Skip to content

Commit 83607f9

Browse files
leto-bbqleto-bbq
committed
add datasync and authority in table sql manual
1 parent f63f2fc commit 83607f9

18 files changed

Lines changed: 5252 additions & 0 deletions

‎src/.vuepress/sidebar/V2.0.x/en-Table.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,8 @@ export const enSidebar = {
239239
{ text: 'Set Operations', link: 'Set-Operations_apache' },
240240
],
241241
},
242+
{ text: 'Data Sync', link: 'SQL-Data-Sync_apache' },
243+
{ text: 'Authority Management', link: 'SQL-Authority-Management_apache' },
242244
{ text: 'Maintenance Statements', link: 'SQL-Maintenance-Statements_apache' },
243245
{ text: 'Identifier', link: 'Identifier' },
244246
{ text: 'Keywords', link: 'Keywords' },

‎src/.vuepress/sidebar/V2.0.x/zh-Table.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,8 @@ export const zhSidebar = {
238238
{ text: '集合操作', link: 'Set-Operations_apache' },
239239
],
240240
},
241+
{ text: '数据同步', link: 'SQL-Data-Sync_apache' },
242+
{ text: '权限管理', link: 'SQL-Authority-Management_apache' },
241243
{ text: '运维语句', link: 'SQL-Maintenance-Statements_apache' },
242244
{ text: '标识符', link: 'Identifier' },
243245
{ text: '保留字&关键字', link: 'Keywords' },

