Skip to content

fix: support GRANT/REVOKE on VIEW with DEFINER/INVOKER security type#24195

Open
ck89119 wants to merge 11 commits intomatrixorigin:3.0-devfrom
ck89119:issue-24187-3.0-dev
Open

fix: support GRANT/REVOKE on VIEW with DEFINER/INVOKER security type#24195
ck89119 wants to merge 11 commits intomatrixorigin:3.0-devfrom
ck89119:issue-24187-3.0-dev

Conversation

@ck89119
Copy link
Copy Markdown
Contributor

@ck89119 ck89119 commented Apr 24, 2026

What type of PR is this?

  • API-change
  • BUG
  • Improvement
  • Documentation
  • Feature
  • Test and CI
  • Code Refactoring

Which issue(s) this PR fixes:

issue #24187

What this PR does / why we need it:

Support view-level privilege control with GRANT/REVOKE ON VIEW syntax, including:

  • Add objectTypeView to distinguish view privileges from table privileges
  • Support DEFINER and INVOKER security types for views via view_security_type session variable
  • Track view lineage (viewChain, directView) in plan nodes for privilege checking at execution time
  • Store SecurityType in view metadata (ViewData)
  • Add distributed test cases for grant/revoke on view scenarios

1. Fix view access bypass via base table ALL/OWNERSHIP: convert predefined
   TableAll/TableOwnership entries from bare General entries to Compound
   entries carrying originViews/directView, so they go through view-chain
   privilege verification.

2. Fix CREATE SQL SECURITY VIEW ignoring explicit security type: add
   SecurityType field to tree.CreateView, pass it from parser, and
   override session variable in plan layer when DDL explicitly specifies it.

3. Fix SHOW CREATE VIEW / ALTER VIEW not preserving security type: splice
   SecurityType into SHOW output when missing from Stmt; ALTER VIEW now
   inherits old view's SecurityType when not explicitly specified.

4. Fix DEFINER path not expanding role inheritance: add
   verifyPrivilegeWithRoleInheritance() to BFS-traverse mo_role_grant
   when the effective role differs from the session role.

5. Update BVT expected results for changed error message wording.
…behavior

SHOW CREATE VIEW should only replay the stored Stmt text as-is, not
auto-inject SQL SECURITY. This matches MySQL behavior where SHOW CREATE
VIEW only shows SQL SECURITY if the original DDL explicitly included it.

Remove findViewKeyword() and the splice logic from buildShowCreateView().
Update BVT tests to use explicit DDL syntax (CREATE SQL SECURITY INVOKER
VIEW) instead of session variable for SecurityType verification.
Revert the 34 result file changes from the previous commit.
…MySQL compat

1. GRANT ON VIEW with wildcard levels (db.*, *.*, *) now filters WGO
   check by obj_type (table vs view), preventing table-level WGO from
   being used to issue view wildcard grants.

2. Restore SHOW CREATE VIEW SQL SECURITY splice logic to match MySQL
   behavior: MySQL always shows SQL SECURITY in SHOW CREATE VIEW output.
   Use findViewKeyword() with whitespace boundary matching.
   Update 34 result files for SQL SECURITY DEFINER in output.

3. Add SHOW CREATE VIEW test for session-variable-created INVOKER view
   (v_invoker) to cover the implicit SecurityType path.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kind/bug Something isn't working size/XXL Denotes a PR that changes 2000+ lines

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants