使用 case 语句创建函数以封装行级安全性答案

【问题标题】：Create function to encapsulate row level security using case statement使用 case 语句创建函数以封装行级安全性
【发布时间】：2021-02-02 22:30:42
【问题描述】：

我想创建一个函数来实现雪花 DW 中的行级安全性以用于报告目的。为此，我们想创建一个函数来保留该逻辑并在选择查询中调用它。

但是创建这个函数，会抛出错误：

CREATE or replace FUNCTION derive_sbg()
returns NUMBER(1,0)
as $$ CASE
    when (select current_role()) = 'z_DEPARTMENT_A_DEVELOPER' and SBG   = 'A' then 1 
    when (select current_role()) = 'z_DEPARTMENT_B_DEVELOPER' and SBG   = 'B' then 1  
    when (select current_role()) = 'z_DEPARTMENT_C_DEVELOPER' and SBG   = 'C' then 1  
    when (select current_role()) = 'z_DEPARTMENT_D_DEVELOPER' and SBG   = 'D' then 1  
    when (select current_role()) = 'z_DEPARTMENT_E_DEVELOPER' and SBG   = 'E' then 1  
    when (select current_role()) = 'z_DEPARTMENT_ALL_DEVELOPER' and  SBG in ('A','B','C','D','E') then 1 
    ELSE 0 END $$;

错误：SQL 编译错误：位置 71 处的错误第 2 行无效标识符 'SBG'

注意：SBG 是 dev.corp_report.sales_info 表中的列

不过，当我如下所述直接在我的选择查询中运行逻辑（函数）时，工作得非常完美

select * from dev.corp_report.sales_info  WHERE 1 = 
CASE
when (select current_role()) = 'z_DEPARTMENT_A_DEVELOPER' and SBG   = 'A' then 1 
when (select current_role()) = 'z_DEPARTMENT_B_DEVELOPER' and SBG   = 'B' then 1  
when (select current_role()) = 'z_DEPARTMENT_C_DEVELOPER' and SBG   = 'C' then 1  
when (select current_role()) = 'z_DEPARTMENT_D_DEVELOPER' and SBG   = 'D' then 1  
when (select current_role()) = 'z_DEPARTMENT_E_DEVELOPER' and SBG   = 'E' then 1  
when (select current_role()) = 'z_DEPARTMENT_ALL_DEVELOPER' and  SBG in ('A','B','C','D','E') then 1 
ELSE 0 END;

所以我想将这个逻辑隐藏在一个函数中，并在我的安全视图中像这样使用它

select * 
    from dev.corp_report.sales_info 
    WHERE 1 = derive_sbg();

非常感谢您的指导。 -问候

【问题讨论】：

不使用SBG的时候还能用吗？
'SBG' 是一列，条件检查必须有。

标签： sql snowflake-cloud-data-platform row-level-security

【解决方案1】：

没有表可以在函数上引用SBG；

CREATE or replace FUNCTION derive_sbg() returns NUMBER(1,0) as $$ CASE when (select 
current_role()) = 'z_DEPARTMENT_A_DEVELOPER' and SBG = 'A' then 1 when (select 
current_role()) = 'z_DEPARTMENT_B_DEVELOPER' and SBG = 'B' then 1
when (select current_role()) = 'z_DEPARTMENT_C_DEVELOPER' and SBG = 'C' then 1
when (select current_role()) = 'z_DEPARTMENT_D_DEVELOPER' and SBG = 'D' then 1
when (select current_role()) = 'z_DEPARTMENT_E_DEVELOPER' and SBG = 'E' then 1
when (select current_role()) = 'z_DEPARTMENT_ALL_DEVELOPER' and SBG in 
('A','B','C','D','E') then 1 ELSE 0 END from dev.corp_report.sales_info $$

【讨论】：