Function test_nested_rls_rules

crates/core/src/sql/execute.rs:773–894

()

    /// Test querying tables with multiple levels of RLS rules
    #[tokio::test]
    async fn test_nested_rls_rules() -> anyhow::Result<()> {
        let db = TestDB::in_memory()?;

        let id_for_a = identity_from_u8(1);
        let id_for_b = identity_from_u8(2);
        let id_for_c = identity_from_u8(3);

        let users_schema = [("identity", AlgebraicType::identity())];
        let sales_schema = [
            ("order_id", AlgebraicType::U64),
            ("product_id", AlgebraicType::U64),
            ("customer", AlgebraicType::identity()),
        ];

        let users_table_id = db.create_table_for_test("users", &users_schema, &[0.into()])?;
        let admin_table_id = db.create_table_for_test("admins", &users_schema, &[0.into()])?;
        let sales_table_id = db.create_table_for_test("sales", &sales_schema, &[0.into()])?;

        insert_rows(&db, admin_table_id, [product![id_for_c]])?;
        insert_rows(
            &db,
            users_table_id,
            [product![id_for_a], product![id_for_b], product![id_for_c]],
        )?;
        insert_rows(
            &db,
            sales_table_id,
            [product![1u64, 1u64, id_for_a], product![2u64, 2u64, id_for_b]],
        )?;

        insert_rls_rules(
            &db,
            [admin_table_id, users_table_id, users_table_id, sales_table_id],
            [
                "select * from admins where identity = :sender",
                "select * from users where identity = :sender",
                "select users.* from admins join users",
                "select s.* from users u join sales s on u.identity = s.customer",
            ],
        )?;

        let auth_for_a = AuthCtx::new(Identity::ZERO, id_for_a);
        let auth_for_b = AuthCtx::new(Identity::ZERO, id_for_b);
        let auth_for_c = AuthCtx::new(Identity::ZERO, id_for_c);

        assert_query_results(
            db.clone(),
            "select * from admins",
            auth_for_a.clone(),
            // Identity "a" is not an admin
            [],
        )
        .await;
        assert_query_results(
            db.clone(),
            "select * from admins",
            auth_for_b.clone(),
            // Identity "b" is not an admin