external
/
citus
mirror of https://github.com/citusdata/citus.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add basic permission checking tests

pull/1281/head
Metin Doslu 2017-03-22 16:18:13 +02:00 committed by Jason Petersen
parent bcff6aa96c
commit 404e32cdb4
No known key found for this signature in database
GPG Key ID: 9F1D3510D110ABA9
3 changed files with 235 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

138
src/test/regress/expected/multi_multiuser.out Normal file
View File

@ -0,0 +1,138 @@
--
-- MULTI_MULTIUSERS
--
-- Test user permissions.
--
ALTER SEQUENCE pg_catalog.pg_dist_shardid_seq RESTART 1420000;
ALTER SEQUENCE pg_catalog.pg_dist_jobid_seq RESTART 1420000;
SET citus.shard_replication_factor TO 1;
SET citus.shard_count TO 2;
CREATE TABLE test (id integer);
SELECT create_distributed_table('test', 'id');
create_distributed_table
--------------------------
(1 row)
CREATE USER full_access;
NOTICE: not propagating CREATE ROLE/USER commands to worker nodes
HINT: Connect to worker nodes directly to manually create all necessary users and roles.
CREATE USER read_access;
NOTICE: not propagating CREATE ROLE/USER commands to worker nodes
HINT: Connect to worker nodes directly to manually create all necessary users and roles.
CREATE USER no_access;
NOTICE: not propagating CREATE ROLE/USER commands to worker nodes
HINT: Connect to worker nodes directly to manually create all necessary users and roles.
GRANT ALL ON TABLE test TO full_access;
GRANT SELECT ON TABLE test TO read_access;
\c - - - :worker_1_port
CREATE USER full_access;
NOTICE: not propagating CREATE ROLE/USER commands to worker nodes
HINT: Connect to worker nodes directly to manually create all necessary users and roles.
CREATE USER read_access;
NOTICE: not propagating CREATE ROLE/USER commands to worker nodes
HINT: Connect to worker nodes directly to manually create all necessary users and roles.
CREATE USER no_access;
NOTICE: not propagating CREATE ROLE/USER commands to worker nodes
HINT: Connect to worker nodes directly to manually create all necessary users and roles.
GRANT ALL ON TABLE test_1420000 TO full_access;
GRANT SELECT ON TABLE test_1420000 TO read_access;
\c - - - :worker_2_port
CREATE USER full_access;
NOTICE: not propagating CREATE ROLE/USER commands to worker nodes
HINT: Connect to worker nodes directly to manually create all necessary users and roles.
CREATE USER read_access;
NOTICE: not propagating CREATE ROLE/USER commands to worker nodes
HINT: Connect to worker nodes directly to manually create all necessary users and roles.
CREATE USER no_access;
NOTICE: not propagating CREATE ROLE/USER commands to worker nodes
HINT: Connect to worker nodes directly to manually create all necessary users and roles.
GRANT ALL ON TABLE test_1420001 TO full_access;
GRANT SELECT ON TABLE test_1420001 TO read_access;
\c - - - :master_port
-- create prepare tests
PREPARE prepare_insert AS INSERT INTO test VALUES ($1);
PREPARE prepare_select AS SELECT count(*) FROM test;
-- check full permission
SET ROLE full_access;
EXECUTE prepare_insert(1);
EXECUTE prepare_select;
count
-------
1
(1 row)
INSERT INTO test VALUES (2);
SELECT count(*) FROM test;
count
-------
2
(1 row)
SELECT count(*) FROM test WHERE id = 1;
count
-------
1
(1 row)
SET citus.task_executor_type TO 'task-tracker';
SELECT count(*) FROM test;
count
-------
2
(1 row)
SET citus.task_executor_type TO 'real-time';
-- check read permission
SET ROLE read_access;
EXECUTE prepare_insert(1);
ERROR: permission denied for relation test
EXECUTE prepare_select;
count
-------
2
(1 row)
INSERT INTO test VALUES (2);
ERROR: permission denied for relation test
SELECT count(*) FROM test;
count
-------
2
(1 row)
SELECT count(*) FROM test WHERE id = 1;
count
-------
1
(1 row)
SET citus.task_executor_type TO 'task-tracker';
SELECT count(*) FROM test;
count
-------
2
(1 row)
SET citus.task_executor_type TO 'real-time';
-- check no permission
SET ROLE no_access;
EXECUTE prepare_insert(1);
ERROR: permission denied for relation test
EXECUTE prepare_select;
ERROR: permission denied for relation test
INSERT INTO test VALUES (2);
ERROR: permission denied for relation test
SELECT count(*) FROM test;
ERROR: permission denied for relation test
SELECT count(*) FROM test WHERE id = 1;
ERROR: permission denied for relation test
SET citus.task_executor_type TO 'task-tracker';
SELECT count(*) FROM test;
ERROR: permission denied for relation test
SET citus.task_executor_type TO 'real-time';
RESET ROLE;
DROP TABLE test;
DROP USER full_access;
DROP USER read_access;
DROP USER no_access;

