mysql - 向有条件的行授予选择权限

Question

如何授予对 View DRVADM 中包含的所有信息的读取权限 除了用户出生日期不为空的行？

Answer 1

考虑以下因素:

drop table if exists variousRights;
create table variousRights
(   -- whitelist table of various privileges
    id int auto_increment primary key,
    rightType varchar(100) not null,
    username varchar(100) not null
);

-- sample data below. For this exercise, all we care about is 'seeNullBirthDateRows'
-- but other data is inserted to ferret out troubles with strategy (too many rows returned)
insert variousRights (rightType,userName) values
('seeNullBirthDateRows','root@localhost'),
('seeNullBirthDateRows','sam@localhost'),
('seeSecretIDs','root@localhost'),
('insertThing101','root@localhost');

drop table if exists employees;
create table employees
(   id int auto_increment primary key,
    empName varchar(100) not null,
    birthDate date null
);

-- sample data inserted. One has a null for birthDate (empty as you say in the question)
insert employees(empName,birthDate) values
('John Smith',null),
('Sally Higgins','2016-02-07'),
('John Smith','2010-01-27');

查询:

select id,empName,birthDate 
from employees
where birthDate is not null
union
select e.id,e.empName,e.birthDate 
from employees e
cross join (select id from variousRights where rightType='seeNullBirthDateRows' and userName=current_user()) vr
where e.birthDate is null;

该查询依赖于交叉联接和并集。至于联合，第一部分对于所有用户来说都是相同的:来自 employees 且出生日期非空的所有行。联合的第二部分将为您在 variousRights 表中指定特权的用户返回空值。

当然，上面的查询可以放入 View 中。

请参阅 mysql 手册页以了解 CURRENT_USER()功能。

至于交叉连接，可以这样想。它是笛卡尔积。但是加入的表(别名 vr)将返回 1 行或 0 行。这决定了特权用户是否看到空的birthDate 行。

注:以上内容已经过测试。看起来工作正常。