mirror of
https://github.com/GreptimeTeam/greptimedb.git
synced 2026-11-06 19:06:58 +00:00
discord9
0d75655ed6
Discovery enumerates the schema's logical metric tables, which is a wider read
than a caller's grants necessarily allow. The frontend now answers "which of
these may this request see" before the planner touches the catalog, and the
planner filters on that answer rather than on its own enumeration.
The scope is process-local state on the query context, skipped by the builder the
same way the other local-only fields are: a remote node must not receive a scope
that widens what it may read. It defaults to `Unavailable`, so a path that did not
prepare authorization cannot discover, and the validator turns "should have been
set and was not" into an internal error instead of a silent unfiltered read.
The named tables of a mixed query are checked too. The complete extractor answers
"no tables at all" when any selector is unresolvable, and that was exactly the
selector that made the query enter the discovery branch - so `beta_total{job="api"}
or {job="api"}` used to lose `beta_total` from the check. Both the allowed and the
unrestricted arms now take the partial answer.
A denied metric is skipped rather than failing the query, which is what makes
discovery mean "every metric you can see". The split route rejects a query whose
name matchers reach a denied table, so the same query answers differently
depending on the request header; that difference is stated where the skip is
made.
The planner's retain runs before any source is prepared, so a denied table's name
reaches neither the plan nor an error message. It filters with borrowed keys, one
pass to build the set and one lookup per metric.
Signed-off-by: discord9 <discord9@163.com>