Function manageClickHouseUser

programs/docker-init/docker-init.cpp:366–508

Write the user management XML to `/etc/clickhouse-server/users.d/default-user.xml`. Returns false if a user-requested setup (CLICKHOUSE_USER/PASSWORD/ACCESS_MANAGEMENT) is invalid — caller should treat this as fatal.

/// Returns false if a user-requested setup (CLICKHOUSE_USER/PASSWORD/ACCESS_MANAGEMENT)
/// is invalid — caller should treat this as fatal.
bool manageClickHouseUser(
    const std::string & config_file,
    const std::string & clickhouse_user,
    const std::string & clickhouse_password,
    const std::string & access_management,
    bool skip_user_setup)
{
    if (skip_user_setup)
    {
        std::cerr << "docker-init: explicitly skip changing user 'default'\n";
        return true;
    }

    const std::string users_d_dir = "/etc/clickhouse-server/users.d";
    const std::string default_user_xml = users_d_dir + "/default-user.xml";

    std::error_code ec;
    fs::create_directories(users_d_dir, ec);

    /// Detect whether the default user was customised via a mounted config file.
    bool clickhouse_default_changed = false;
    std::string users_xml_path = extractConfigValue(config_file, "user_directories.users_xml.path");
    if (!users_xml_path.empty())
    {
        std::string abs_users_xml = (users_xml_path[0] == '/')
            ? users_xml_path
            : (fs::path(config_file).parent_path() / users_xml_path).string();

        auto join = [](const std::vector<std::string> & v)
        {
            std::string s;
            for (const auto & line : v)
                s += line + "\n";
            return s;
        };

        auto [c1, original] = captureCommand({
            g_clickhouse_binary, "extract-from-config",
            "--config-file", abs_users_xml,
            "--key", "users.default", "--try",
        });
        auto [c2, processed] = captureCommand({
            g_clickhouse_binary, "extract-from-config",
            "--config-file", config_file,
            "--users", "--key", "users.default", "--try",
        });

        if (c1 == 0 && c2 == 0 && join(original) != join(processed))
            clickhouse_default_changed = true;
    }

    bool has_custom_user = !clickhouse_user.empty() && clickhouse_user != "default";
    bool has_password = !clickhouse_password.empty();
    bool has_access_mgmt = access_management != "0";

    if (has_custom_user || has_password || has_access_mgmt)
    {
        if (access_management != "0" && access_management != "1")