NYdb::NQuery::TQueryClient(driver);
286+
287+
auto result = client.ExecuteQuery(R"(
288+
SELECT * FROM `/Root/test_acl`;
289+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
290+
UNIT_ASSERT_C(!result.IsSuccess(), result.GetIssues().ToString());
291+
const auto expectedIssueMessage = "Failed to resolve table `/Root/test_acl` status: AccessDenied., code: 2028";
292+
UNIT_ASSERT_C(result.GetIssues().ToString().Contains(expectedIssueMessage), result.GetIssues().ToString());
293+
294+
auto resultWrite = client.ExecuteQuery(R"(
295+
REPLACE INTO `/Root/test_acl` (id, name) VALUES (1, 'test');
296+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
297+
UNIT_ASSERT_C(!resultWrite.IsSuccess(), resultWrite.GetIssues().ToString());
298+
UNIT_ASSERT_C(resultWrite.GetIssues().ToString().Contains(expectedIssueMessage), resultWrite.GetIssues().ToString());
299+
300+
driver.Stop(true);
301+
}
302+
303+
{
304+
auto schemeClient = kikimr.GetSchemeClient();
305+
NYdb::NScheme::TPermissions permissions("user0@builtin", {"ydb.deprecated.describe_schema", "ydb.deprecated.select_row"});
306+
AssertSuccessResult(schemeClient.ModifyPermissions("/Root/test_acl",
307+
NYdb::NScheme::TModifyPermissionsSettings().AddGrantPermissions(permissions)
308+
).ExtractValueSync()
309+
);
310+
}
311+
312+
{
313+
auto driverConfig = TDriverConfig()
314+
.SetEndpoint(kikimr.GetEndpoint())
315+
.SetAuthToken("user0@builtin");
316+
auto driver = TDriver(driverConfig);
317+
auto client = NYdb::NQuery::TQueryClient(driver);
318+
319+
auto result = client.ExecuteQuery(R"(
320+
SELECT * FROM `/Root/test_acl`;
321+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
322+
UNIT_ASSERT_C(result.IsSuccess(), result.GetIssues().ToString());
323+
324+
auto resultWrite = client.ExecuteQuery(R"(
325+
REPLACE INTO `/Root/test_acl` (id, name) VALUES (1, 'test');
326+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
327+
UNIT_ASSERT_C(!resultWrite.IsSuccess(), resultWrite.GetIssues().ToString());
328+
const auto expectedIssueMessage = "Failed to resolve table `/Root/test_acl` status: AccessDenied., code: 2028";
329+
UNIT_ASSERT_C(resultWrite.GetIssues().ToString().Contains(expectedIssueMessage), resultWrite.GetIssues().ToString());
330+
331+
driver.Stop(true);
332+
}
333+
334+
{
335+
auto schemeClient = kikimr.GetSchemeClient();
336+
NYdb::NScheme::TPermissions permissions("user0@builtin", {"ydb.deprecated.update_row"});
337+
AssertSuccessResult(schemeClient.ModifyPermissions("/Root/test_acl",
338+
NYdb::NScheme::TModifyPermissionsSettings().AddGrantPermissions(permissions)
339+
).ExtractValueSync()
340+
);
341+
}
342+
343+
{
344+
auto driverConfig = TDriverConfig()
345+
.SetEndpoint(kikimr.GetEndpoint())
346+
.SetAuthToken("user0@builtin");
347+
auto driver = TDriver(driverConfig);
348+
auto client = NYdb::NQuery::TQueryClient(driver);
349+
350+
auto result = client.ExecuteQuery(R"(
351+
SELECT * FROM `/Root/test_acl`;
352+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
353+
UNIT_ASSERT_C(result.IsSuccess(), result.GetIssues().ToString());
354+
355+
auto resultWrite = client.ExecuteQuery(R"(
356+
REPLACE INTO `/Root/test_acl` (id, name) VALUES (1, 'test');
357+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
358+
UNIT_ASSERT_C(resultWrite.IsSuccess(), resultWrite.GetIssues().ToString());
359+
360+
driver.Stop(true);
361+
}
362+
}
215363
}
216364

217365
} // namespace NKqp

0 commit comments

Comments
 (0)