Merge pull request #16382 from taosdata/feat/3.0_systable_privilege_wxy

feat: system table visible permission

include/common/systable.h

@@ -60,16 +60,20 @@ typedef struct SSysDbTableSchema {
   const char*   name;
   const int32_t type;
   const int32_t bytes;
+  const bool    sysInfo;
 } SSysDbTableSchema;
 
 typedef struct SSysTableMeta {
   const char*              name;
   const SSysDbTableSchema* schema;
   const int32_t            colNum;
+  const bool               sysInfo;
 } SSysTableMeta;
 
 void getInfosDbMeta(const SSysTableMeta** pInfosTableMeta, size_t* size);
 void getPerfDbMeta(const SSysTableMeta** pPerfsTableMeta, size_t* size);
+void getVisibleInfosTablesNum(bool sysInfo, size_t* size);
+bool invisibleColumn(bool sysInfo, int8_t tableType, int8_t flags);
 
 #ifdef __cplusplus
 }

include/common/tmsg.h

@@ -296,6 +296,7 @@ void    tFreeSSubmitRsp(SSubmitRsp* pRsp);
 #define COL_IDX_ON     ((int8_t)0x2)
 #define COL_SET_NULL   ((int8_t)0x10)
 #define COL_SET_VAL    ((int8_t)0x20)
+#define COL_IS_SYSINFO ((int8_t)0x40)
 struct SSchema {
   int8_t   type;
   int8_t   flags;
@@ -530,6 +531,7 @@ typedef struct {
   uint32_t connId;
   int32_t  dnodeNum;
   int8_t   superUser;
+  int8_t   sysInfo;
   int8_t   connType;
   SEpSet   epSet;
   int32_t  svrTimestamp;
@@ -1253,6 +1255,7 @@ typedef struct {
   uint64_t suid;
   uint64_t tuid;
   int32_t  vgId;
+  int8_t   sysInfo;
   SSchema* pSchemas;
 } STableMetaRsp;
 

include/libs/command/command.h

@@ -17,12 +17,12 @@
 #define TDENGINE_COMMAND_H
 
 #include "cmdnodes.h"
-#include "tmsg.h"
 #include "plannodes.h"
+#include "tmsg.h"
 
 typedef struct SExplainCtx SExplainCtx;
 
-int32_t qExecCommand(SNode* pStmt, SRetrieveTableRsp** pRsp);
+int32_t qExecCommand(bool sysInfoUser, SNode *pStmt, SRetrieveTableRsp **pRsp);
 
 int32_t qExecStaticExplain(SQueryPlan *pDag, SRetrieveTableRsp **pRsp);
 int32_t qExecExplainBegin(SQueryPlan *pDag, SExplainCtx **pCtx, int64_t startTs);

include/libs/nodes/plannodes.h

@@ -317,6 +317,7 @@ typedef struct SSystemTableScanPhysiNode {
   SEpSet         mgmtEpSet;
   bool           showRewrite;
   int32_t        accountId;
+  bool           sysInfo;
 } SSystemTableScanPhysiNode;
 
 typedef struct STableScanPhysiNode {

include/libs/parser/parser.h

@@ -49,6 +49,7 @@ typedef struct SParseContext {
   SStmtCallback*   pStmtCb;
   const char*      pUser;
   bool             isSuperUser;
+  bool             enableSysInfo;
   bool             async;
   int8_t           schemalessType;
   const char*      svrVer;

include/libs/planner/planner.h

@@ -38,6 +38,7 @@ typedef struct SPlanContext {
   char*       pMsg;
   int32_t     msgLen;
   const char* pUser;
+  bool        sysInfo;
 } SPlanContext;
 
 // Create the physical plan for the query, according to the AST.

source/client/inc/clientInt.h

@@ -137,6 +137,7 @@ typedef struct STscObj {
   char          db[TSDB_DB_FNAME_LEN];
   char          sVer[TSDB_VERSION_LEN];
   char          sDetailVer[128];
+  int8_t        sysInfo;
   int8_t        connType;
   int32_t       acctId;
   uint32_t      connId;

source/client/src/clientImpl.c

@@ -215,6 +215,7 @@ int32_t parseSql(SRequestObj* pRequest, bool topicQuery, SQuery** pQuery, SStmtC
                        .pUser = pTscObj->user,
                        .schemalessType = pTscObj->schemalessType,
                        .isSuperUser = (0 == strcmp(pTscObj->user, TSDB_DEFAULT_USER)),
+                       .enableSysInfo = pTscObj->sysInfo,
                        .svrVer = pTscObj->sVer,
                        .nodeOffline = (pTscObj->pAppInfo->onlineDnodes < pTscObj->pAppInfo->totalDnodes)};
 
