diff options
| -rw-r--r-- | src/test/regress/expected/rowsecurity.out | 41 | ||||
| -rw-r--r-- | src/test/regress/sql/rowsecurity.sql | 3 |
2 files changed, 24 insertions, 20 deletions
diff --git a/src/test/regress/expected/rowsecurity.out b/src/test/regress/expected/rowsecurity.out index 0ae555783bd..65bea11963d 100644 --- a/src/test/regress/expected/rowsecurity.out +++ b/src/test/regress/expected/rowsecurity.out @@ -68,6 +68,8 @@ INSERT INTO document VALUES ( 6, 22, 1, 'rls_regress_user2', 'great science fiction'), ( 7, 33, 2, 'rls_regress_user2', 'great technology book'), ( 8, 44, 1, 'rls_regress_user2', 'great manga'); +VACUUM ANALYZE category; +VACUUM ANALYZE document; ALTER TABLE document ENABLE ROW LEVEL SECURITY; -- user's security level must be higher than or equal to document's CREATE POLICY p1 ON document @@ -184,20 +186,19 @@ EXPLAIN (COSTS OFF) SELECT * FROM document WHERE f_leak(dtitle); (7 rows) EXPLAIN (COSTS OFF) SELECT * FROM document NATURAL JOIN category WHERE f_leak(dtitle); - QUERY PLAN ----------------------------------------------------------------------- - Hash Join - Hash Cond: (category.cid = document.cid) + QUERY PLAN +---------------------------------------------------------------- + Nested Loop + Join Filter: (document.cid = category.cid) + -> Subquery Scan on document + Filter: f_leak(document.dtitle) + -> Seq Scan on document document_1 + Filter: (dlevel <= $0) + InitPlan 1 (returns $0) + -> Index Scan using uaccount_pkey on uaccount + Index Cond: (pguser = "current_user"()) -> Seq Scan on category - -> Hash - -> Subquery Scan on document - Filter: f_leak(document.dtitle) - -> Seq Scan on document document_1 - Filter: (dlevel <= $0) - InitPlan 1 (returns $0) - -> Index Scan using uaccount_pkey on uaccount - Index Cond: (pguser = "current_user"()) -(11 rows) +(10 rows) -- only owner can change policies ALTER POLICY p1 ON document USING (true); --fail @@ -275,12 +276,12 @@ EXPLAIN (COSTS OFF) SELECT * FROM document NATURAL JOIN category WHERE f_leak(dt QUERY PLAN ---------------------------------------------------- Nested Loop + Join Filter: (document.cid = category.cid) -> Subquery Scan on document Filter: f_leak(document.dtitle) -> Seq Scan on document document_1 Filter: (dauthor = "current_user"()) - -> Index Scan using category_pkey on category - Index Cond: (cid = document.cid) + -> Seq Scan on category (7 rows) -- interaction of FK/PK constraints @@ -295,12 +296,12 @@ SET SESSION AUTHORIZATION rls_regress_user1; SELECT * FROM document d FULL OUTER JOIN category c on d.cid = c.cid; did | cid | dlevel | dauthor | dtitle | cid | cname -----+-----+--------+-------------------+--------------------+-----+------------ - 2 | 11 | 2 | rls_regress_user1 | my second novel | 11 | novel 1 | 11 | 1 | rls_regress_user1 | my first novel | 11 | novel - | | | | | 33 | technology - 5 | 44 | 2 | rls_regress_user1 | my second manga | | - 4 | 44 | 1 | rls_regress_user1 | my first manga | | + 2 | 11 | 2 | rls_regress_user1 | my second novel | 11 | novel 3 | 22 | 2 | rls_regress_user1 | my science fiction | | + 4 | 44 | 1 | rls_regress_user1 | my first manga | | + 5 | 44 | 2 | rls_regress_user1 | my second manga | | + | | | | | 33 | technology (6 rows) DELETE FROM category WHERE cid = 33; -- fails with FK violation @@ -312,8 +313,8 @@ SELECT * FROM document d FULL OUTER JOIN category c on d.cid = c.cid; did | cid | dlevel | dauthor | dtitle | cid | cname -----+-----+--------+-------------------+-----------------------+-----+----------------- 6 | 22 | 1 | rls_regress_user2 | great science fiction | 22 | science fiction - 8 | 44 | 1 | rls_regress_user2 | great manga | 44 | manga 7 | 33 | 2 | rls_regress_user2 | great technology book | | + 8 | 44 | 1 | rls_regress_user2 | great manga | 44 | manga (3 rows) INSERT INTO document VALUES (10, 33, 1, current_user, 'hoge'); diff --git a/src/test/regress/sql/rowsecurity.sql b/src/test/regress/sql/rowsecurity.sql index fdadf99fd62..57c9c9364e9 100644 --- a/src/test/regress/sql/rowsecurity.sql +++ b/src/test/regress/sql/rowsecurity.sql @@ -82,6 +82,9 @@ INSERT INTO document VALUES ( 7, 33, 2, 'rls_regress_user2', 'great technology book'), ( 8, 44, 1, 'rls_regress_user2', 'great manga'); +VACUUM ANALYZE category; +VACUUM ANALYZE document; + ALTER TABLE document ENABLE ROW LEVEL SECURITY; -- user's security level must be higher than or equal to document's |