{

std::vector<UUID> ids;

ids.reserve(names.size());

for (const String & name : names)

{

auto id = findImpl(type, name);

if (id)

ids.push_back(*id);

}

return ids;

{

std::vector<UUID> res;

for (auto type : collections::range(AccessEntityType::MAX))

{

auto ids = findAllImpl(type);

res.insert(res.end(), ids.begin(), ids.end());

}

return res;

{

auto id = findImpl(type, name);

if (id)

return *id;

throwNotFound(type, name, storage_name);

{

std::vector<UUID> ids;

ids.reserve(names.size());

for (const String & name : names)

ids.push_back(getID(type, name));

return ids;

{

for (const auto & id : ids)

{

if (!exists(id))

return false;

}

return true;

{

if (auto name_and_type = readNameWithType(id, throw_if_not_exists))

return name_and_type->first;

return std::nullopt;

{

Strings res;

res.reserve(ids.size());

for (const auto & id : ids)

{

if (auto name = readName(id, throw_if_not_exists))

res.emplace_back(std::move(name).value());

}

return res;

{

if (auto entity = read(id, throw_if_not_exists))

return std::make_pair(entity->getName(), entity->getType());

return std::nullopt;

{

std::vector<std::pair<UUID, AccessEntityPtr>> entities;

for (const auto & id : findAll(type))

{

if (auto entity = tryRead(id))

entities.emplace_back(id, entity);

}

return entities;

{

auto id = generateRandomID();

if (insert(id, entity, replace_if_exists, throw_if_exists, conflicting_id))

return id;

return std::nullopt;

{

chassert(ids.empty() || (multiple_entities.size() == ids.size()));

if (multiple_entities.empty())

return {};

if (multiple_entities.size() == 1)

{

UUID id;

if (!ids.empty())

id = ids[0];

else

id = generateRandomID();

if (insert(id, multiple_entities[0], replace_if_exists, throw_if_exists))

return {id};

return {};

}

std::vector<AccessEntityPtr> successfully_inserted;

try

{

std::vector<UUID> new_ids;

for (size_t i = 0; i < multiple_entities.size(); ++i)

{

const auto & entity = multiple_entities[i];

UUID id;

if (!ids.empty())

id = ids[i];

else

id = generateRandomID();

if (insert(id, entity, replace_if_exists, throw_if_exists))

{

successfully_inserted.push_back(entity);

new_ids.push_back(id);

}

}

return new_ids;

}

catch (Exception & e)

{

/// Try to add more information to the error message.

if (!successfully_inserted.empty())

{

String successfully_inserted_str;

for (const auto & entity : successfully_inserted)

{

if (!successfully_inserted_str.empty())

successfully_inserted_str += ", ";

successfully_inserted_str += entity->formatTypeWithName();

}

e.addMessage("After successfully inserting {}/{}: {}", successfully_inserted.size(), multiple_entities.size(), successfully_inserted_str);

}

throw;

}

{

if (isReadOnly())

throwReadonlyCannotInsert(entity->getType(), entity->getName());

throw Exception(ErrorCodes::NOT_IMPLEMENTED, "insertImpl is not implemented in {}", getStorageType());

{

++remove_depth;

SCOPE_EXIT(--remove_depth);

bool removed = removeImpl(id, throw_if_not_exists);

if (removed && remove_depth == 1)

removeReferencesToRemovedIDs({id});

return removed;

{

if (ids.empty())

return {};

if (ids.size() == 1)

return remove(ids[0], throw_if_not_exists) ? ids : std::vector<UUID>{};

++remove_depth;

SCOPE_EXIT(--remove_depth);

Strings removed_names;

std::vector<UUID> removed_ids;

try

{

std::vector<UUID> readonly_ids;

/// First we call removeImpl() for non-readonly entities. We bypass remove() here

/// to defer the dependency cleanup until after every entity has been removed —

/// otherwise we'd run the cascade once per id and waste work.

for (const auto & id : ids)

{

if (isReadOnly(id))

readonly_ids.push_back(id);

else

{

auto name = tryReadName(id);

if (removeImpl(id, throw_if_not_exists))

{

removed_ids.push_back(id);

if (name)

removed_names.push_back(std::move(name).value());

}

}

}

/// For readonly entities we're still going to call removeImpl() because

/// isReadOnly(id) could change and even if it's not then a storage-specific

/// implementation of removeImpl() will probably generate a better error message.

for (const auto & id : readonly_ids)

{

auto name = tryReadName(id);

if (removeImpl(id, throw_if_not_exists))

{

removed_ids.push_back(id);

if (name)

removed_names.push_back(std::move(name).value());

}

}

}

catch (Exception & e)

{

/// Even on failure, clean up references for the entities we did remove so the

/// access state on disk does not retain dangling UUIDs.

if (!removed_ids.empty() && remove_depth == 1)

{

std::unordered_set<UUID> removed_set(removed_ids.begin(), removed_ids.end());

removeReferencesToRemovedIDs(removed_set);

}

/// Try to add more information to the error message.

if (!removed_names.empty())

{

String removed_names_str;

for (const auto & name : removed_names)

{

if (!removed_names_str.empty())

removed_names_str += ", ";

removed_names_str += backQuote(name);

}

e.addMessage("After successfully removing {}/{}: {}", removed_names.size(), ids.size(), removed_names_str);

}

throw;

}

if (!removed_ids.empty() && remove_depth == 1)

{

std::unordered_set<UUID> removed_set(removed_ids.begin(), removed_ids.end());

removeReferencesToRemovedIDs(removed_set);

}

return removed_ids;

{

if (removed_ids.empty())

return;

auto update_func = [&removed_ids](const AccessEntityPtr & old, const UUID &) -> AccessEntityPtr

{

auto new_entity = old->clone();

new_entity->removeDependencies(removed_ids);

return new_entity;

};

/// Any access entity type can reference any other (e.g. a user references roles, a

/// settings profile references roles/users, a row policy references roles/users, etc.),

/// so we walk every type. Iteration is O(N) where N is the total number of access

/// entities — typically small.

for (auto type : collections::range(AccessEntityType::MAX))

{

std::vector<UUID> dependent_ids;

try

{

dependent_ids = findAllImpl(type);

}

catch (...)

{

tryLogCurrentException(getLogger(), "while listing access entities for dependency cleanup");

continue;

}

for (const auto & dependent_id : dependent_ids)

{

/// An entity can never depend on itself in the relevant sense, and we just

/// removed entities in `removed_ids` — there is nothing to update for them.

if (removed_ids.contains(dependent_id))

continue;

try

{

auto entity = readImpl(dependent_id, /* throw_if_not_exists= */ false);

if (!entity)

continue;

if (!entity->hasDependencies(removed_ids))

continue;

/// `update()` will dispatch to the same storage that owns the entity,

/// so for `MultipleAccessStorage` this naturally crosses sub-storages.

/// `throw_if_not_exists=false` covers concurrent removals.

update(dependent_id, update_func, /* throw_if_not_exists= */ false);

}

catch (Exception & e)

{

/// A read-only sub-storage (e.g. `users.xml`) cannot be updated. That is

/// expected — its content is reloaded from the config so any references

/// will be reconciled on the next reload. Don't fail the whole cascade.

if (e.code() == ErrorCodes::ACCESS_STORAGE_READONLY)

continue;

tryLogCurrentException(getLogger(),

"while removing references to dropped access entities from " + outputID(dependent_id));

}

catch (...)

{

tryLogCurrentException(getLogger(),

"while removing references to dropped access entities from " + outputID(dependent_id));

}

}

}

{

if (isReadOnly(id))

{

auto entity = read(id, throw_if_not_exists);

if (!entity)

return false;

throwReadonlyCannotRemove(entity->getType(), entity->getName());

}

throw Exception(ErrorCodes::NOT_IMPLEMENTED, "removeImpl is not implemented in {}", getStorageType());

{

if (ids.empty())

return {};

if (ids.size() == 1)

return update(ids[0], update_func, throw_if_not_exists) ? ids : std::vector<UUID>{};

Strings names_of_updated;

try

{

std::vector<UUID> ids_of_updated;

std::vector<UUID> readonly_ids;

/// First we call update() for non-readonly entities.

for (const auto & id : ids)

{

if (isReadOnly(id))

readonly_ids.push_back(id);

else

{

auto name = tryReadName(id);

if (update(id, update_func, throw_if_not_exists))

{

ids_of_updated.push_back(id);

if (name)

names_of_updated.push_back(std::move(name).value());

}

}

}

/// For readonly entities we're still going to call update() because

/// isReadOnly(id) could change and even if it's not then a storage-specific

/// implementation of updateImpl() will probably generate a better error message.

for (const auto & id : readonly_ids)

{

auto name = tryReadName(id);

if (update(id, update_func, throw_if_not_exists))

