@@ -68,8 +68,6 @@ INSERT INTO document VALUES
6868 ( 6, 22, 1, 'rls_regress_user2', 'great science fiction'),
6969 ( 7, 33, 2, 'rls_regress_user2', 'great technology book'),
7070 ( 8, 44, 1, 'rls_regress_user2', 'great manga');
71- VACUUM ANALYZE category;
72- VACUUM ANALYZE document;
7371ALTER TABLE document ENABLE ROW LEVEL SECURITY;
7472-- user's security level must be higher than or equal to document's
7573CREATE POLICY p1 ON document
@@ -186,19 +184,20 @@ EXPLAIN (COSTS OFF) SELECT * FROM document WHERE f_leak(dtitle);
186184(7 rows)
187185
188186EXPLAIN (COSTS OFF) SELECT * FROM document NATURAL JOIN category WHERE f_leak(dtitle);
189- QUERY PLAN
190- ----------------------------------------------------------------
191- Nested Loop
192- Join Filter: (document.cid = category.cid)
193- -> Subquery Scan on document
194- Filter: f_leak(document.dtitle)
195- -> Seq Scan on document document_1
196- Filter: (dlevel <= $0)
197- InitPlan 1 (returns $0)
198- -> Index Scan using uaccount_pkey on uaccount
199- Index Cond: (pguser = "current_user"())
187+ QUERY PLAN
188+ ----------------------------------------------------------------------
189+ Hash Join
190+ Hash Cond: (category.cid = document.cid)
200191 -> Seq Scan on category
201- (10 rows)
192+ -> Hash
193+ -> Subquery Scan on document
194+ Filter: f_leak(document.dtitle)
195+ -> Seq Scan on document document_1
196+ Filter: (dlevel <= $0)
197+ InitPlan 1 (returns $0)
198+ -> Index Scan using uaccount_pkey on uaccount
199+ Index Cond: (pguser = "current_user"())
200+ (11 rows)
202201
203202-- only owner can change policies
204203ALTER POLICY p1 ON document USING (true); --fail
@@ -276,12 +275,12 @@ EXPLAIN (COSTS OFF) SELECT * FROM document NATURAL JOIN category WHERE f_leak(dt
276275 QUERY PLAN
277276----------------------------------------------------
278277 Nested Loop
279- Join Filter: (document.cid = category.cid)
280278 -> Subquery Scan on document
281279 Filter: f_leak(document.dtitle)
282280 -> Seq Scan on document document_1
283281 Filter: (dauthor = "current_user"())
284- -> Seq Scan on category
282+ -> Index Scan using category_pkey on category
283+ Index Cond: (cid = document.cid)
285284(7 rows)
286285
287286-- interaction of FK/PK constraints
@@ -296,12 +295,12 @@ SET SESSION AUTHORIZATION rls_regress_user1;
296295SELECT * FROM document d FULL OUTER JOIN category c on d.cid = c.cid;
297296 did | cid | dlevel | dauthor | dtitle | cid | cname
298297-----+-----+--------+-------------------+--------------------+-----+------------
299- 1 | 11 | 1 | rls_regress_user1 | my first novel | 11 | novel
300298 2 | 11 | 2 | rls_regress_user1 | my second novel | 11 | novel
301- 3 | 22 | 2 | rls_regress_user1 | my science fiction | |
302- 4 | 44 | 1 | rls_regress_user1 | my first manga | |
303- 5 | 44 | 2 | rls_regress_user1 | my second manga | |
299+ 1 | 11 | 1 | rls_regress_user1 | my first novel | 11 | novel
304300 | | | | | 33 | technology
301+ 5 | 44 | 2 | rls_regress_user1 | my second manga | |
302+ 4 | 44 | 1 | rls_regress_user1 | my first manga | |
303+ 3 | 22 | 2 | rls_regress_user1 | my science fiction | |
305304(6 rows)
306305
307306DELETE FROM category WHERE cid = 33; -- fails with FK violation
@@ -313,8 +312,8 @@ SELECT * FROM document d FULL OUTER JOIN category c on d.cid = c.cid;
313312 did | cid | dlevel | dauthor | dtitle | cid | cname
314313-----+-----+--------+-------------------+-----------------------+-----+-----------------
315314 6 | 22 | 1 | rls_regress_user2 | great science fiction | 22 | science fiction
316- 7 | 33 | 2 | rls_regress_user2 | great technology book | |
317315 8 | 44 | 1 | rls_regress_user2 | great manga | 44 | manga
316+ 7 | 33 | 2 | rls_regress_user2 | great technology book | |
318317(3 rows)
319318
320319INSERT INTO document VALUES (10, 33, 1, current_user, 'hoge');
0 commit comments