SHOW MASKING POLICIES gives UNKNOWN_TABLE (60) instead of SUPPORT_IS_DISABLED (344)

[clickgapai]

Found via ClickGap automated review. Please close or comment if this is incorrect or needs adjustment.

Retrospective finding from a historical scan of PR #92402 (merged 2025-12-17). Confirmed on current codebase — close with a note if already fixed.

Describe what's wrong

Running SHOW MASKING POLICIES on an OSS build returns a confusing error about system.masking_policies not existing (UNKNOWN_TABLE, code 60), instead of the intended Cloud-only guard error (SUPPORT_IS_DISABLED, code 344) that SHOW CREATE MASKING POLICY correctly returns.

Root cause: InterpreterShowAccessEntitiesQuery.cpp:117-136 — the MASKING_POLICY case in getRewrittenQuery() generates a query against system.masking_policies which does not exist in OSS builds, instead of throwing SUPPORT_IS_DISABLED like the SHOW CREATE path does.

Affected locations:

• src/Interpreters/Access/InterpreterShowAccessEntitiesQuery.cpp:117 — MASKING_POLICY case in getRewrittenQuery() generates SQL against non-existent system.masking_policies

Impact: Users running SHOW MASKING POLICIES on OSS ClickHouse get a confusing 'Unknown table system.masking_policies' error instead of a clear 'Masking Policies are available only in ClickHouse Cloud' message. All variants (SHOW MASKING POLICIES, SHOW MASKING POLICIES ON db.table) are affected.

Does it reproduce on most recent release?

Yes — confirmed on current master (commit ac0ea6720cf7).

How to reproduce

-- Test: SHOW MASKING POLICIES should give SUPPORT_IS_DISABLED (344) not UNKNOWN_TABLE (60)

-- This correctly throws SUPPORT_IS_DISABLED (error code 344)
SHOW CREATE MASKING POLICY mask_email ON mydb.mytable; -- { serverError SUPPORT_IS_DISABLED }

-- This SHOULD throw SUPPORT_IS_DISABLED (344) but instead throws UNKNOWN_TABLE (60)
SHOW MASKING POLICIES; -- { serverError SUPPORT_IS_DISABLED }

Expected behavior

Both statements should return error code 344 (SUPPORT_IS_DISABLED) with message 'Masking Policies are available only in ClickHouse Cloud'

Error message and/or stacktrace

Expected server error code: 344 but got: 60. Code: 60. DB::Exception: Unknown table expression identifier 'system.masking_policies' in scope SELECT name FROM system.masking_policies ORDER BY name ASC. (UNKNOWN_TABLE)

Additional context

Open risks:

• Same missing guard may exist in other interpreters that handle MASKING_POLICY, e.g. InterpreterMoveAccessEntityQuery

Suggested fix: Add a guard at the top of the MASKING_POLICY case in InterpreterShowAccessEntitiesQuery::getRewrittenQuery() (or in execute()) that throws Exception(ErrorCodes::SUPPORT_IS_DISABLED, 'Masking Policies are available only in ClickHouse Cloud'), matching the pattern used in InterpreterShowCreateAccessEntityQuery::getEntities() at line 343-346.

Analysis details: Confidence HIGH | Severity P3 | Testability: STATELESS_SQL

Found during automated review of PR #92402.

[zlareb1]

https://fiddle.clickhouse.com/86d18f0d-b17f-458c-8235-8c5a32e1f7e5

[clickgapai]

Looking at the fiddle, you're right - this is inconsistent behavior.

The issue is that SHOW MASKING POLICIES tries to query system.masking_policies (which doesn't exist in OSS builds) and fails with UNKNOWN_TABLE, while SHOW CREATE MASKING POLICY correctly returns SUPPORT_IS_DISABLED.

The root cause is in InterpreterShowAccessEntitiesQuery::getRewrittenQuery() at line 117-136. It generates:

SELECT name FROM system.masking_policies ...

But this table only exists in Cloud builds. The interpreter should check for Cloud-only features before generating the query, just like InterpreterShowCreateAccessEntityQuery::getEntities() does at lines 343-346.

The fix would be to add a guard in the MASKING_POLICY case that throws SUPPORT_IS_DISABLED before attempting to query the non-existent table. This would make both commands return the same error code (344) and provide a clearer message to users.

This inconsistency could confuse users who might think masking policies are partially implemented when they see UNKNOWN_TABLE instead of a clear "not supported" message.