派生表与投影别名

chusql-server/src/ChuSQL/Server/Backend.hs

@@ -283,7 +283,8 @@ statementNeedsDatabase stmt = any (not . T.any (== '.')) (statementTables stmt)
 tableRefsOf :: FromClause -> [Text]
 tableRefsOf FromUnit = []
 tableRefsOf (FromTable _ name) = [T.pack name]
-tableRefsOf (FromJoin _ left _ name cond) = tableRefsOf left ++ [T.pack name] ++ exprTables cond
+tableRefsOf (FromSubquery _ stmt) = statementTables stmt
+tableRefsOf (FromJoin _ left right cond) = tableRefsOf left ++ tableRefsOf right ++ exprTables cond
 
 -- | 表达式里出现的表（子查询是唯一的来路）
 exprTables :: Expr -> [Text]

chusql-server/test/Spec.hs

@@ -643,6 +643,15 @@ privilegeSpec = describe "server privileges" $ do
             Left err -> expectationFailure err
             Right stmt -> authorize service root testDatabase stmt `shouldReturn` Right ()
 
+    it "requires the privilege on the table inside a derived table" $ withPrivileges $ \service root -> do
+        _ <- runPrivilegeCommand service root testDatabase (CreateRoleCommand "reader")
+        _ <- runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "reader" False)
+        _ <- runPrivilegeCommand service root testDatabase (GrantRoleCommand "reader" ["alice"])
+        authorizeSql service (Ordinary testAccount) "SELECT d.name FROM (SELECT name FROM users) d"
+            `shouldReturn` Right ()
+        authorizeSql service (Ordinary testAccount) "SELECT d.name FROM (SELECT product FROM orders) d"
+            `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON orders")
+
     it "keeps the role tables on the real storage" $ withIpcStorage $ do
         base <- ipcBackend
         service <- newPrivileges base