‎src/UserGuide/Master/Table/SQL-Manual/SQL-Authority-Management_apache.md‎

Lines changed: 378 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,378 @@
1+
<!--
2+
3+
Licensed to the Apache Software Foundation (ASF) under one
4+
or more contributor license agreements. See the NOTICE file
5+
distributed with this work for additional information
6+
regarding copyright ownership. The ASF licenses this file
7+
to you under the Apache License, Version 2.0 (the
8+
"License"); you may not use this file except in compliance
9+
with the License. You may obtain a copy of the License at
10+
11+
http://www.apache.org/licenses/LICENSE-2.0
12+
13+
Unless required by applicable law or agreed to in writing,
14+
software distributed under the License is distributed on an
15+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16+
KIND, either express or implied. See the License for the
17+
specific language governing permissions and limitations
18+
under the License.
19+
20+
-->
21+
22+
# Authority Management
23+
24+
This document is the SQL manual for authority management starting from version V2.0.7. For detailed function usage, see [Authority Management](../User-Manual/Authority-Management-Upgrade_apache.md). For an introduction to authority management functions before version V2.0.7, refer to [Authority Management](../User-Manual/Authority-Management_apache.md)
25+
26+
## 1. Privilege List
27+
28+
<table>
29+
<tbody>
30+
<tr>
31+
<th>Privilege Type</th>
32+
<th>Privilege Name</th>
33+
<th>Scope of Effect</th>
34+
<th>Description</th>
35+
</tr>
36+
<!-- Global Privileges - SYSTEM -->
37+
<tr>
38+
<td rowspan="17">Global Privileges</td>
39+
<td rowspan="6">SYSTEM</td>
40+
<td rowspan="6">Global</td>
41+
<td>Allows users to create, modify, and delete databases.</td>
42+
</tr>
43+
<tr>
44+
<td>Allows users to create, modify, and delete tables and table views.</td>
45+
</tr>
46+
<tr>
47+
<td>Allows users to create, delete, and view user-defined functions.</td>
48+
</tr>
49+
<tr>
50+
<td>Allows users to create, start, stop, delete, and view PIPEs. Allows users to create, delete, and view PIPEPLUGINS.</td>
51+
</tr>
52+
<tr>
53+
<td>Allows users to query and cancel queries. Allows users to view variables. Allows users to view cluster status.</td>
54+
</tr>
55+
<tr>
56+
<td>Allows users to create, delete, and view deep learning models.</td>
57+
</tr>
58+
<!-- Global Privileges - SECURITY -->
59+
<tr>
60+
<td rowspan="10">SECURITY</td>
61+
<td rowspan="10">Global</td>
62+
<td>Allows users to create users.</td>
63+
</tr>
64+
<tr>
65+
<td>Allows users to delete users.</td>
66+
</tr>
67+
<tr>
68+
<td>Allows users to modify user passwords.</td>
69+
</tr>
70+
<tr>
71+
<td>Allows users to view user privilege information.</td>
72+
</tr>
73+
<tr>
74+
<td>Allows users to list all users.</td>
75+
</tr>
76+
<tr>
77+
<td>Allows users to create roles.</td>
78+
</tr>
79+
<tr>
80+
<td>Allows users to delete roles.</td>
81+
</tr>
82+
<tr>
83+
<td>Allows users to view role privilege information.</td>
84+
</tr>
85+
<tr>
86+
<td>Allows users to grant a role to a user or revoke it.</td>
87+
</tr>
88+
<tr>
89+
<td>Allows users to list all roles.</td>
90+
</tr>
91+
<!-- Global Privileges - AUDIT -->
92+
<tr>
93+
<td>AUDIT</td>
94+
<td>Global</td>
95+
<td>Allows users to maintain audit log rules and view audit logs.</td>
96+
</tr>
97+
<!-- Data Privileges - CREATE -->
98+
<tr>
99+
<td rowspan="15">Data Privileges</td>
100+
<td rowspan="3">CREATE</td>
101+
<td>ANY</td>
102+
<td>Allows creating any table and any database.</td>
103+
</tr>
104+
<tr>
105+
<td>Database</td>
106+
<td>Allows users to create tables under this database; allows users to create a database with this name.</td>
107+
</tr>
108+
<tr>
109+
<td>Table</td>
110+
<td>Allows users to create a table with this name.</td>
111+
</tr>
112+
<!-- Data Privileges - ALTER -->
113+
<tr>
114+
<td rowspan="3">ALTER</td>
115+
<td>ANY</td>
116+
<td>Allows modifying the definition of any table and any database.</td>
117+
</tr>
118+
<tr>
