pingcap / pingcap/tidb

column masking policy: enhance test coverage for policy name uniqueness and cross-table scenarios

Open
#67,217 0 comments 0 reactions 0 assignees View on GitHub
component/ddl component/privilege type/enhancement
Dominant language
Go
Stars
40.5k
Forks
6.2k
PR merge metrics
PR metrics pending

Description

## Enhancement Summary

The column masking policy feature has insufficient test coverage for certain policy name uniqueness scenarios.

## Current Test Coverage

The existing test file `tests/integrationtest/t/privilege/column_masking_policy.test` has the following coverage:

| Scenario | Covered? | Location |
|----------|----------|----------|
| Same column, second policy | ✅ Yes | Line 14-15 (error 8268) |
| Same table, different columns, same policy name | ❌ No | - |
| Same table, different columns, different policy names | ✅ Yes | Line 213-214 (`p_modify_guard_c`, `p_modify_guard_d`) |
| Different tables, same policy name | ❌ **No** | - |

## Design Facts

Based on the code analysis:

1. **Table constraint** (`pkg/session/bootstrap.go:808`):
```sql
UNIQUE KEY uk_table_policy(table_id, policy_name)
```
This means **policy_name is table-level unique**, not database-level unique.

2. **Code logic** (`pkg/ddl/masking_policy.go:64-75`):
The `onCreateMaskingPolicy` function only checks for duplicate names **within the same table**.

## Missing Test Scenarios

1. **Same table, different columns, same policy name should fail**:
- Create policy `p_test` on table `t1` column `c1`
- Try to create policy `p_test` on table `t1` column `c2` → should error

2. **Different tables, same policy name should succeed**:
- Create policy `p_test` on table `t1` column `c1`
- Create policy `p_test` on table `t2` column `c1` → should succeed
- Verify both policies exist independently

## Proposed Test Addition

Add a new test case `IT-MASK-P0-012 TestColumnMaskPolicyNameUniqueness` to cover these scenarios.

## Component

- `component/privilege`
- `component/ddl`

## Related Files

- Test file: `tests/integrationtest/t/privilege/column_masking_policy.test`
- Implementation: `pkg/ddl/masking_policy.go`
- Schema: `pkg/session/bootstrap.go` (CreateMaskingPolicyTable)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.