Skip to content

Fix wrong access type for PREWARM PRIMARY INDEX CACHE ON CLUSTER#109198

Merged
Algunenano merged 2 commits into
ClickHouse:masterfrom
Algunenano:fix-prewarm-primary-index-cache-access
Jul 3, 2026
Merged

Fix wrong access type for PREWARM PRIMARY INDEX CACHE ON CLUSTER#109198
Algunenano merged 2 commits into
ClickHouse:masterfrom
Algunenano:fix-prewarm-primary-index-cache-access

Conversation

@Algunenano

@Algunenano Algunenano commented Jul 2, 2026

Copy link
Copy Markdown
Member

Closes: #105133

getRequiredAccessForDDLOnCluster required SYSTEM PREWARM MARK CACHE for the PREWARM_PRIMARY_INDEX_CACHE case (copy-paste from the neighbouring PREWARM_MARK_CACHE case), while local execution correctly checks SYSTEM PREWARM PRIMARY INDEX CACHE. As a result a user granted only SYSTEM PREWARM PRIMARY INDEX CACHE was denied SYSTEM PREWARM PRIMARY INDEX CACHE ... ON CLUSTER, and a user with only SYSTEM PREWARM MARK CACHE could run it.

Changelog category (leave one):

  • Bug Fix (user-visible misbehavior in an official stable release)

Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):

Fix the access check for SYSTEM PREWARM PRIMARY INDEX CACHE ... ON CLUSTER, which incorrectly required the SYSTEM PREWARM MARK CACHE privilege instead of SYSTEM PREWARM PRIMARY INDEX CACHE.

Version info

  • Merged into: 26.7.1.472 (included in 26.7 and later)

getRequiredAccessForDDLOnCluster required SYSTEM PREWARM MARK CACHE for
the PREWARM_PRIMARY_INDEX_CACHE case (copy-paste from the neighbouring
PREWARM_MARK_CACHE case), while local execution correctly checks
SYSTEM PREWARM PRIMARY INDEX CACHE. As a result, a user granted only
SYSTEM PREWARM PRIMARY INDEX CACHE was denied the ON CLUSTER variant,
and a user with only SYSTEM PREWARM MARK CACHE could run it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@clickhouse-gh

clickhouse-gh Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Workflow [PR], commit [3ea4c6b]

Summary:


AI Review

Summary

This PR fixes the ON CLUSTER access map for SYSTEM PREWARM PRIMARY INDEX CACHE so it matches the local execution path, and adds a focused regression test that covers both the allowed and denied privilege cases. The change is narrow, matches the linked issue, and I did not find remaining correctness or coverage gaps in the current diff.

Final Verdict

Status: ✅ Approve

@clickhouse-gh clickhouse-gh Bot added the pr-bugfix Pull request with bugfix, not backported by default label Jul 2, 2026
The successful ON CLUSTER query emits a distributed DDL result row whose
presence depends on distributed_ddl_output_mode. Force
distributed_ddl_output_mode=none so the test has no output regardless of
the default profile.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@clickhouse-gh

clickhouse-gh Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

LLVM Coverage Report

Metric Baseline Current Δ
Lines 85.50% 85.50% +0.00%
Functions 92.70% 92.60% -0.10%
Branches 77.70% 77.70% +0.00%

Changed lines: Changed C/C++ lines covered: 4/4 (100.00%) · Uncovered code

Full report · Diff report

@asya-ch asya-ch self-assigned this Jul 2, 2026
@Algunenano
Algunenano added this pull request to the merge queue Jul 3, 2026
Merged via the queue into ClickHouse:master with commit 6df94fe Jul 3, 2026
174 checks passed
@Algunenano
Algunenano deleted the fix-prewarm-primary-index-cache-access branch July 3, 2026 10:00
@robot-clickhouse-ci-2 robot-clickhouse-ci-2 added the pr-synced-to-cloud The PR is synced to the cloud repo label Jul 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pr-bugfix Pull request with bugfix, not backported by default pr-synced-to-cloud The PR is synced to the cloud repo

Projects

None yet

Development

Successfully merging this pull request may close these issues.

getRequiredAccessForDDLOnCluster uses wrong access type for PREWARM_PRIMARY_INDEX_CACHE

3 participants