系统表统一命名与迁移

chusql-server/src/ChuSQL/Server/Backend.hs

@@ -188,9 +188,9 @@ memoryBackendWith trusted name ref =
         }
   where
     -- | 按视角过滤库里的表
-    scoped = if trusted then filter (not . reserved . fst) else visible
+    scoped = if trusted then filter (not . blocked . fst) else visible
     -- | 该视角下要隐藏的表
-    hidden = if trusted then reserved else internalTable
+    hidden = if trusted then blocked else internalTable
     -- | 取结果列名，空结果回落到解析
     colsOf db stmt rows = case rows of
         [] -> columnsFromStatement db stmt
@@ -352,15 +352,15 @@ systemDatabaseName = "system"
 usersTable :: String
 usersTable = "__system_users"
 
--- | 角色与授权表的名字，不带内部前缀
+-- | 角色与授权表的名字，在系统库里但服务自己要读写
 rolesTable :: String
-rolesTable = "sys_roles"
+rolesTable = "__system_roles"
 
 grantsTable :: String
-grantsTable = "sys_grants"
+grantsTable = "__system_grants"
 
 membersTable :: String
-membersTable = "sys_members"
+membersTable = "__system_members"
 
 internalNames :: [String]
 internalNames = [rolesTable, grantsTable, membersTable]
@@ -369,9 +369,17 @@ internalNames = [rolesTable, grantsTable, membersTable]
 reserved :: String -> Bool
 reserved = T.isPrefixOf "__system_" . T.toLower . T.pack
 
+-- | 是不是服务自己要经请求通道读写的表
+privilegeTable :: String -> Bool
+privilegeTable name = T.unpack (T.toLower (T.pack name)) `elem` internalNames
+
 -- | 是不是服务自己的内部表
 internalTable :: String -> Bool
-internalTable name = reserved name || T.unpack (T.toLower (T.pack name)) `elem` internalNames
+internalTable name = reserved name || privilegeTable name
+
+-- | 外部语句能不能碰这张表
+blocked :: String -> Bool
+blocked name = reserved name && not (privilegeTable name)
 
 -- | 去掉内部表
 visible :: Database -> Database

chusql-server/test/Spec.hs

@@ -553,6 +553,25 @@ privilegeSpec = describe "server privileges" $ do
             Left err -> expectationFailure err
             Right stmt -> authorize service root testDatabase stmt `shouldReturn` Right ()
 
+    it "keeps the role tables on the real storage" $ withIpcStorage $ do
+        base <- ipcBackend
+        service <- newPrivileges base
+        created <- runPrivilegeCommand service (Root testRootName) testDatabase (CreateRoleCommand "reader")
+        created `shouldBe` Right ()
+        views <- listRoleViews service
+        fmap (map roleName) views `shouldBe` Right ["reader"]
+        -- 改名后真存储上仍要读得到角色表
+        let system = beWithDatabase base "system"
+        stored <- beStatement system "SELECT * FROM __system_roles"
+        case stored of
+            Left err -> expectationFailure ("select __system_roles: " ++ err)
+            Right result -> concatMap (map snd) (srRows result) `shouldContain` [VStr "reader"]
+        -- 账号表不给语句通道看到
+        denied <- beStatement system "SELECT * FROM __system_users"
+        case denied of
+            Left _ -> pure ()
+            Right result -> expectationFailure ("account table must stay hidden: " ++ show (srRows result))
+
 -- 真存储夹具：一个用例一份数据目录，跑完关链路删干净
 
 -- | 本次用例的数据目录（用例串行跑，固定名够用）