5
src/test/regress/multi_schedule
View File

@ -225,3 +225,8 @@ test: multi_remove_node_reference_table
# multi_transactional_drop_shards tests for dropping shards using connection API # multi_transactional_drop_shards tests for dropping shards using connection API
# ---------- # ----------
test: multi_transactional_drop_shards test: multi_transactional_drop_shards
# ----------
# multi_multiuser tests simple combinations of permission access and queries
# ----------
test: multi_multiuser

92
src/test/regress/sql/multi_multiuser.sql Normal file
View File

@ -0,0 +1,92 @@
--
-- MULTI_MULTIUSERS
--
-- Test user permissions.
--
ALTER SEQUENCE pg_catalog.pg_dist_shardid_seq RESTART 1420000;
ALTER SEQUENCE pg_catalog.pg_dist_jobid_seq RESTART 1420000;
SET citus.shard_replication_factor TO 1;
SET citus.shard_count TO 2;
CREATE TABLE test (id integer);
SELECT create_distributed_table('test', 'id');
CREATE USER full_access;
CREATE USER read_access;
CREATE USER no_access;
GRANT ALL ON TABLE test TO full_access;
GRANT SELECT ON TABLE test TO read_access;
\c - - - :worker_1_port
CREATE USER full_access;
CREATE USER read_access;
CREATE USER no_access;
GRANT ALL ON TABLE test_1420000 TO full_access;
GRANT SELECT ON TABLE test_1420000 TO read_access;
\c - - - :worker_2_port
CREATE USER full_access;
CREATE USER read_access;
CREATE USER no_access;
GRANT ALL ON TABLE test_1420001 TO full_access;
GRANT SELECT ON TABLE test_1420001 TO read_access;
\c - - - :master_port
-- create prepare tests
PREPARE prepare_insert AS INSERT INTO test VALUES ($1);
PREPARE prepare_select AS SELECT count(*) FROM test;
-- check full permission
SET ROLE full_access;
EXECUTE prepare_insert(1);
EXECUTE prepare_select;
INSERT INTO test VALUES (2);
SELECT count(*) FROM test;
SELECT count(*) FROM test WHERE id = 1;
SET citus.task_executor_type TO 'task-tracker';
SELECT count(*) FROM test;
SET citus.task_executor_type TO 'real-time';
-- check read permission
SET ROLE read_access;
EXECUTE prepare_insert(1);
EXECUTE prepare_select;
INSERT INTO test VALUES (2);
SELECT count(*) FROM test;
SELECT count(*) FROM test WHERE id = 1;
SET citus.task_executor_type TO 'task-tracker';
SELECT count(*) FROM test;
SET citus.task_executor_type TO 'real-time';
-- check no permission
SET ROLE no_access;
EXECUTE prepare_insert(1);
EXECUTE prepare_select;
INSERT INTO test VALUES (2);
SELECT count(*) FROM test;
SELECT count(*) FROM test WHERE id = 1;
SET citus.task_executor_type TO 'task-tracker';
SELECT count(*) FROM test;
SET citus.task_executor_type TO 'real-time';
RESET ROLE;
DROP TABLE test;
DROP USER full_access;
DROP USER read_access;
DROP USER no_access;