119+
<td>Database</td>
120+
<td>Allows users to modify the definition of a database and the definitions of tables under that database.</td>
121+
</tr>
122+
<tr>
123+
<td>Table</td>
124+
<td>Allows users to modify the definition of a table.</td>
125+
</tr>
126+
<!-- Data Privileges - SELECT -->
127+
<tr>
128+
<td rowspan="3">SELECT</td>
129+
<td>ANY</td>
130+
<td>Allows querying data from any table in any database in the system.</td>
131+
</tr>
132+
<tr>
133+
<td>Database</td>
134+
<td>Allows users to query data from any table in this database.</td>
135+
</tr>
136+
<tr>
137+
<td>Table</td>
138+
<td>Allows users to query data in this table. When executing multi-table queries, the database only displays data that the user has permission to access.</td>
139+
</tr>
140+
<!-- Data Privileges - INSERT -->
141+
<tr>
142+
<td rowspan="3">INSERT</td>
143+
<td>ANY</td>
144+
<td>Allows inserting/updating data into any table in any database.</td>
145+
</tr>
146+
<tr>
147+
<td>Database</td>
148+
<td>Allows users to insert/update data into any table within the scope of this database.</td>
149+
</tr>
150+
<tr>
151+
<td>Table</td>
152+
<td>Allows users to insert/update data into this table.</td>
153+
</tr>
154+
<!-- Data Privileges - DELETE -->
155+
<tr>
156+
<td rowspan="3">DELETE</td>
157+
<td>ANY</td>
158+
<td>Allows deleting data from any table.</td>
159+
</tr>
160+
<tr>
161+
<td>Database</td>
162+
<td>Allows users to delete data within the scope of this database.</td>
163+
</tr>
164+
<tr>
165+
<td>Table</td>
166+
<td>Allows users to delete data from this table.</td>
167+
</tr>
168+
</tbody>
169+
</table>
170+
171+
## 2. SQL Statements
172+
173+
### 2.1 User and Role Management
174+
175+
1. Create User (Requires SECURITY privilege)
176+
177+
```SQL
178+
CREATE USER <USERNAME> <PASSWORD>
179+
eg: CREATE USER user1 'passwd';
180+
```
181+
182+
2. Change Password
183+
184+
Users can change their own passwords, but changing other users' passwords requires the SECURITY privilege.
185+
186+
```SQL
187+
ALTER USER <USERNAME> SET PASSWORD <password>
188+
eg: ALTER USER tempuser SET PASSWORD 'newpwd';
189+
```
190+
191+
3. Drop User (Requires SECURITY privilege)
192+
193+
```SQL
194+
DROP USER <USERNAME>
195+
eg: DROP USER user1;
196+
```
197+
198+
4. Create Role (Requires SECURITY privilege)
199+
200+
```SQL
201+
CREATE ROLE <ROLENAME>
202+
eg: CREATE ROLE role1;
203+
```
204+
205+
5. Drop Role (Requires SECURITY privilege)
206+
207+
```SQL
208+
DROP ROLE <ROLENAME>
209+
eg: DROP ROLE role1;
210+
```
211+
212+
6. Grant Role to User (Requires SECURITY privilege)
213+
214+
```SQL
215+
GRANT ROLE <ROLENAME> TO <USERNAME>
216+
eg: GRANT ROLE admin TO user1;
217+
```
218+
219+
7. Revoke Role from User (Requires SECURITY privilege)
220+
221+
```SQL
222+
REVOKE ROLE <ROLENAME> FROM <USERNAME>
223+
eg: REVOKE ROLE admin FROM user1;
224+
```
225+
226+
8. List All Users (Requires SECURITY privilege)
227+
228+
```SQL
229+
LIST USER;
230+
```
231+
232+
9. List All Roles (Requires SECURITY privilege)
233+
234+
```SQL
235+
LIST ROLE;
236+
```
237+
238+
10. List All Users Under a Specified Role (Requires SECURITY privilege)
239+
240+
```SQL
241+
LIST USER OF ROLE <ROLENAME>
242+
eg: LIST USER OF ROLE roleuser;
243+
```
244+
245+
11. List All Roles of a Specified User
246+
247+
Users can list their own roles, but listing other users' roles requires the SECURITY privilege.
248+
249+
```SQL
250+
LIST ROLE OF USER <USERNAME>
251+
eg: LIST ROLE OF USER tempuser;
252+
```
253+
254+
12. List All Privileges of a User
255+
256+
Users can list their own privilege information, but listing other users' privileges requires the SECURITY privilege.
257+
258+
```SQL
259+
LIST PRIVILEGES OF USER <USERNAME>
260+
eg: LIST PRIVILEGES OF USER tempuser;
261+
```
262+
263+
13. List All Privileges of a Role
264+
265+
Users can list the privilege information of roles they possess, but listing other roles' privileges requires the SECURITY privilege.
266+
267+
```SQL
268+
LIST PRIVILEGES OF ROLE <ROLENAME>
