@@ -68,8 +68,6 @@ INSERT INTO document VALUES
68
68
( 6, 22, 1, 'rls_regress_user2', 'great science fiction'),
69
69
( 7, 33, 2, 'rls_regress_user2', 'great technology book'),
70
70
( 8, 44, 1, 'rls_regress_user2', 'great manga');
71
- VACUUM ANALYZE category;
72
- VACUUM ANALYZE document;
73
71
ALTER TABLE document ENABLE ROW LEVEL SECURITY;
74
72
-- user's security level must be higher than or equal to document's
75
73
CREATE POLICY p1 ON document
@@ -186,19 +184,20 @@ EXPLAIN (COSTS OFF) SELECT * FROM document WHERE f_leak(dtitle);
186
184
(7 rows)
187
185
188
186
EXPLAIN (COSTS OFF) SELECT * FROM document NATURAL JOIN category WHERE f_leak(dtitle);
189
- QUERY PLAN
190
- ----------------------------------------------------------------
191
- Nested Loop
192
- Join Filter: (document.cid = category.cid)
193
- -> Subquery Scan on document
194
- Filter: f_leak(document.dtitle)
195
- -> Seq Scan on document document_1
196
- Filter: (dlevel <= $0)
197
- InitPlan 1 (returns $0)
198
- -> Index Scan using uaccount_pkey on uaccount
199
- Index Cond: (pguser = "current_user"())
187
+ QUERY PLAN
188
+ ----------------------------------------------------------------------
189
+ Hash Join
190
+ Hash Cond: (category.cid = document.cid)
200
191
-> Seq Scan on category
201
- (10 rows)
192
+ -> Hash
193
+ -> Subquery Scan on document
194
+ Filter: f_leak(document.dtitle)
195
+ -> Seq Scan on document document_1
196
+ Filter: (dlevel <= $0)
197
+ InitPlan 1 (returns $0)
198
+ -> Index Scan using uaccount_pkey on uaccount
199
+ Index Cond: (pguser = "current_user"())
200
+ (11 rows)
202
201
203
202
-- only owner can change policies
204
203
ALTER POLICY p1 ON document USING (true); --fail
@@ -276,12 +275,12 @@ EXPLAIN (COSTS OFF) SELECT * FROM document NATURAL JOIN category WHERE f_leak(dt
276
275
QUERY PLAN
277
276
----------------------------------------------------
278
277
Nested Loop
279
- Join Filter: (document.cid = category.cid)
280
278
-> Subquery Scan on document
281
279
Filter: f_leak(document.dtitle)
282
280
-> Seq Scan on document document_1
283
281
Filter: (dauthor = "current_user"())
284
- -> Seq Scan on category
282
+ -> Index Scan using category_pkey on category
283
+ Index Cond: (cid = document.cid)
285
284
(7 rows)
286
285
287
286
-- interaction of FK/PK constraints
@@ -296,12 +295,12 @@ SET SESSION AUTHORIZATION rls_regress_user1;
296
295
SELECT * FROM document d FULL OUTER JOIN category c on d.cid = c.cid;
297
296
did | cid | dlevel | dauthor | dtitle | cid | cname
298
297
-----+-----+--------+-------------------+--------------------+-----+------------
299
- 1 | 11 | 1 | rls_regress_user1 | my first novel | 11 | novel
300
298
2 | 11 | 2 | rls_regress_user1 | my second novel | 11 | novel
301
- 3 | 22 | 2 | rls_regress_user1 | my science fiction | |
302
- 4 | 44 | 1 | rls_regress_user1 | my first manga | |
303
- 5 | 44 | 2 | rls_regress_user1 | my second manga | |
299
+ 1 | 11 | 1 | rls_regress_user1 | my first novel | 11 | novel
304
300
| | | | | 33 | technology
301
+ 5 | 44 | 2 | rls_regress_user1 | my second manga | |
302
+ 4 | 44 | 1 | rls_regress_user1 | my first manga | |
303
+ 3 | 22 | 2 | rls_regress_user1 | my science fiction | |
305
304
(6 rows)
306
305
307
306
DELETE FROM category WHERE cid = 33; -- fails with FK violation
@@ -313,8 +312,8 @@ SELECT * FROM document d FULL OUTER JOIN category c on d.cid = c.cid;
313
312
did | cid | dlevel | dauthor | dtitle | cid | cname
314
313
-----+-----+--------+-------------------+-----------------------+-----+-----------------
315
314
6 | 22 | 1 | rls_regress_user2 | great science fiction | 22 | science fiction
316
- 7 | 33 | 2 | rls_regress_user2 | great technology book | |
317
315
8 | 44 | 1 | rls_regress_user2 | great manga | 44 | manga
316
+ 7 | 33 | 2 | rls_regress_user2 | great technology book | |
318
317
(3 rows)
319
318
320
319
INSERT INTO document VALUES (10, 33, 1, current_user, 'hoge');
0 commit comments