CalvinKirs opened a new pull request, #67444: URL: https://github.com/apache/doris/pull/67444
### What this PR does Adjusts what `mysql.user` returns so the visible rows follow the requesting user's privileges, and keeps password-derived columns out of the result entirely. - Rows are now scoped to the caller: role administrators (`ADMIN_PRIV` or `GRANT_PRIV`) still see every account; other users see only their own account. - The `authentication_string` and `password_policy.history_passwords` columns are always rendered as `***` for every caller, including accounts with an empty password. To make row scoping possible, the caller identity is threaded through `TShowUserRequest` (the same pattern already used by the sibling schema-table scanners such as `user_privileges` and `processlist`), so the FE can filter rows. A request without an identity returns no rows. ### Compatibility - `current_user_ident` is an `optional` Thrift field, wire-compatible in both directions. - No metadata / editlog / storage-format change, so downgrade is clean. - During a rolling window where a new FE talks to an old BE that does not set the field, `mysql.user` returns no rows (fail-closed) until the BE is also upgraded; upgrading BE before FE avoids this. ### Tests - `FrontendServiceImplTest#testShowUser` asserts the administrator, normal-user, and no-identity behaviors, including that the password columns are masked. - `regression-test/suites/auth_p0/test_mysql_user_visibility.groovy` covers the end-to-end admin-vs-normal-user visibility and masking. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
