mirror of https://github.com/citusdata/citus.git
112 lines
5.3 KiB
Plaintext
112 lines
5.3 KiB
Plaintext
-- SECLABEL
|
|
--
|
|
-- Test suite for running SECURITY LABEL ON ROLE statements from non-main databases
|
|
SET citus.enable_create_database_propagation to ON;
|
|
CREATE DATABASE database1;
|
|
CREATE DATABASE database2;
|
|
\c - - - :worker_1_port
|
|
SET citus.enable_create_database_propagation to ON;
|
|
CREATE DATABASE database_w1;
|
|
\c - - - :master_port
|
|
CREATE ROLE user1;
|
|
\c database1
|
|
SHOW citus.main_db;
|
|
citus.main_db
|
|
---------------------------------------------------------------------
|
|
regression
|
|
(1 row)
|
|
|
|
SHOW citus.superuser;
|
|
citus.superuser
|
|
---------------------------------------------------------------------
|
|
postgres
|
|
(1 row)
|
|
|
|
CREATE ROLE "user 2";
|
|
-- Set a SECURITY LABEL on a role from a non-main database
|
|
SECURITY LABEL FOR "citus '!tests_label_provider" ON ROLE user1 IS 'citus_classified';
|
|
SECURITY LABEL FOR "citus '!tests_label_provider" ON ROLE "user 2" IS 'citus_unclassified';
|
|
-- Check the result
|
|
\c regression
|
|
SELECT node_type, result FROM get_citus_tests_label_provider_labels('user1') ORDER BY node_type;
|
|
node_type | result
|
|
---------------------------------------------------------------------
|
|
coordinator | {"label": "citus_classified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
worker_1 | {"label": "citus_classified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
worker_2 | {"label": "citus_classified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
(3 rows)
|
|
|
|
SELECT node_type, result FROM get_citus_tests_label_provider_labels('"user 2"') ORDER BY node_type;
|
|
node_type | result
|
|
---------------------------------------------------------------------
|
|
coordinator | {"label": "citus_unclassified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
worker_1 | {"label": "citus_unclassified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
worker_2 | {"label": "citus_unclassified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
(3 rows)
|
|
|
|
\c database1
|
|
-- Set a SECURITY LABEL on database, it should not be propagated
|
|
SECURITY LABEL FOR "citus '!tests_label_provider" ON DATABASE database1 IS 'citus_classified';
|
|
-- Set a SECURITY LABEL on a table, it should not be propagated
|
|
CREATE TABLE a (i int);
|
|
SECURITY LABEL ON TABLE a IS 'citus_classified';
|
|
\c regression
|
|
SELECT node_type, result FROM get_citus_tests_label_provider_labels('database1') ORDER BY node_type;
|
|
node_type | result
|
|
---------------------------------------------------------------------
|
|
coordinator | {"label": "citus_classified", "objtype": "database", "provider": "citus '!tests_label_provider"}
|
|
worker_1 |
|
|
worker_2 |
|
|
(3 rows)
|
|
|
|
-- Check that only the SECURITY LABEL for ROLES is propagated to the non-main databases on other nodes
|
|
\c database_w1 - - :worker_1_port
|
|
SELECT provider, objtype, label, objname FROM pg_seclabels ORDER BY objname;
|
|
provider | objtype | label | objname
|
|
---------------------------------------------------------------------
|
|
citus '!tests_label_provider | role | citus_unclassified | "user 2"
|
|
citus '!tests_label_provider | role | citus_classified | user1
|
|
(2 rows)
|
|
|
|
-- Check the result after a transaction
|
|
BEGIN;
|
|
SECURITY LABEL FOR "citus '!tests_label_provider" ON ROLE user1 IS 'citus_unclassified';
|
|
SECURITY LABEL FOR "citus '!tests_label_provider" ON DATABASE database_w1 IS 'citus_classified';
|
|
COMMIT;
|
|
\c regression
|
|
SELECT node_type, result FROM get_citus_tests_label_provider_labels('database_w1') ORDER BY node_type;
|
|
node_type | result
|
|
---------------------------------------------------------------------
|
|
coordinator |
|
|
worker_1 | {"label": "citus_classified", "objtype": "database", "provider": "citus '!tests_label_provider"}
|
|
worker_2 |
|
|
(3 rows)
|
|
|
|
SELECT node_type, result FROM get_citus_tests_label_provider_labels('user1') ORDER BY node_type;
|
|
node_type | result
|
|
---------------------------------------------------------------------
|
|
coordinator | {"label": "citus_unclassified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
worker_1 | {"label": "citus_unclassified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
worker_2 | {"label": "citus_unclassified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
(3 rows)
|
|
|
|
BEGIN;
|
|
SECURITY LABEL FOR "citus '!tests_label_provider" ON ROLE "user 2" IS 'citus_classified';
|
|
ROLLBACK;
|
|
SELECT node_type, result FROM get_citus_tests_label_provider_labels('"user 2"') ORDER BY node_type;
|
|
node_type | result
|
|
---------------------------------------------------------------------
|
|
coordinator | {"label": "citus_unclassified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
worker_1 | {"label": "citus_unclassified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
worker_2 | {"label": "citus_unclassified", "objtype": "role", "provider": "citus '!tests_label_provider"}
|
|
(3 rows)
|
|
|
|
-- clean up
|
|
SET citus.enable_create_database_propagation to ON;
|
|
DROP DATABASE database1;
|
|
DROP DATABASE database2;
|
|
DROP DATABASE database_w1;
|
|
DROP ROLE user1;
|
|
DROP ROLE "user 2";
|
|
RESET citus.enable_create_database_propagation;
|