feat: Add ability to set sql security option

dev-mkc19 · dev-mkc19 · commit bb7a6f7772a9 · 2025-03-20T11:36:59.000+03:00
resolve SQL security and definer logic #359
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,7 @@
+### Release [1.8.10]
+#### New Features
+* Added abillity to set [SQL Security](https://clickhouse.com/docs/en/sql-reference/statements/create/view#sql_security) for normal views, referenced by [issue 359](https://github.com/ClickHouse/dbt-clickhouse/issues/359).
+
 ### Release [1.8.9], 2025-02-16
 
 #### Improvements
diff --git a/README.md b/README.md
@@ -106,7 +106,7 @@ your_profile_name:
 ## Model Configuration
 
 | Option                 | Description                                                                                                                                                                                                                                                                                                          | Default if any |
-|------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|
+| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- |
 | engine                 | The table engine (type of table) to use when creating tables                                                                                                                                                                                                                                                         | `MergeTree()`  |
 | order_by               | A tuple of column names or arbitrary expressions. This allows you to create a small sparse index that helps find data faster.                                                                                                                                                                                        | `tuple()`      |
 | partition_by           | A partition is a logical combination of records in a table by a specified criterion. The partition key can be any expression from the table columns.                                                                                                                                                                 |                |
@@ -120,6 +120,10 @@ your_profile_name:
 | query_settings         | A map/dictionary of ClickHouse user level settings to be used with `INSERT` or `DELETE` statements in conjunction with this model                                                                                                                                                                                    |                |
 | ttl                    | A TTL expression to be used with the table.  The TTL expression is a string that can be used to specify the TTL for the table.                                                                                                                                                                                       |                |
 | indexes                | A list of indexes to create, available only for `table` materialization. For examples look at ([#397](https://github.com/ClickHouse/dbt-clickhouse/pull/397))                                                                                                                                                        |                |
+| sql_security           | Allow you to specify which ClickHouse user to use when executing the view's underlying query. `SQL SECURITY` has three legal values: `DEFINER`, `INVOKER`, or `NONE`.                                                                                                                                                |                |
+| definer                | If `sql_security` was set to `DEFINER`, you have to specify any existing user or `CURRENT_USER` in the `DEFINER` clause.                                                                                                                                                                                             |                |
+|                        |                                                                                                                                                                                                                                                                                                                      |                |
+
 
 ## Column Configuration
 
diff --git a/dbt/adapters/clickhouse/__version__.py b/dbt/adapters/clickhouse/__version__.py
@@ -1 +1 @@
-version = '1.8.9'
+version = '1.8.10'
diff --git a/dbt/include/clickhouse/macros/materializations/view.sql b/dbt/include/clickhouse/macros/materializations/view.sql
@@ -37,11 +37,32 @@
 {%- endmaterialization -%}
 
 
+{% macro get_sql_security_clause(relation) %}
+  {% set sql_security = config.get('sql_security') %}
+  {% if sql_security -%}
+    {% if sql_security == 'definer' -%}
+    {%- set definer = config.require('definer') -%}
+      {% if not definer -%}
+        {{ exceptions.raise_compiler_error("Invalid config parameter `definer`. No value was provided.") }}
+      {%- endif %}
+      DEFINER = {{ definer }} SQL SECURITY DEFINER
+    {%- elif sql_security == 'invoker' %}
+      SQL SECURITY INVOKER
+    {%- elif sql_security == 'none' %}
+      SQL SECURITY NONE
+    {%- else %}
+      {{ exceptions.raise_compiler_error("Invalid config parameter `sql_security`. Got: `" + sql_security + "`, but only definer | invoker | none allowed.") }}
+    {%- endif %}
+  {%- endif %}
+{%- endmacro -%}
+
+
 {% macro clickhouse__create_view_as(relation, sql) -%}
   {%- set sql_header = config.get('sql_header', none) -%}
   {{ sql_header if sql_header is not none }}
 
-  create or replace view {{ relation.include(database=False) }} {{ on_cluster_clause(relation)}}
+  create or replace view {{ relation.include(database=False) }} {{ on_cluster_clause(relation) }}
+    {{ get_sql_security_clause(relation) }}
     {% set contract_config = config.get('contract') %}
     {% if contract_config.enforced %}
       {{ get_assert_columns_equivalent(sql) }}

Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-version = '1.8.9'`
	`1`	`+version = '1.8.10'`