-
Notifications
You must be signed in to change notification settings - Fork 32
Open
Description
Currently plan does not recognize when view is created with security_invoker = true.
All of views I use require Row Level Security to be inherited from the tables.
This
CREATE VIEW view_permission WITH (security_invoker = true) AS
SELECT
dcr.id,
dcr.v0 AS role,
dcr.v1 AS tenant_id,
dt.decrypted_name AS tenant_name,
dcr.decrypted_v2 AS object,
dcr.decrypted_v3 AS action,
dcr.decrypted_v4 AS rule,
dcr.decrypted_v5 AS scope,
dcr.decrypted_v6 AS feature
FROM decrypted_casbin_rule dcr
LEFT JOIN decrypted_user_tenant dt
ON dt.tenant_id::text = dcr.v1
WHERE dcr.ptype = 'p';gets transformed by plan into
CREATE OR REPLACE VIEW view_permission AS
SELECT dcr.id,
dcr.v0 AS role,
dcr.v1 AS tenant_id,
dt.decrypted_name AS tenant_name,
dcr.decrypted_v2 AS object,
dcr.decrypted_v3 AS action,
dcr.decrypted_v4 AS rule,
dcr.decrypted_v5 AS scope,
dcr.decrypted_v6 AS feature
FROM decrypted_casbin_rule dcr
LEFT JOIN decrypted_user_tenant dt ON dt.tenant_id::text = dcr.v1
WHERE dcr.ptype = 'p';
As you can see WITH (security_invoker = true) is gone which makes views accessable to anyone as Row Level Security is be disabled when this part is not present.
Reactions are currently unavailable