Skip to content

Commit 814e885

Browse files
nikvas0nikvas0
authored
ACL test for olap (#13270)
1 parent c7db92a commit 814e885

File tree

1 file changed

+143
-0
lines changed

1 file changed

+143
-0
lines changed

‎ydb/core/kqp/ut/scheme/kqp_acl_ut.cpp‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -353,6 +353,149 @@ Y_UNIT_TEST_SUITE(KqpAcl) {
353353
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
354354
UNIT_ASSERT_C(resultWrite.IsSuccess(), resultWrite.GetIssues().ToString());
355355

356+
auto resultDelete = client.ExecuteQuery(R"(
357+
DELETE FROM `/Root/test_acl` WHERE 1=1;
358+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
359+
UNIT_ASSERT_C(!resultDelete.IsSuccess(), resultDelete.GetIssues().ToString());
360+
const auto expectedIssueMessage = "Failed to resolve table `/Root/test_acl` status: AccessDenied., code: 2028";
361+
UNIT_ASSERT_C(resultDelete.GetIssues().ToString().Contains(expectedIssueMessage), resultDelete.GetIssues().ToString());
362+
363+
driver.Stop(true);
364+
}
365+
366+
{
367+
auto schemeClient = kikimr.GetSchemeClient();
368+
NYdb::NScheme::TPermissions permissions("user0@builtin", {"ydb.deprecated.erase_row"});
369+
NYdb::NScheme::TPermissions revokePermissions("user0@builtin", {"ydb.deprecated.update_row"});
370+
AssertSuccessResult(schemeClient.ModifyPermissions("/Root/test_acl",
371+
NYdb::NScheme::TModifyPermissionsSettings()
372+
.AddGrantPermissions(permissions)
373+
.AddRevokePermissions(revokePermissions)
374+
).ExtractValueSync()
375+
);
376+
}
377+
378+
{
379+
auto driverConfig = TDriverConfig()
380+
.SetEndpoint(kikimr.GetEndpoint())
381+
.SetAuthToken("user0@builtin");
382+
auto driver = TDriver(driverConfig);
383+
auto client = NYdb::NQuery::TQueryClient(driver);
384+
385+
auto result = client.ExecuteQuery(R"(
386+
SELECT * FROM `/Root/test_acl`;
387+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
388+
UNIT_ASSERT_C(result.IsSuccess(), result.GetIssues().ToString());
389+
390+
auto resultWrite = client.ExecuteQuery(R"(
391+
REPLACE INTO `/Root/test_acl` (id, name) VALUES (1, 'test');
392+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
393+
UNIT_ASSERT_C(!resultWrite.IsSuccess(), resultWrite.GetIssues().ToString());
394+
const auto expectedIssueMessage = "Failed to resolve table `/Root/test_acl` status: AccessDenied., code: 2028";
395+
UNIT_ASSERT_C(resultWrite.GetIssues().ToString().Contains(expectedIssueMessage), resultWrite.GetIssues().ToString());
396+
397+
auto resultDelete = client.ExecuteQuery(R"(
398+
DELETE FROM `/Root/test_acl` WHERE 1=1;
399+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
400+
UNIT_ASSERT_C(resultDelete.IsSuccess(), resultDelete.GetIssues().ToString());
401+
402+
driver.Stop(true);
403+
}
404+
405+
{
406+
auto schemeClient = kikimr.GetSchemeClient();
407+
NYdb::NScheme::TPermissions permissions("user0@builtin", {"ydb.deprecated.erase_row", "ydb.deprecated.update_row"});
408+
AssertSuccessResult(schemeClient.ModifyPermissions("/Root/test_acl",
409+
NYdb::NScheme::TModifyPermissionsSettings().AddGrantPermissions(permissions)
410+
).ExtractValueSync()
411+
);
412+
}
413+
414+
{
415+
auto driverConfig = TDriverConfig()
416+
.SetEndpoint(kikimr.GetEndpoint())
417+
.SetAuthToken("user0@builtin");
418+
auto driver = TDriver(driverConfig);
419+
auto client = NYdb::NQuery::TQueryClient(driver);
420+
421+
auto result = client.ExecuteQuery(R"(
422+
SELECT * FROM `/Root/test_acl`;
423+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
424+
UNIT_ASSERT_C(result.IsSuccess(), result.GetIssues().ToString());
425+
426+
auto resultWrite = client.ExecuteQuery(R"(
427+
REPLACE INTO `/Root/test_acl` (id, name) VALUES (1, 'test');
428+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
429+
UNIT_ASSERT_C(resultWrite.IsSuccess(), resultWrite.GetIssues().ToString());
430+
431+
auto resultDelete = client.ExecuteQuery(R"(
432+
DELETE FROM `/Root/test_acl` WHERE 1=1;
433+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
434+
UNIT_ASSERT_C(resultDelete.IsSuccess(), resultDelete.GetIssues().ToString());
435+
436+
driver.Stop(true);
437+
}
438+
439+
{
440+
auto schemeClient = kikimr.GetSchemeClient();
441+
NYdb::NScheme::TPermissions revokePermissions("user0@builtin", {"ydb.deprecated.select_row"});
442+
AssertSuccessResult(schemeClient.ModifyPermissions("/Root/test_acl",
443+
NYdb::NScheme::TModifyPermissionsSettings()
444+
.AddRevokePermissions(revokePermissions)
445+
).ExtractValueSync()
446+
);
447+
}
448+
449+
{
450+
auto driverConfig = TDriverConfig()
451+
.SetEndpoint(kikimr.GetEndpoint())
452+
.SetAuthToken("user0@builtin");
453+
auto driver = TDriver(driverConfig);
454+
auto client = NYdb::NQuery::TQueryClient(driver);
455+
456+
auto result = client.ExecuteQuery(R"(
457+
SELECT * FROM `/Root/test_acl`;
458+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
459+
UNIT_ASSERT_C(!result.IsSuccess(), result.GetIssues().ToString());
460+
const auto expectedIssueMessage = "Failed to resolve table `/Root/test_acl` status: AccessDenied., code: 2028";
461+
UNIT_ASSERT_C(result.GetIssues().ToString().Contains(expectedIssueMessage), result.GetIssues().ToString());
462+
463+
auto resultWrite = client.ExecuteQuery(R"(
464+
REPLACE INTO `/Root/test_acl` (id, name) VALUES (1, 'test');
465+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
466+
UNIT_ASSERT_C(resultWrite.IsSuccess(), resultWrite.GetIssues().ToString());
467+
468+
auto resultDelete = client.ExecuteQuery(R"(
469+
DELETE FROM `/Root/test_acl` WHERE 1=1;
470+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
471+
UNIT_ASSERT_C(!resultDelete.IsSuccess(), resultDelete.GetIssues().ToString());
472+
UNIT_ASSERT_C(resultDelete.GetIssues().ToString().Contains(expectedIssueMessage), resultDelete.GetIssues().ToString());
473+
474+
driver.Stop(true);
475+
}
476+
477+
{
478+
auto driverConfig = TDriverConfig()
479+
.SetEndpoint(kikimr.GetEndpoint())
480+
.SetAuthToken("user0@builtin");
481+
auto driver = TDriver(driverConfig);
482+
auto client = NYdb::NQuery::TQueryClient(driver);
483+
484+
auto result = client.ExecuteQuery(R"(
485+
INSERT INTO `/Root/test_acl` (id, name) VALUES (100, 'test');
486+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
487+
UNIT_ASSERT_C(result.IsSuccess(), result.GetIssues().ToString());
488+
489+
auto resultWrite = client.ExecuteQuery(R"(
490+
UPDATE `/Root/test_acl` ON SELECT 100 AS id, 'new test' AS name;
491+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
492+
UNIT_ASSERT_C(resultWrite.IsSuccess(), resultWrite.GetIssues().ToString());
493+
494+
auto resultDelete = client.ExecuteQuery(R"(
495+
DELETE FROM `/Root/test_acl` ON SELECT 100 AS id;
496+
)", NYdb::NQuery::TTxControl::BeginTx().CommitTx()).ExtractValueSync();
497+
UNIT_ASSERT_C(resultDelete.IsSuccess(), resultDelete.GetIssues().ToString());
498+
356499
driver.Stop(true);
357500
}
358501
}

0 commit comments

Comments
 (0)