cockroachdb / cockroachdb/cockroach

sql/schemachanger: support security invoker views in the declarative schema changer

Open
#164,275 0 comments 0 reactions 0 assignees View on GitHub
A-schema-changer-impl C-enhancement T-sql-foundations
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

## Summary

Add support for `CREATE VIEW ... WITH (security_invoker = true)` in the declarative schema changer. Security invoker views check permissions against the invoking user rather than the view owner.

## Describe the solution you'd like

- Handle `n.Options.SecurityInvoker` in the declarative `create_view.go`
- Respect the `AllowViewWithSecurityInvokerClause` session variable gate
- Store the security invoker flag in the view descriptor
- Ensure compatibility with both `CREATE VIEW` and `CREATE OR REPLACE VIEW`
- Add tests

## Code References

- [create_view.go:81](https://github.com/cockroachdb/cockroach/blob/7f85419e8fa/pkg/sql/create_view.go#L81) — legacy security invoker session variable gate
- [create_view.go](https://github.com/cockroachdb/cockroach/blob/7f85419e8fa/pkg/sql/schemachanger/scbuild/internal/scbuildstmt/create_view.go) — declarative schema changer create view implementation

Epic: CRDB-31466

Jira issue: CRDB-60730

Contributor guide

Open the contributing guide

Research direction

Start with pkg/sql/schemachanger/scbuild/internal/scbuildstmt/create_view.go and compare its handling with the legacy gate in pkg/sql/create_view.go around line 81. Trace the view descriptor creation and existing CREATE VIEW and CREATE OR REPLACE VIEW tests, then add coverage for the session-variable gate and security-invoker flag so both statement forms store and honor the option.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, sql
Domain
databases, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.