Function test_rls_rules

crates/core/src/sql/execute.rs:546–769

()

    /// Test querying a table with RLS rules
    #[tokio::test]
    async fn test_rls_rules() -> anyhow::Result<()> {
        let db = TestDB::in_memory()?;

        let id_for_a = identity_from_u8(1);
        let id_for_b = identity_from_u8(2);

        let users_schema = [("identity", AlgebraicType::identity())];
        let sales_schema = [
            ("order_id", AlgebraicType::U64),
            ("customer", AlgebraicType::identity()),
        ];

        let users_table_id = db.create_table_for_test("users", &users_schema, &[])?;
        let sales_table_id = db.create_table_for_test("sales", &sales_schema, &[])?;

        insert_rows(&db, users_table_id, vec![product![id_for_a], product![id_for_b]])?;
        insert_rows(
            &db,
            sales_table_id,
            vec![
                product![1u64, id_for_a],
                product![2u64, id_for_b],
                product![3u64, id_for_a],
                product![4u64, id_for_b],
            ],
        )?;

        insert_rls_rules(
            &db,
            [users_table_id, sales_table_id],
            [
                "select * from users where identity = :sender",
                "select s.* from users u join sales s on u.identity = s.customer",
            ],
        )?;

        let auth_for_a = AuthCtx::new(Identity::ZERO, id_for_a);
        let auth_for_b = AuthCtx::new(Identity::ZERO, id_for_b);

        assert_query_results(
            db.clone(),
            // Should only return the identity for sender "a"
            "select * from users",
            auth_for_a.clone(),
            [product![id_for_a]],
        )
        .await;
        assert_query_results(
            db.clone(),
            // Should only return the identity for sender "b"
            "select * from users",
            auth_for_b.clone(),
            [product![id_for_b]],
        )
        .await;
        assert_query_results(
            db.clone(),
            // Should only return the orders for sender "a"