Skip to content

do not merge until OSS will support it - add MASKING POLICY support to RBAC restore #1466

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Slach wants to merge 1 commit into
base: master
Choose a base branch
from
+27 −9
Open

do not merge until OSS will support it - add MASKING POLICY support to RBAC restore #1466

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 15 additions & 9 deletions pkg/backup/restore.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -746,20 +746,24 @@ func (b *Backuper) isRBACExists(ctx context.Context, kind string, name string, a
"SETTINGS PROFILE": "settings_profiles",
"QUOTA": "quotas",
"USER": "users",
"MASKING POLICY": "masking_policies",
}
systemTable, systemTableExists := rbacSystemTableNames[kind]
if !systemTableExists {
log.Error().Msgf("unsupported RBAC object kind: %s", kind)
return false, "", nil
}
isRBACExistsSQL := fmt.Sprintf("SELECT toString(id) AS id, name FROM `system`.`%s` WHERE name=? LIMIT 1", systemTable)
existsRBACRow := make([]clickhouse.RBACObject, 0)
if err := b.ch.SelectContext(ctx, &existsRBACRow, isRBACExistsSQL, name); err != nil {
log.Warn().Msgf("RBAC object resolve failed, check SQL GRANTS or <access_management> settings for user which you use to connect to clickhouse-server, kind: %s, name: %s, error: %v", kind, name, err)
return false, "", nil
}
if len(existsRBACRow) != 0 {
return true, "sql", []string{existsRBACRow[0].Id}
// system.masking_policies exists only in 26.8+, on older versions check only local and keeper user directories
if systemTable != "masking_policies" || version >= 26008000 {
isRBACExistsSQL := fmt.Sprintf("SELECT toString(id) AS id, name FROM `system`.`%s` WHERE name=? LIMIT 1", systemTable)
existsRBACRow := make([]clickhouse.RBACObject, 0)
if err := b.ch.SelectContext(ctx, &existsRBACRow, isRBACExistsSQL, name); err != nil {
log.Warn().Msgf("RBAC object resolve failed, check SQL GRANTS or <access_management> settings for user which you use to connect to clickhouse-server, kind: %s, name: %s, error: %v", kind, name, err)
return false, "", nil
}
if len(existsRBACRow) != 0 {
return true, "sql", []string{existsRBACRow[0].Id}
}
}
}

Expand Down Expand Up @@ -859,6 +863,7 @@ func (b *Backuper) dropExistsRBAC(ctx context.Context, kind string, name string,
"SETTINGS PROFILE": "S",
"QUOTA": "Q",
"USER": "U",
"MASKING POLICY": "M",
}
keeperRBACTypePrefix, isKeeperRBACTypePrefixExists := keeperPrefixesRBAC[kind]
if !isKeeperRBACTypePrefixExists {
Expand Down Expand Up @@ -904,6 +909,7 @@ func (b *Backuper) detectRBACObject(sql string) (string, string, error) {
"ATTACH SETTINGS PROFILE": "SETTINGS PROFILE",
"ATTACH QUOTA": "QUOTA",
"ATTACH USER": "USER",
"ATTACH MASKING POLICY": "MASKING POLICY",
}

// Iterate over the prefixes to find a match.
Expand Down Expand Up @@ -932,7 +938,7 @@ func (b *Backuper) detectRBACObject(sql string) (string, string, error) {
} else {
name = names[0]
}
if kind != "ROW POLICY" {
if kind != "ROW POLICY" && kind != "MASKING POLICY" {
name = strings.Trim(name, "`")
}
name = strings.TrimSpace(name)
Expand Down
12 changes: 12 additions & 0 deletions pkg/backup/restore_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,18 @@ func TestDetectRBACObject(t *testing.T) {
expectedName: "test_rbac",
expectedErr: nil,
},
{
inputSQL: "ATTACH MASKING POLICY `test_rbac` ON default.test_rbac UPDATE name = 'xxx' TO ID('e1469fb8-e014-c22b-4e5c-406134320f91');\n",
expectedKind: "MASKING POLICY",
expectedName: "`test_rbac` ON default.test_rbac",
expectedErr: nil,
},
{
inputSQL: "ATTACH MASKING POLICY mask_email ON default.users UPDATE email = concat(substring(email, 1, 2), '***') WHERE 1 TO ALL PRIORITY 1;\n",
expectedKind: "MASKING POLICY",
expectedName: "mask_email ON default.users",
expectedErr: nil,
},
{
inputSQL: "INVALID SQL",
expectedKind: "",
Expand Down
Loading