An overview of the core components can be found in the included
TransactionalClusterMetadata.md
patch by Alex Petrov, Marcus Eriksson and Sam Tunnicliffe; reviewed by
Alex Petrov, Marcus Eriksson and Sam Tunnicliffe for CASSANDRA-18330
Co-authored-by: Marcus Eriksson <marcuse@apache.org>
Co-authored-by: Alex Petrov <oleksandr.petrov@gmail.com>
Co-authored-by: Sam Tunnicliffe <samt@apache.org>
Allows to attach the native masking functions and UDFs to the definitions of
table columns in the schema, as defined by CEP-20.
The functions masking a column can be specified on CREATE TABLE queries, right
at the end of the column definition. The mask of a column can also be changed
or dropped with an ALTER TABLE query. Once a column is masked, SELECT queries
will always return the masked value of the column. That masking is done on the
coordinator, at the end of the query execution. Thus, masking won't affect any
filters or ordering, which would be based on the clear values of the masked
columns. Column masks are stored on the table system_schema.column_masks.
A new UNMASK permission allows to see the clear data of columns with an
attached mask. Also, a new SELECT_MASKED permission allows to run SELECT
queries restricting the clear values of masked columns. Superusers have both
permissions by default, whereas regular users don't have them.
Dynamic data masking can be enabled/disabled with the config property
dynamic_data_masking_enabled in cassandra.yaml. It is disabled by default.
This is the combination of multiple tickets:
* Add masking functions to column metadata (CASSANDRA-18068)
* Add UNMASK permission (CASSANDRA-18069)
* Add SELECT_MASKED permission (CASSANDRA-18070)
* Add support for using UDFs as masking functions (CASSANDRA-18071)
* Add feature flag for dynamic data masking (CASSANDRA-18316)
patch by Andrés de la Peña; reviewed by Benjamin Lerer and Berenguer Blasi for CASSANDRA-17940
IF (NOT) EXISTS is now also offered in cqlsh completion for CREATE TYPE, DROP TYPE, CREATE ROLE and DROP ROLE
patch by Brad Schoening; reviewed by Stefan Miklosovic and Brandon Williams for CASSANDRA-16640
patch by Tommy Stendahl; reviewed by Stefan Miklosovic and Aleksey Yeschenko for CASSANDRA-10383
Co-authored-by: Tommy Stendahl <tommy.stendahl@ericsson.com>
Co-authored-by: Stefan Miklosovic <smiklosovic@apache.org>
patch by Francisco Guerrero; reviewed by Benjamin Lerer and Yifan Cai for CASSANDRA-17030
This commit allows GRANT/REVOKE statement to support multiple permissions with a single
statement. For example,
```
GRANT MODIFY, SELECT ON KEYSPACE field TO manager;
GRANT ALTER, DROP ON ROLE role1 TO role2;
```
Patch by Benjamin Lerer; Review by Andres de la Peña and Ekaterina Dimitrova for CASSANDRA-17027
In some cases it is useful to prevent users to alter or drop a keyspace
while allowing them to create new tables.
This patch add support for a new DataResource below KEYSPACE but above
TABLE. The syntax to grant permission at this level in ALL TABLES IN
KEYSPACE.
Patch by Blake Eggleston, Benedict Elliott Smith, Marcus Eriksson, Alex Petrov, Ariel Weisberg; Reviewed by Blake Eggleston, Marcus Eriksson, Benedict Elliott Smith, Alex Petrov, Ariel Weisberg for CASSANDRA-14404
Co-authored-by: Blake Eggleston <bdeggleston@gmail.com>
Co-authored-by: Benedict Elliott Smith <benedict@apache.org>
Co-authored-by: Marcus Eriksson <marcuse@apache.org>
Co-authored-by: Alex Petrov <oleksandr.petrov@gmail.com>
In CASSANDRA-8844, a new 'cdc' table option was added. The python
driver added this as a recognized option, which caused it to show up in
cqlsh autocomplete suggestions. However, the cqlsh tests were not
updated to match this.
This should fix the following failing tests:
- test_complete_in_create_table
- test_complete_in_create_columnfamily
Sam Tunnicliffe