cockroachdb / cockroachdb/cockroach
sql/schemachanger: support security invoker views in the declarative schema changer
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
## Summary
Add support for `CREATE VIEW ... WITH (security_invoker = true)` in the declarative schema changer. Security invoker views check permissions against the invoking user rather than the view owner.
## Describe the solution you'd like
- Handle `n.Options.SecurityInvoker` in the declarative `create_view.go`
- Respect the `AllowViewWithSecurityInvokerClause` session variable gate
- Store the security invoker flag in the view descriptor
- Ensure compatibility with both `CREATE VIEW` and `CREATE OR REPLACE VIEW`
- Add tests
## Code References
- [create_view.go:81](https://github.com/cockroachdb/cockroach/blob/7f85419e8fa/pkg/sql/create_view.go#L81) — legacy security invoker session variable gate
- [create_view.go](https://github.com/cockroachdb/cockroach/blob/7f85419e8fa/pkg/sql/schemachanger/scbuild/internal/scbuildstmt/create_view.go) — declarative schema changer create view implementation
Epic: CRDB-31466
Jira issue: CRDB-60730
Contributor guide
Research direction
Start with pkg/sql/schemachanger/scbuild/internal/scbuildstmt/create_view.go and compare its handling with the legacy gate in pkg/sql/create_view.go around line 81. Trace the view descriptor creation and existing CREATE VIEW and CREATE OR REPLACE VIEW tests, then add coverage for the session-variable gate and security-invoker flag so both statement forms store and honor the option.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, sql
- Domain
- databases, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100