Skip to content

Commit 57f457d

Browse files
TCeasonTCeason
authored
chore: add rbac about sequence and nextval (#2551)
1 parent cae764d commit 57f457d

File tree

4 files changed

+53
-3
lines changed

4 files changed

+53
-3
lines changed

‎docs/en/guides/56-security/access-control/01-privileges.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ Databend offers a range of privileges that allow you to exercise fine-grained co
112112
| CREATE DATABASE | Global | Creates a database or UDF. |
113113
| CREATE WAREHOUSE | Global | Creates a warehouse. |
114114
| CREATE CONNECTION | Global | Creates a connection. |
115+
| CREATE SEQUENCE | Global | Creates a sequence. |
115116
| DELETE | Table | Deletes or truncates rows in a table. |
116117
| DROP | Global, Database, Table, View | Drops a database, table, view or UDF. Undrops a table. |
117118
| INSERT | Table | Inserts rows into a table. |
@@ -128,6 +129,7 @@ Databend offers a range of privileges that allow you to exercise fine-grained co
128129
| READ | Stage | Read a stage. |
129130
| USAGE | UDF | Use udf. |
130131
| ACCESS CONNECTION | CONNECTION | Access connection. |
132+
| ACCESS SEQUENCE | SEQUENCE | Access sequence. |
131133

132134
### Global Privileges
133135

@@ -235,3 +237,11 @@ Please note that you can use the [USE DATABASE](/sql/sql-commands/ddl/database/d
235237
| Access Connection | Can access Connection. |
236238
| ALL | Grants Access Connection privileges for the specified object type. |
237239
| OWNERSHIP | Grants full control over a Connection. Only a single role can hold this privilege on a specific object at a time. |
240+
241+
### Sequence Privileges
242+
243+
| Privilege | Description |
244+
|:----------------|:-----------------------------------------------------------------------------------------------------------------|
245+
| Access Sequence | Can access Sequence.(e.g. Drop,Desc) |
246+
| ALL | Grants Access Sequence privileges for the specified object type. |
247+
| OWNERSHIP | Grants full control over a Sequence. Only a single role can hold this privilege on a specific object at a time. |

‎docs/en/sql-reference/10-sql-commands/00-ddl/01-table/10-ddl-create-table.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar_position: 1
55

66
import FunctionDescription from '@site/src/components/FunctionDescription';
77

8-
<FunctionDescription description="Introduced or updated: v1.2.714"/>
8+
<FunctionDescription description="Introduced or updated: v1.2.784"/>
99

1010
import EEFeature from '@site/src/components/EEFeature';
1111

@@ -114,6 +114,7 @@ By default, **all columns are nullable(NULL)** in Databend. If you need a column
114114
- An expression with no input arguments and returns a scalar value, such as `1 + 1`, `NOW()` or `UUID()`.
115115
- A dynamically generated value from a sequence, such as `NEXTVAL(staff_id_seq)` for the `staff_id` column in the example below.
116116
- NEXTVAL must be used as a standalone default value; expressions like `NEXTVAL(seq1) + 1` are not supported.
117+
- Users must adhere to their granted permissions for sequence utilization, including operations such as [NEXTVAL](/sql/sql-functions/sequence-functions/nextval#access-control-requirements)
117118

118119
```sql
119120
CREATE SEQUENCE staff_id_seq;

‎docs/en/sql-reference/10-sql-commands/00-ddl/04-sequence/create-sequence.md

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar_position: 1
55

66
import FunctionDescription from '@site/src/components/FunctionDescription';
77

8-
<FunctionDescription description="Introduced or updated: v1.2.426"/>
8+
<FunctionDescription description="Introduced or updated: v1.2.784"/>
99

1010
Creates a new sequence in Databend.
1111

@@ -25,6 +25,25 @@ CREATE [ OR REPLACE ] SEQUENCE [IF NOT EXISTS] <sequence>
2525
|--------------|-----------------------------------------|
2626
| `<sequence>` | The name of the sequence to be created. |
2727

28+
## Access control requirements
29+
30+
| Privilege | Object Type | Description |
31+
|:----------------|:------------|:----------------------|
32+
| CREATE SEQUENCE | Global | Creates a sequence. |
33+
34+
35+
To create a sequence, the user performing the operation or the [current_role](/guides/security/access-control/roles) must have the CREATE SEQUENCE [privilege](/guides/security/access-control/privileges).
36+
37+
:::note
38+
39+
The enable_experimental_sequence_rbac_check settings governs sequence-level access control. It is disabled by default.
40+
sequence creation solely requires the user to possess superuser privileges, bypassing detailed RBAC checks.
41+
When enabled, granular permission verification is enforced during sequence establishment.
42+
43+
This is an experimental feature and may be enabled by default in the future.
44+
45+
:::
46+
2847
## Examples
2948

3049
This example showcases how sequences and the [NEXTVAL](/sql/sql-functions/sequence-functions/nextval) function are employed to automatically generate and assign unique identifiers to rows in a table.

‎docs/en/sql-reference/20-sql-functions/18-sequence-functions/nextval.md

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: NEXTVAL
33
---
44
import FunctionDescription from '@site/src/components/FunctionDescription';
55

6-
<FunctionDescription description="Introduced or updated: v1.2.453"/>
6+
<FunctionDescription description="Introduced or updated: v1.2.784"/>
77

88
Retrieves the next value from a sequence.
99

@@ -17,6 +17,26 @@ NEXTVAL(<sequence_name>)
1717

1818
Integer.
1919

20+
## Access control requirements
21+
22+
| Privilege | Object Type | Description |
23+
|:----------------|:------------|:-------------------|
24+
| ACCESS SEQUENCE | SEQUENCE | Access a sequence. |
25+
26+
27+
To access a sequence, the user performing the operation or the roles must have the ACCESS SEQUENCE [privilege](/guides/security/access-control/privileges).
28+
29+
:::note
30+
31+
The enable_experimental_sequence_rbac_check settings governs sequence-level access control. It is disabled by default.
32+
sequence creation solely requires the user to possess superuser privileges, bypassing detailed RBAC checks.
33+
When enabled, granular permission verification is enforced during sequence establishment.
34+
35+
This is an experimental feature and may be enabled by default in the future.
36+
37+
:::
38+
39+
2040
## Examples
2141

2242
This example demonstrates how the NEXTVAL function works with a sequence:

0 commit comments

Comments
 (0)