269+
eg: LIST PRIVILEGES OF ROLE actor;
270+
```
271+
272+
### 2.2 Privilege Management
273+
274+
#### 2.2.1 Grant Privileges
275+
276+
1. Grant user management privileges to a user
277+
278+
```SQL
279+
GRANT SECURITY TO USER <USERNAME>
280+
eg: GRANT SECURITY TO USER TEST_USER;
281+
```
282+
283+
2. Grant a user the privilege to create databases and create tables within the database scope, and allow the user to manage privileges within that scope
284+
285+
```SQL
286+
GRANT CREATE ON DATABASE <DATABASE> TO USER <USERNAME> WITH GRANT OPTION
287+
eg: GRANT CREATE ON DATABASE TESTDB TO USER TEST_USER WITH GRANT OPTION;
288+
```
289+
290+
3. Grant a role the privilege to query a database
291+
292+
```SQL
293+
GRANT SELECT ON DATABASE <DATABASE> TO ROLE <ROLENAME>
294+
eg: GRANT SELECT ON DATABASE TESTDB TO ROLE TEST_ROLE;
295+
```
296+
297+
4. Grant a user the privilege to query a table
298+
299+
```SQL
300+
GRANT SELECT ON <DATABASE>.<TABLENAME> TO USER <USERNAME>
301+
eg: GRANT SELECT ON TESTDB.TESTTABLE TO USER TEST_USER;
302+
```
303+
304+
5. Grant a role the privilege to query all databases and tables
305+
306+
```SQL
307+
GRANT SELECT ON ANY TO ROLE <ROLENAME>
308+
eg: GRANT SELECT ON ANY TO ROLE TEST_ROLE;
309+
```
310+
311+
6. ALL Syntax Sugar: ALL represents all privileges within the object scope. You can use the ALL field to flexibly grant privileges.
312+
313+
```SQL
314+
GRANT ALL TO USER TESTUSER;
315+
-- Grants all privileges available to the user, including global privileges and all data privileges in the ANY scope
316+
317+
GRANT ALL ON ANY TO USER TESTUSER;
318+
-- Grants all data privileges available in the ANY scope to the user. After executing this statement, the user will have all data privileges on all databases
319+
320+
GRANT ALL ON DATABASE TESTDB TO USER TESTUSER;
321+
-- Grants all data privileges available in the DB scope to the user. After executing this statement, the user will have all data privileges on this database
322+
323+
GRANT ALL ON TABLE TESTTABLE TO USER TESTUSER;
324+
-- Grants all data privileges available in the TABLE scope to the user. After executing this statement, the user will have all data privileges on this table
325+
```
326+
327+
#### 2.2.2 Revoke Privileges
328+
329+
1. Revoke user management privileges from a user
330+
331+
```SQL
332+
REVOKE SECURITY FROM USER <USERNAME>
333+
eg: REVOKE SECURITY FROM USER TEST_USER;
334+
```
335+
336+
2. Revoke a user's privilege to create databases and create tables within the database scope
337+
338+
```SQL
339+
REVOKE CREATE ON DATABASE <DATABASE> FROM USER <USERNAME>
340+
eg: REVOKE CREATE ON DATABASE TEST_DB FROM USER TEST_USER;
341+
```
342+
343+
3. Revoke a user's privilege to query a table
344+
345+
```SQL
346+
REVOKE SELECT ON <DATABASE>.<TABLENAME> FROM USER <USERNAME>
347+
eg: REVOKE SELECT ON TESTDB.TESTTABLE FROM USER TEST_USER;
348+
```
349+
350+
4. Revoke a user's privilege to query all databases and tables
351+
352+
```SQL
353+
REVOKE SELECT ON ANY FROM USER <USERNAME>
354+
eg: REVOKE SELECT ON ANY FROM USER TEST_USER;
355+
```
356+
357+
5. ALL Syntax Sugar: ALL represents all privileges within the object scope. You can use the ALL field to flexibly revoke privileges.
358+
359+
```SQL
360+
REVOKE ALL FROM USER TESTUSER;
361+
-- Revokes all global privileges and all data privileges in the ANY scope from the user
362+
363+
REVOKE ALL ON ANY FROM USER TESTUSER;
364+
-- Revokes all data privileges in the ANY scope from the user, and does not affect DB-scope and TABLE-scope privileges
365+
366+
REVOKE ALL ON DATABASE TESTDB FROM USER TESTUSER;
367+
-- Revokes all data privileges on the DB from the user, and does not affect TABLE privileges
368+
369+
REVOKE ALL ON TABLE TESTDB FROM USER TESTUSER;
370+
-- Revokes all data privileges on the TABLE from the user
371+
```
372+
373+
#### 2.2.3 View User Privileges
374+
375+
```SQL
376+
LIST PRIVILEGES OF USER <USERNAME>
377+
eg: LIST PRIVILEGES OF USER tempuser
378+
```

0 commit comments

Comments
 (0)