{

ids_of_updated.push_back(id);

if (name)

names_of_updated.push_back(std::move(name).value());

}

}

return ids_of_updated;

}

catch (Exception & e)

{

/// Try to add more information to the error message.

if (!names_of_updated.empty())

{

String names_of_updated_str;

for (const auto & name : names_of_updated)

{

if (!names_of_updated_str.empty())

names_of_updated_str += ", ";

names_of_updated_str += backQuote(name);

}

e.addMessage("After successfully updating {}/{}: {}", names_of_updated.size(), ids.size(), names_of_updated_str);

}

throw;

}

{

if (isReadOnly(id))

{

auto entity = read(id, throw_if_not_exists);

if (!entity)

return false;

throwReadonlyCannotUpdate(entity->getType(), entity->getName());

}

throw Exception(ErrorCodes::NOT_IMPLEMENTED, "updateImpl is not implemented in {}", getStorageType());

const Credentials & credentials,

const Poco::Net::IPAddress & address,

const ExternalAuthenticators & external_authenticators,

const ClientInfo & client_info,

bool allow_no_password,

bool allow_plaintext_password) const

{

return *authenticateImpl(credentials, address, external_authenticators, client_info, /* throw_if_user_not_exists = */ true, allow_no_password, allow_plaintext_password);

const Credentials & credentials,

const Poco::Net::IPAddress & address,

const ExternalAuthenticators & external_authenticators,

const ClientInfo & client_info,

bool throw_if_user_not_exists,

bool allow_no_password,

bool allow_plaintext_password) const

{

return authenticateImpl(credentials, address, external_authenticators, client_info, throw_if_user_not_exists, allow_no_password, allow_plaintext_password);

{

if (type == AuthenticationType::NO_PASSWORD)

return allow_no_password;

if (type == AuthenticationType::PLAINTEXT_PASSWORD)

return allow_plaintext_password;

return true;

const Credentials & credentials,

const Poco::Net::IPAddress & address,

const ExternalAuthenticators & external_authenticators,

const ClientInfo & client_info,

bool throw_if_user_not_exists,

bool allow_no_password,

bool allow_plaintext_password) const

{

if (auto id = find<User>(credentials.getUserName()))

{

if (auto user = tryRead<User>(*id))

{

AuthResult auth_result { .user_id = *id, .user_name = credentials.getUserName() };

if (!isAddressAllowed(*user, address))

throwAddressNotAllowed(address);

bool skipped_not_allowed_authentication_methods = false;

bool need_second_factor = false;

const AuthenticationData * matched_authentication_method = nullptr;

for (const auto & auth_method : user->authentication_methods)

{

auto auth_type = auth_method.getType();

if (!authenticationTypeIsAllowed(auth_type, allow_no_password, allow_plaintext_password))

{

skipped_not_allowed_authentication_methods = true;

continue;

}

auto cred_check_result = areCredentialsValid(user->getName(), auth_method, credentials, external_authenticators, client_info, auth_result.settings);

if (cred_check_result == Authentication::CredentialsCheckResult::Success)

{

matched_authentication_method = &auth_method;

break;

}

if (cred_check_result == Authentication::CredentialsCheckResult::NeedSecondFactor)

need_second_factor = true;

}

if (matched_authentication_method)

{

/// `AlwaysAllowCredentials` are used only after an internal caller has authenticated the user, for

/// example with an interserver secret. They do not identify any particular authentication method, so

/// applying one method's `GRANTS` or `VALID UNTIL` here would incorrectly make those method-specific

/// limits affect the internal connection. Preserve the matched method's type for session logging.

if (typeid_cast<const AlwaysAllowCredentials *>(&credentials))

{

auth_result.authentication_data = *matched_authentication_method;

auth_result.authentication_data.setGrants({});

auth_result.authentication_data.setValidUntil(0);

return auth_result;

}

auth_result.authentication_data = *matched_authentication_method;

/// Fail-close against ambiguous credentials. Authentication returns the first matching method, but the

/// same effective credential can be accepted by more than one method (for example `IDENTIFIED BY 'p', BY 'p'`

/// stores two `sha256_password` methods with different random salts). If a broader or earlier method could

/// shadow a later token-style method, a limited credential would silently regain the full rights (or lifetime)

/// of the other method. To prevent that, the session is limited to the intersection of the `GRANTS` of all

/// matching methods and expires at the earliest of their `VALID UNTIL`. The scan matches credentials

/// while ignoring expiry: an already-expired method that accepts the credential must still shorten the

/// combined `VALID UNTIL` (rejecting the login below), otherwise the expiry of a token method would

/// silently hand the shared credential the rights and lifetime of the broader method.

