From a01c2e3f8c265aceb3042cdee1abafeed4f68485 Mon Sep 17 00:00:00 2001
From: Pervakov Grigorii <pervakov.grigory@gmail.com>
Date: Thu, 7 Nov 2024 16:51:53 +0300
Subject: [PATCH] Keep materialized view security overriden context until end
 of query

---
 src/Processors/Sinks/SinkToStorage.h                     | 4 ++++
 src/Storages/StorageMaterializedView.cpp                 | 2 ++
 ...67_materialized_view_keeps_security_context.reference | 1 +
 .../03267_materialized_view_keeps_security_context.sql   | 9 +++++++++
 4 files changed, 16 insertions(+)
 create mode 100644 tests/queries/0_stateless/03267_materialized_view_keeps_security_context.reference
 create mode 100644 tests/queries/0_stateless/03267_materialized_view_keeps_security_context.sql

diff --git a/src/Processors/Sinks/SinkToStorage.h b/src/Processors/Sinks/SinkToStorage.h
index c728fa87b1ea..4bdcb2fe8550 100644
--- a/src/Processors/Sinks/SinkToStorage.h
+++ b/src/Processors/Sinks/SinkToStorage.h
@@ -5,6 +5,8 @@
 namespace DB
 {
 
+class Context;
+
 /// Sink which is returned from Storage::write.
 class SinkToStorage : public ExceptionKeepingTransform
 {
@@ -16,12 +18,14 @@ friend class PartitionedSink;
 
     const Block & getHeader() const { return inputs.front().getHeader(); }
     void addTableLock(const TableLockHolder & lock) { table_locks.push_back(lock); }
+    void addInterpreterContext(std::shared_ptr<const Context> context) { interpreter_context.emplace_back(std::move(context)); }
 
 protected:
     virtual void consume(Chunk & chunk) = 0;
 
 private:
     std::vector<TableLockHolder> table_locks;
+    std::vector<std::shared_ptr<const Context>> interpreter_context;
 
     void onConsume(Chunk chunk) override;
     GenerateResult onGenerate() override;
diff --git a/src/Storages/StorageMaterializedView.cpp b/src/Storages/StorageMaterializedView.cpp
index d047b28e076f..3289ff1ae255 100644
--- a/src/Storages/StorageMaterializedView.cpp
+++ b/src/Storages/StorageMaterializedView.cpp
@@ -382,6 +382,7 @@ void StorageMaterializedView::read(
         }
 
         query_plan.addStorageHolder(storage);
+        query_plan.addInterpreterContext(context);
         query_plan.addTableLock(std::move(lock));
     }
 }
@@ -405,6 +406,7 @@ SinkToStoragePtr StorageMaterializedView::write(const ASTPtr & query, const Stor
 
     auto sink = storage->write(query, metadata_snapshot, context, async_insert);
 
+    sink->addInterpreterContext(context);
     sink->addTableLock(lock);
     return sink;
 }
diff --git a/tests/queries/0_stateless/03267_materialized_view_keeps_security_context.reference b/tests/queries/0_stateless/03267_materialized_view_keeps_security_context.reference
new file mode 100644
index 000000000000..d00491fd7e5b
--- /dev/null
+++ b/tests/queries/0_stateless/03267_materialized_view_keeps_security_context.reference
@@ -0,0 +1 @@
+1
diff --git a/tests/queries/0_stateless/03267_materialized_view_keeps_security_context.sql b/tests/queries/0_stateless/03267_materialized_view_keeps_security_context.sql
new file mode 100644
index 000000000000..bb44e4920afa
--- /dev/null
+++ b/tests/queries/0_stateless/03267_materialized_view_keeps_security_context.sql
@@ -0,0 +1,9 @@
+DROP TABLE IF EXISTS {CLICKHOUSE_DATABASE:Identifier}.rview;
+DROP TABLE IF EXISTS {CLICKHOUSE_DATABASE:Identifier}.wview;
+
+-- Read from view
+CREATE MATERIALIZED VIEW rview ENGINE = File(CSV) POPULATE AS SELECT 1 AS c0;
+SELECT 1 FROM rview;
+
+-- Write through view populate
+CREATE MATERIALIZED VIEW wview ENGINE = Join(ALL, INNER, c0) POPULATE AS SELECT 1 AS c0;