xiangfu0 commented on code in PR #20183:
URL: https://github.com/apache/pinot/pull/20183#discussion_r4516365723
##########
pinot-core/src/main/java/org/apache/pinot/core/plan/maker/InstancePlanMakerImplV2.java:
##########
@@ -289,6 +295,30 @@ private static boolean
isAndRestrictionPushdownEnabled(AndRestrictionPushdownMod
}
}
+ /// Optimizes the row-level security (RLS) filter with the schema of the
table, as the WHERE clause that holds the
+ /// same filter. Then the RLS bitmap and the WHERE clause evaluate the same
predicate: for example, the optimizer
+ /// turns `intColumn = 2.0` into `intColumn = 2`, which the dictionary of an
INT column can look up.
+ ///
+ /// Always starts from the filter that the broker sent, so a second call
gives the same result. Fails the query when
+ /// the optimizer fails, because the query must not run without the RLS
filter.
+ private static void optimizeRowFilter(QueryContext queryContext) {
+ Expression rowFilterExpression = queryContext.getRowFilterExpression();
+ if (rowFilterExpression == null) {
+ return;
+ }
+ FilterContext rowFilter;
+ try {
+ rowFilter = RequestContextUtils.getFilter(
+ QUERY_OPTIMIZER.optimizeFilter(rowFilterExpression.deepCopy(),
queryContext.getSchema()));
Review Comment:
**[must-fix] Apply table expression overrides to the independent RLS
filter.** With a supported `expressionOverrideMap` of `lower(rawTenant)` to
indexed derived column `tenantLower`, the broker rewrites the WHERE policy, but
this independently parsed copy keeps `lower(rawTenant)`. If `rawTenant` has its
forward index disabled, materializing the new RLS bitmap now fails an otherwise
valid query because the original transform requires that index. Apply the
equivalent physical-table overrides to this copy before planning it, and cover
a non-identity override with a disabled source forward index through a real
broker/server regression.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
