Skip to content

[Feature Request] Add support for tracking security_invoker on views #343

@czlowiek488

Description

@czlowiek488

Currently plan does not recognize when view is created with security_invoker = true.

All of views I use require Row Level Security to be inherited from the tables.

This

  CREATE VIEW view_permission WITH (security_invoker = true) AS
    SELECT
        dcr.id,
        dcr.v0 AS role,
        dcr.v1 AS tenant_id,
        dt.decrypted_name AS tenant_name,
        dcr.decrypted_v2 AS object,
        dcr.decrypted_v3 AS action,
        dcr.decrypted_v4 AS rule,
        dcr.decrypted_v5 AS scope,
        dcr.decrypted_v6 AS feature
    FROM decrypted_casbin_rule dcr
    LEFT JOIN decrypted_user_tenant dt
        ON dt.tenant_id::text = dcr.v1
    WHERE dcr.ptype = 'p';

gets transformed by plan into

CREATE OR REPLACE VIEW view_permission AS
 SELECT dcr.id,
    dcr.v0 AS role,
    dcr.v1 AS tenant_id,
    dt.decrypted_name AS tenant_name,
    dcr.decrypted_v2 AS object,
    dcr.decrypted_v3 AS action,
    dcr.decrypted_v4 AS rule,
    dcr.decrypted_v5 AS scope,
    dcr.decrypted_v6 AS feature
   FROM decrypted_casbin_rule dcr
     LEFT JOIN decrypted_user_tenant dt ON dt.tenant_id::text = dcr.v1
  WHERE dcr.ptype = 'p';

As you can see WITH (security_invoker = true) is gone which makes views accessable to anyone as Row Level Security is be disabled when this part is not present.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions