Method getRowPolicyFilter

src/Access/ContextAccess.cpp:532–576

#endif

RowPolicyFilterPtr ContextAccess::getRowPolicyFilter(const String & database, const String & table_name, RowPolicyFilterType filter_type) const
{
    RowPolicyFilterPtr filter;

    {
        std::lock_guard lock{mutex};

        if (initialized && !user && !user_was_dropped)
            throw Exception(ErrorCodes::LOGICAL_ERROR, "ContextAccess is inconsistent (bug 55041)");

        if (enabled_row_policies)
            filter = enabled_row_policies->getFilter(database, table_name, filter_type);

        if (row_policies_of_initial_user)
        {
            /// Find and set extra row policies to be used based on `client_info.initial_user`, if the initial user exists.
            /// TODO: we need a better solution here. It seems we should pass the initial row policy
            /// because a shard is allowed to not have the initial user or it might be another user
            /// with the same name.
            filter = row_policies_of_initial_user->getFilter(database, table_name, filter_type, filter);
        }
    }

    if (filter && filter->policies.empty())
    {
        if (access_control->shouldThrowOnUnmatchedRowPolicies())
        {
            throw Exception(ErrorCodes::ACCESS_DENIED,
                            "{}: Table {}.{} has row policies, but none of them are for the current user",
                            getUserName(), backQuoteIfNeed(database), backQuoteIfNeed(table_name));
        }
        else
        {
            chassert(filter->isAlwaysTrue() || filter->isAlwaysFalse());
            std::string_view filter_info =
                filter->isAlwaysTrue() ? ", no filters will be used" :
                (filter->isAlwaysFalse() ? ", no rows will be shown" : "");

            LOG_TRACE(trace_log, "{}: Table {}.{} has row policies, but none of them are for the current user{}",
                      getUserName(), backQuoteIfNeed(database), backQuoteIfNeed(table_name), filter_info);
        }
    }

    return filter;
}

std::shared_ptr<const EnabledQuota> ContextAccess::getQuota() const
{