Add priv check

[flaneur2020]

I hereby agree to the terms of the CLA available at: https://databend.rs/dev/policies/cla/

Summary

Summary about this PR

• add checks on write operations
• find user identity with client ip on authenticating user.
• take default@127.0.0.1 to run the stateless tests

Changelog

• New Feature

Related Issues

Fixes #3170

Test Plan

Unit Tests

Stateless Tests

[databend-bot]

Thanks for the contribution!
I have applied any labels matching special text in your PR Changelog.

Please review the labels and make any necessary changes.

[vercel]

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/databend/databend/Hd845vASwdywbeV498TapZB3WvpH
✅ Preview: https://databend-git-fork-flaneur2020-add-priv-check-databend.vercel.app

[Deployment for 7ad46d1 canceled]

[BohuTANG]

common/meta/types mainly for type definiton.
Maybe better to put the verify_privilege in other place?

[flaneur2020]

before adding roles, we might need a seperate PrivilegeManager to cache and verify the user privileges (it needs cache all the roles' privileges, and generate an effective grant set with the privileges merged from the roles), maybe the PrivilegeManager could be the better place to verify the privilege, and leaving the types user_grant mod as plain data objects. 🤔

this refactor requires some work, maybe we can make this refactor in a stand-alone PR? q.q

[BohuTANG]

That's OK

[BohuTANG]

check_privilege is better?

[flaneur2020]

there're some validate_ and check_ functions in our codebase, as the existing convention, the check_ functions often return a bool and used in an if condition, and the validate_ functions often returns an Result<()>, and mostly used as a short-circuit call with a ?, which breaks the control flow if any error occurred, like:

validate_expression(&expr)?;

   57 fn validate_function_arg(
   58     name: &str,
   59     args_len: usize,
   60     variadic_arguments: Option<(usize, usize)>,
   61     num_arguments: usize,
   62 ) -> Result<()> {

in this case, the validate_privilege function would return an Result<()> and used as a short-circuit call with a ?, i guess naming it as validate_ follows the convension in the current codebase? 🤔

[BohuTANG]

Good 👍

[BohuTANG]

/lgtm

[codecov-commenter]

Codecov Report

Merging #3710 (7ad46d1) into main (8745add) will increase coverage by 0%.
The diff coverage is 80%.

@@          Coverage Diff          @@
##            main   #3710   +/-   ##
=====================================
  Coverage     59%     59%           
=====================================
  Files        711     711           
  Lines      38305   38344   +39     
=====================================
+ Hits       22878   22905   +27     
- Misses     15427   15439   +12     

Impacted Files	Coverage Δ
common/meta/types/src/user_grant.rs	62% <ø> (ø)
common/meta/types/src/user_identity.rs	75% <ø> (ø)
common/meta/types/src/user_info.rs	87% <ø> (ø)
common/meta/types/src/user_privilege.rs	33% <ø> (ø)
query/src/interpreters/interpreter_kill.rs	0% <0%> (ø)
query/src/users/user_mgr.rs	83% <64%> (-3%)	⬇️
query/src/functions/context_function.rs	92% <100%> (ø)
...ry/src/interpreters/interpreter_database_create.rs	83% <100%> (+1%)	⬆️
...uery/src/interpreters/interpreter_database_drop.rs	95% <100%> (+<1%)	⬆️
query/src/interpreters/interpreter_insert.rs	82% <100%> (+1%)	⬆️
... and 9 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8745add...7ad46d1. Read the comment docs.

[databend-bot]

Wait for another reviewer approval