Function filterAccessElementForHints

src/Access/ContextAccess.cpp:60–76

Filter access-denied hint output (the "required grant"/"missing permissions" text in ACCESS_DENIED errors). Column names from implicit expansion (e.g. SELECT *) require SHOW_COLUMNS to be shown in hints.

    /// Filter access-denied hint output (the "required grant"/"missing permissions" text in ACCESS_DENIED errors).
    /// Column names from implicit expansion (e.g. SELECT *) require SHOW_COLUMNS to be shown in hints.
    AccessRightsElement filterAccessElementForHints(const AccessRightsElement & element, const AccessRights & access)
    {
        if (element.columns.empty())
            return element;

        // Columns imply a resolved table and database (current DB is already substituted upstream).
        chassert(!element.table.empty());
        chassert(!element.database.empty());

        if (access.isGranted(AccessType::SHOW_COLUMNS, element.database, element.table, element.columns))
            return element;

        // Hide column names unless SHOW_COLUMNS covers all required columns.
        AccessRightsElement res = element;
        res.columns.clear();
        return res;
    }

    AccessRightsElements filterAccessElementsForHints(const AccessRightsElements & elements, const AccessRights & access)
    {