///

/// Methods that neither restrict the grants nor set an expiry cannot narrow anything and are skipped without

/// an extra credential check. Methods verified against an external system (`LDAP`/`KERBEROS`/`HTTP`/`JWT`) are

/// also skipped, so authentication never performs an extra external probe here: a probe with the same credential

/// could fail against a different server and, for example, trip an account lockout there. This skip cannot lose

/// a `GRANTS` narrowing, because a `GRANTS` clause on an externally verified method is rejected at creation

/// (see `AuthenticationData::fromAST`); it can only lose a `VALID UNTIL` of such a method, matching the

/// pre-existing first-match behavior of per-method `VALID UNTIL`.

std::optional<AccessRights> combined_grants;

if (!matched_authentication_method->getGrants().structurallyEmpty())

combined_grants.emplace(matched_authentication_method->getGrants());

bool another_method_restricts_grants = false;

time_t combined_valid_until = matched_authentication_method->getValidUntil();

for (const auto & other_method : user->authentication_methods)

{

if (&other_method == matched_authentication_method)

continue;

/// A method disabled by `allow_no_password` / `allow_plaintext_password` must be ignored here too,

/// exactly as in the primary loop above; otherwise it could narrow or expire an otherwise allowed login.

if (!authenticationTypeIsAllowed(other_method.getType(), allow_no_password, allow_plaintext_password))

continue;

const bool restricts_grants = !other_method.getGrants().structurallyEmpty();

const time_t other_valid_until = other_method.getValidUntil();

if (!restricts_grants && other_valid_until == 0)

continue;

if (!authenticationTypeIsVerifiedLocally(other_method.getType()))

continue;

SettingsChanges discarded_settings;

if (areCredentialsValid(user->getName(), other_method, credentials, external_authenticators, client_info, discarded_settings, /* check_valid_until = */ false)

!= Authentication::CredentialsCheckResult::Success)

continue;

if (restricts_grants)

{

another_method_restricts_grants = true;

AccessRights other_grants{other_method.getGrants()};

if (combined_grants)

combined_grants->makeIntersection(other_grants);

else

combined_grants.emplace(std::move(other_grants));

}

if (other_valid_until != 0 && (combined_valid_until == 0 || other_valid_until < combined_valid_until))

combined_valid_until = other_valid_until;

}

/// The earliest `VALID UNTIL` among the matching methods wins even when it has already passed:

/// the shared credential is expired as a whole, exactly as if the single matched method had expired.

if (combined_valid_until != 0)

{

const time_t now = std::chrono::system_clock::to_time_t(std::chrono::system_clock::now());

if (now > combined_valid_until)

throw Exception(ErrorCodes::WRONG_PASSWORD, "Invalid credentials");

}

if (another_method_restricts_grants)

{

AccessRightsElements limited = combined_grants->getElements();

if (limited.structurallyEmpty())

limited.emplace_back(); /// Empty intersection means deny all (`USAGE ON *.*`), not "no limit".

auth_result.authentication_data.setGrants(std::move(limited));

}

if (combined_valid_until != matched_authentication_method->getValidUntil())

auth_result.authentication_data.setValidUntil(combined_valid_until);

return auth_result;

}

if (skipped_not_allowed_authentication_methods)

{

LOG_INFO(getLogger(), "Skipped the check for not allowed authentication methods,"

"check allow_no_password and allow_plaintext_password settings in the server configuration");

}

if (need_second_factor)

throw Exception(ErrorCodes::REQUIRED_SECOND_FACTOR, "Authentication requires second factor");

throw Exception(ErrorCodes::WRONG_PASSWORD, "Invalid credentials");

}

}

if (throw_if_user_not_exists)

throwNotFound(AccessEntityType::USER, credentials.getUserName(), storage_name);

else

return std::nullopt;

const std::string & user_name,

const AuthenticationData & authentication_method,

const Credentials & credentials,

const ExternalAuthenticators & external_authenticators,

const ClientInfo & client_info,

SettingsChanges & settings,

bool check_valid_until)

{

if (!credentials.isReady())

return Authentication::CredentialsCheckResult::Fail;

if (credentials.getUserName() != user_name)

return Authentication::CredentialsCheckResult::Fail;

if (check_valid_until)

