Add more tests for column masking

[guyco33]

Tests are failing due to #10370

[findinpath]

it would be worth for the readability of the test scenario to perform the query without any column masking

[findinpath]

I don't quite get the purpose of this masking.
The column comment has the value nstructions sleep furiously among .
Why do you check for password in this text?

[guyco33]

I want to mask some values in comment column (in this case the password value) and also to use comment column as a reference for the decision about masking other columns (we called it "conditional masking")

In a real example there is a json payload column with some attributes that should be masked and a country attribute that used as a reference for masking other columns.

[findinpath]

The column comment has the value nstructions sleep furiously among .

This value doesn't contain a password substring. So, I guess the masking is pointless in this case. Or am I missing something?

[guyco33]

I found that issue happens in InlineProjections#inlineProjections
Maybe it relates on how column masks are added

[guyco33]

The column comment has the value nstructions sleep furiously among .

This value doesn't contain a password substring. So, I guess the masking is pointless in this case. Or am I missing something?

You are right. That's why I added the last test (L293:L337)

[findinpath]

I had a look again on the test and I am sorry to say that I still don't quite understand why isn't there any masking in the result of the queries.
Shouldn't the test demonstrate that the * is masking the content of the returned columns on which the masking should apply?

[guyco33]

Shouldn't the test demonstrate that the * is masking the content of the returned columns on which the masking should apply?

You are right. I fixed it now. Take a look on the tests with orderkey = 39 (L293:L337)

[guyco33]

The column comment has the value nstructions sleep furiously among .

This value doesn't contain a password substring. So, I guess the masking is pointless in this case. Or am I missing something?

That's right. masking is pointless for this specific row, but I added it to demonstrate the issue when adding the masking on orderstatus while refering clerk (L291)

[findinpath]

I see now.

The purpose of the test is currently just to demonstrate that the masking doesn't work properly. Thank you for the patience in trying to explain the purpose of the tests.

[guyco33]

Fails with Symbol clerk already has assignment

[guyco33]

Fails with Symbol clerk already has assignment

[guyco33]

Removing this test, since AC doesn't allow to have more than one masking per column.

trino/lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/security/TableAccessControlRule.java

Line 72 in 35986d7

this.columnConstraints = Maps.uniqueIndex(requireNonNull(columns, "columns is null").orElse(ImmutableList.of()), ColumnConstraint::getName);

[kokosing]

The change is good. Please squash the commits and change the PR title and description as well as commit message to focus on a bug fix (not adding tests).

[guyco33]

@kokosing Although the fix solves the issue, it creates another issue that can be seem in the last commit

[guyco33]

Fixed by #12262