@@ -68,6 +68,8 @@ INSERT INTO document VALUES
6868 ( 6, 22, 1, 'rls_regress_user2', 'great science fiction'),
6969 ( 7, 33, 2, 'rls_regress_user2', 'great technology book'),
7070 ( 8, 44, 1, 'rls_regress_user2', 'great manga');
71+ VACUUM ANALYZE category;
72+ VACUUM ANALYZE document;
7173ALTER TABLE document ENABLE ROW LEVEL SECURITY;
7274-- user's security level must be higher than or equal to document's
7375CREATE POLICY p1 ON document
@@ -184,20 +186,19 @@ EXPLAIN (COSTS OFF) SELECT * FROM document WHERE f_leak(dtitle);
184186(7 rows)
185187
186188EXPLAIN (COSTS OFF) SELECT * FROM document NATURAL JOIN category WHERE f_leak(dtitle);
187- QUERY PLAN
188- ----------------------------------------------------------------------
189- Hash Join
190- Hash Cond: (category.cid = document.cid)
189+ QUERY PLAN
190+ ----------------------------------------------------------------
191+ Nested Loop
192+ Join Filter: (document.cid = category.cid)
193+ -> Subquery Scan on document
194+ Filter: f_leak(document.dtitle)
195+ -> Seq Scan on document document_1
196+ Filter: (dlevel <= $0)
197+ InitPlan 1 (returns $0)
198+ -> Index Scan using uaccount_pkey on uaccount
199+ Index Cond: (pguser = "current_user"())
191200 -> Seq Scan on category
192- -> Hash
193- -> Subquery Scan on document
194- Filter: f_leak(document.dtitle)
195- -> Seq Scan on document document_1
196- Filter: (dlevel <= $0)
197- InitPlan 1 (returns $0)
198- -> Index Scan using uaccount_pkey on uaccount
199- Index Cond: (pguser = "current_user"())
200- (11 rows)
201+ (10 rows)
201202
202203-- only owner can change policies
203204ALTER POLICY p1 ON document USING (true); --fail
@@ -275,12 +276,12 @@ EXPLAIN (COSTS OFF) SELECT * FROM document NATURAL JOIN category WHERE f_leak(dt
275276 QUERY PLAN
276277----------------------------------------------------
277278 Nested Loop
279+ Join Filter: (document.cid = category.cid)
278280 -> Subquery Scan on document
279281 Filter: f_leak(document.dtitle)
280282 -> Seq Scan on document document_1
281283 Filter: (dauthor = "current_user"())
282- -> Index Scan using category_pkey on category
283- Index Cond: (cid = document.cid)
284+ -> Seq Scan on category
284285(7 rows)
285286
286287-- interaction of FK/PK constraints
@@ -295,12 +296,12 @@ SET SESSION AUTHORIZATION rls_regress_user1;
295296SELECT * FROM document d FULL OUTER JOIN category c on d.cid = c.cid;
296297 did | cid | dlevel | dauthor | dtitle | cid | cname
297298-----+-----+--------+-------------------+--------------------+-----+------------
298- 2 | 11 | 2 | rls_regress_user1 | my second novel | 11 | novel
299299 1 | 11 | 1 | rls_regress_user1 | my first novel | 11 | novel
300- | | | | | 33 | technology
301- 5 | 44 | 2 | rls_regress_user1 | my second manga | |
302- 4 | 44 | 1 | rls_regress_user1 | my first manga | |
300+ 2 | 11 | 2 | rls_regress_user1 | my second novel | 11 | novel
303301 3 | 22 | 2 | rls_regress_user1 | my science fiction | |
302+ 4 | 44 | 1 | rls_regress_user1 | my first manga | |
303+ 5 | 44 | 2 | rls_regress_user1 | my second manga | |
304+ | | | | | 33 | technology
304305(6 rows)
305306
306307DELETE FROM category WHERE cid = 33; -- fails with FK violation
@@ -312,8 +313,8 @@ SELECT * FROM document d FULL OUTER JOIN category c on d.cid = c.cid;
312313 did | cid | dlevel | dauthor | dtitle | cid | cname
313314-----+-----+--------+-------------------+-----------------------+-----+-----------------
314315 6 | 22 | 1 | rls_regress_user2 | great science fiction | 22 | science fiction
315- 8 | 44 | 1 | rls_regress_user2 | great manga | 44 | manga
316316 7 | 33 | 2 | rls_regress_user2 | great technology book | |
317+ 8 | 44 | 1 | rls_regress_user2 | great manga | 44 | manga
317318(3 rows)
318319
319320INSERT INTO document VALUES (10, 33, 1, current_user, 'hoge');
0 commit comments