{

auto valid_until = authentication_method.getValidUntil();

if (valid_until)

{

const time_t now = std::chrono::system_clock::to_time_t(std::chrono::system_clock::now());

if (now > valid_until)

return Authentication::CredentialsCheckResult::Fail;

}

}

return Authentication::areCredentialsValid(credentials, authentication_method, external_authenticators, client_info, settings);

{

if (!isBackupAllowed())

throwBackupNotAllowed();

auto entities_ids = findAll(type);

if (entities_ids.empty())

return;

auto backup_entry_with_path = makeBackupEntryForAccessEntities(

entities_ids,

backup_entries_collector.getAllAccessEntities(),

backup_entries_collector.getBackupSettings().write_access_entities_dependents,

data_path_in_backup);

if (isReplicated())

{

auto backup_coordination = backup_entries_collector.getBackupCoordination();

auto replication_id = getReplicationID();

backup_coordination->addReplicatedAccessFilePath(replication_id, type, backup_entry_with_path.first);

backup_entries_collector.addPostTask(

[backup_entry = backup_entry_with_path.second,

replication_id,

type,

&backup_entries_collector,

backup_coordination]

{

for (const String & path : backup_coordination->getReplicatedAccessFilePaths(replication_id, type))

backup_entries_collector.addBackupEntry(path, backup_entry);

});

}

else

{

backup_entries_collector.addBackupEntry(backup_entry_with_path);

}

{

if (!isRestoreAllowed())

throwRestoreNotAllowed();

if (isReplicated())

{

auto restore_coordination = restorer.getRestoreCoordination();

if (!restore_coordination->acquireReplicatedAccessStorage(getReplicationID()))

return;

}

restorer.addDataRestoreTask(

[this, &restorer, data_path_in_backup]

{

auto entities_to_restore = restorer.getAccessEntitiesToRestore(data_path_in_backup);

const auto & restore_settings = restorer.getRestoreSettings();

restoreAccessEntitiesFromBackup(*this, entities_to_restore, restore_settings);

});

{

static Poco::UUIDGenerator generator;

UUID id;

generator.createRandom().copyTo(reinterpret_cast<char *>(&id));

return id;

{

std::unordered_map<UUID, size_t> positions_by_id;

std::unordered_map<std::string_view, size_t> positions_by_type_and_name[static_cast<size_t>(AccessEntityType::MAX)];

std::vector<size_t> positions_to_remove;

for (size_t pos = 0; pos != entities.size(); ++pos)

{

const auto & [id, entity] = entities[pos];

if (auto it = positions_by_id.find(id); it == positions_by_id.end())

{

positions_by_id[id] = pos;

}

else if (it->second != pos)

{

/// Conflict: same ID is used for multiple entities. We will ignore them.

positions_to_remove.emplace_back(pos);

positions_to_remove.emplace_back(it->second);

}

std::string_view entity_name = entity->getName();

auto & positions_by_name = positions_by_type_and_name[static_cast<size_t>(entity->getType())];

if (auto it = positions_by_name.find(entity_name); it == positions_by_name.end())

{

positions_by_name[entity_name] = pos;

}

else if (it->second != pos)

{

/// Conflict: same name and type are used for multiple entities. We will ignore them.

positions_to_remove.emplace_back(pos);

positions_to_remove.emplace_back(it->second);

}

}

if (positions_to_remove.empty())

return;

std::sort(positions_to_remove.begin(), positions_to_remove.end());

positions_to_remove.erase(std::unique(positions_to_remove.begin(), positions_to_remove.end()), positions_to_remove.end());

for (size_t pos : positions_to_remove)

{

LOG_WARNING(

log_,

"Skipping {} (id={}) due to conflicts with other access entities",

entities[pos].second->formatTypeWithName(),

toString(entities[pos].first));

}

/// Remove conflicting entities.

for (size_t pos : positions_to_remove | boost::adaptors::reversed) /// Must remove in reversive order.

entities.erase(entities.begin() + pos);

{

callOnce(log_initialized, [&] {

log = ::getLogger("Access(" + storage_name + ")");

});

return log;

{

int error_code = AccessEntityTypeInfo::get(type).not_found_error_code;

throw Exception(error_code, "There is no {} in {}", formatEntityTypeWithName(type, name), backQuote(storage_name));

{

throw Exception(ErrorCodes::LOGICAL_ERROR, "{}: {} expected to be of type {}", outputID(id),