Skip to content

Commit a26a769

Browse files
committed
ref-docs: append draft for sql: add security_invoker feature flag and grammar support
1 parent 752785c commit a26a769

1 file changed

Lines changed: 123 additions & 0 deletions

File tree

src/current/v26.1/create-view.md

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,3 +255,126 @@ CREATE MATERIALIZED VIEW overdrawn_accounts
255255
- [Online Schema Changes]({% link {{ page.version.version }}/online-schema-changes.md %})
256256
- [`AS OF SYSTEM TIME`]({% link {{ page.version.version }}/as-of-system-time.md %})
257257
- [Follower Reads]({% link {{ page.version.version }}/follower-reads.md %})
258+
259+
<!-- REF DOC DRAFT: The following content was auto-generated. Please integrate into the sections above and remove this comment block. -->
260+
261+
## CREATE VIEW (Updated)
262+
263+
The `CREATE VIEW` statement has been enhanced to support the `security_invoker` option.
264+
265+
### Updated Synopsis
266+
267+
```sql
268+
CREATE [TEMPORARY | TEMP] VIEW [IF NOT EXISTS] view_name [( column_list )] [WITH ( option [= value] [, ....] )] AS select_stmt
269+
```
270+
271+
### New Parameters
272+
273+
| Parameter | Description | Required |
274+
| --- | --- | --- |
275+
| `security_invoker` | controls whether the view runs with the permissions of the view owner (false) or the current user (true). Accepts `true`, `false`, `1`, or `0`. Defaults to `true` when specified without a value | No |
276+
277+
{{site.data.alerts.callout_info}}
278+
The `security_invoker` option requires the `enable_view_security_invoker` feature flag to be enabled via the `allow_view_with_security_invoker_clause` session setting.
279+
{{site.data.alerts.end}}
280+
281+
### Examples
282+
283+
{% include_cached copy-clipboard.html %}
284+
~~~ sql
285+
-- Enable the feature flag
286+
SET allow_view_with_security_invoker_clause = on;
287+
~~~
288+
289+
{% include_cached copy-clipboard.html %}
290+
~~~ sql
291+
-- Create a view with security invoker enabled (default value)
292+
CREATE VIEW security_view WITH ( security_invoker ) AS SELECT * FROM sensitive_table;
293+
~~~
294+
295+
{% include_cached copy-clipboard.html %}
296+
~~~ sql
297+
-- Create a view with security invoker explicitly set to true
298+
CREATE VIEW user_permissions_view WITH ( security_invoker = true ) AS SELECT * FROM users;
299+
~~~
300+
301+
{% include_cached copy-clipboard.html %}
302+
~~~ sql
303+
-- Create a view with security invoker disabled (runs with view owner permissions)
304+
CREATE VIEW admin_view WITH ( security_invoker = false ) AS SELECT * FROM admin_data;
305+
~~~
306+
307+
{% include_cached copy-clipboard.html %}
308+
~~~ sql
309+
-- Using integer values (1 = true, 0 = false)
310+
CREATE VIEW numeric_view WITH ( security_invoker = 1 ) AS SELECT count(*) FROM transactions;
311+
~~~
312+
313+
---
314+
315+
## ALTER VIEW SET OPTIONS [NEEDS REVIEW]
316+
317+
{{site.data.alerts.callout_danger}}
318+
**Note**: This feature is currently unimplemented. The grammar support has been added but attempting to use this syntax will result in an "unimplemented" error.
319+
{{site.data.alerts.end}}
320+
321+
### Synopsis
322+
323+
```sql
324+
ALTER VIEW [IF EXISTS] view_name SET ( security_invoker = { true | false | 1 | 0 } )
325+
```
326+
327+
### Description
328+
329+
The `ALTER VIEW SET OPTIONS` statement would modify view options after creation, specifically the `security_invoker` setting that controls view permission behavior.
330+
331+
### Parameters
332+
333+
| Parameter | Description | Required |
334+
| --- | --- | --- |
335+
| `view_name` | the name of the view to modify | Yes |
336+
| `security_invoker` | controls whether the view runs with the permissions of the view owner (false) or the current user (true). Accepts `true`, `false`, `1`, or `0` | Yes |
337+
338+
### Current Status
339+
340+
{% include_cached copy-clipboard.html %}
341+
~~~ sql
342+
-- This will return an unimplemented error
343+
ALTER VIEW my_view SET ( security_invoker = false );
344+
~~~
345+
346+
```
347+
ERROR: at or near ")": syntax error: unimplemented: this syntax
348+
HINT: You have attempted to use a feature that is not yet implemented.
349+
```
350+
351+
### See Also
352+
353+
- [`CREATE VIEW`]({% link {{ page.version.version }}/create-view.md %})
354+
- [`DROP VIEW`]({% link {{ page.version.version }}/drop-view.md %})
355+
- [`SHOW CREATE`]({% link {{ page.version.version }}/show-create.md %})
356+
357+
---
358+
359+
## Related Feature Flag
360+
361+
The security invoker functionality is controlled by the `allow_view_with_security_invoker_clause` session setting:
362+
363+
{% include_cached copy-clipboard.html %}
364+
~~~ sql
365+
-- Enable security invoker support
366+
SET allow_view_with_security_invoker_clause = on;
367+
368+
-- Verify the setting
369+
SHOW allow_view_with_security_invoker_clause;
370+
~~~
371+
372+
When this setting is disabled (default), attempting to create views with the `security_invoker` option will result in:
373+
374+
```
375+
ERROR: security invoker views are not supported
376+
```
377+
378+
[HUMAN REVIEW: The security invoker feature appears to be related to PostgreSQL-style security definer/invoker views, but the specific behavior and security implications should be verified against the intended implementation.]
379+
380+
<!-- END REF DOC DRAFT -->

0 commit comments

Comments
 (0)