CREATE ROW ACCESS POLICY

在 TiDB Cloud Lake 中创建新的行访问策略。行访问策略定义了一个布尔谓词，当该策略附加到表时，TiDB Cloud Lake 会将其应用到行上。

语法

CREATE ROW ACCESS POLICY [ IF NOT EXISTS ] <policy_name> AS
    ( <arg_name> <arg_type> [ , <arg_name> <arg_type> ... ] )
    RETURNS BOOLEAN -> <predicate_expression>
    [ COMMENT = '<comment>' ]

访问控制要求

TiDB Cloud Lake 会自动将新行访问策略的 OWNERSHIP 授予当前角色，以便其能够与其他对象一样管理该策略。

示例

以下示例创建了一个策略：仅暴露 Engineering 部门的行，除非当前角色为 admin。

SET enable_experimental_row_access_policy = 1;

CREATE TABLE employees (
    id INT,
    name STRING,
    department STRING
);

INSERT INTO employees VALUES
    (1, 'Alice', 'Engineering'),
    (2, 'Bob', 'Sales'),
    (3, 'Charlie', 'Engineering');

CREATE ROW ACCESS POLICY rap_engineering
AS (dept STRING)
RETURNS BOOLEAN ->
  CASE
    WHEN current_role() = 'admin' THEN true
    WHEN dept = 'Engineering' THEN true
    ELSE false
  END
  COMMENT = 'show engineering rows';

ALTER TABLE employees
ADD ROW ACCESS POLICY rap_engineering ON (department);

SELECT id, name, department FROM employees ORDER BY id;

┌────┬─────────┬─────────────┐
│ id │ name    │ department  │
├────┼─────────┼─────────────┤
│  1 │ Alice   │ Engineering │
│  3 │ Charlie │ Engineering │
└────┴─────────┴─────────────┘

ON (department) 子句将表列 department 映射到策略参数 dept。