@@ -246,7 +247,7 @@ int32_t parseSql(SRequestObj* pRequest, bool topicQuery, SQuery** pQuery, SStmtC
 
 int32_t execLocalCmd(SRequestObj* pRequest, SQuery* pQuery) {
   SRetrieveTableRsp* pRsp = NULL;
-  int32_t            code = qExecCommand(pQuery->pRoot, &pRsp);
+  int32_t            code = qExecCommand(pRequest->pTscObj->sysInfo, pQuery->pRoot, &pRsp);
   if (TSDB_CODE_SUCCESS == code && NULL != pRsp) {
     code = setQueryResultFromRsp(&pRequest->body.resInfo, pRsp, false, true);
   }
@@ -284,7 +285,7 @@ void asyncExecLocalCmd(SRequestObj* pRequest, SQuery* pQuery) {
     return;
   }
 
-  int32_t code = qExecCommand(pQuery->pRoot, &pRsp);
+  int32_t code = qExecCommand(pRequest->pTscObj->sysInfo, pQuery->pRoot, &pRsp);
   if (TSDB_CODE_SUCCESS == code && NULL != pRsp) {
     code = setQueryResultFromRsp(&pRequest->body.resInfo, pRsp, false, true);
   }
@@ -419,7 +420,8 @@ int32_t getPlan(SRequestObj* pRequest, SQuery* pQuery, SQueryPlan** pPlan, SArra
                       .showRewrite = pQuery->showRewrite,
                       .pMsg = pRequest->msgBuf,
                       .msgLen = ERROR_MSG_BUF_DEFAULT_SIZE,
-                      .pUser = pRequest->pTscObj->user};
+                      .pUser = pRequest->pTscObj->user,
+                      .sysInfo = pRequest->pTscObj->sysInfo};
 
   return qCreateQueryPlan(&cxt, pPlan, pNodeList);
 }
@@ -992,7 +994,8 @@ void launchAsyncQuery(SRequestObj* pRequest, SQuery* pQuery, SMetaData* pResultM
                           .showRewrite = pQuery->showRewrite,
                           .pMsg = pRequest->msgBuf,
                           .msgLen = ERROR_MSG_BUF_DEFAULT_SIZE,
-                          .pUser = pRequest->pTscObj->user};
+                          .pUser = pRequest->pTscObj->user,
+                          .sysInfo = pRequest->pTscObj->sysInfo};
 
       SAppInstInfo* pAppInfo = getAppInfo(pRequest);
       SQueryPlan*   pDag = NULL;
@@ -1577,10 +1580,11 @@ static int32_t doConvertUCS4(SReqResultInfo* pResultInfo, int32_t numOfRows, int
 }
 
 int32_t getVersion1BlockMetaSize(const char* p, int32_t numOfCols) {
-  int32_t cols = *(int32_t*) (p + sizeof(int32_t) * 3);
+  int32_t cols = *(int32_t*)(p + sizeof(int32_t) * 3);
   ASSERT(numOfCols == cols);
 
-  return sizeof(int32_t) + sizeof(int32_t) + sizeof(int32_t)*3 + sizeof(uint64_t) + numOfCols * (sizeof(int8_t) + sizeof(int32_t));
+  return sizeof(int32_t) + sizeof(int32_t) + sizeof(int32_t) * 3 + sizeof(uint64_t) +
+         numOfCols * (sizeof(int8_t) + sizeof(int32_t));
 }
 
 static int32_t estimateJsonLen(SReqResultInfo* pResultInfo, int32_t numOfCols, int32_t numOfRows) {

source/client/src/clientMain.c

@@ -759,6 +759,7 @@ int32_t createParseContext(const SRequestObj *pRequest, SParseContext **pCxt) {
                            .pUser = pTscObj->user,
                            .schemalessType = pTscObj->schemalessType,
                            .isSuperUser = (0 == strcmp(pTscObj->user, TSDB_DEFAULT_USER)),
+                           .enableSysInfo = pTscObj->sysInfo,
                            .async = true,
                            .svrVer = pTscObj->sVer,
                            .nodeOffline = (pTscObj->pAppInfo->onlineDnodes < pTscObj->pAppInfo->totalDnodes)};

source/client/src/clientMsgHandler.c

@@ -96,6 +96,7 @@ int32_t processConnectRsp(void* param, SDataBuf* pMsg, int32_t code) {
              connectRsp.epSet.eps[i].fqdn, connectRsp.epSet.eps[i].port, pTscObj->id);
   }
 
+  pTscObj->sysInfo = connectRsp.sysInfo;
   pTscObj->connId = connectRsp.connId;
   pTscObj->acctId = connectRsp.acctId;
   tstrncpy(pTscObj->sVer, connectRsp.sVer, tListLen(pTscObj->sVer));

source/common/src/tmsg.c

@@ -3630,6 +3630,7 @@ int32_t tSerializeSConnectRsp(void *buf, int32_t bufLen, SConnectRsp *pRsp) {
   if (tEncodeU32(&encoder, pRsp->connId) < 0) return -1;
   if (tEncodeI32(&encoder, pRsp->dnodeNum) < 0) return -1;
   if (tEncodeI8(&encoder, pRsp->superUser) < 0) return -1;
+  if (tEncodeI8(&encoder, pRsp->sysInfo) < 0) return -1;
   if (tEncodeI8(&encoder, pRsp->connType) < 0) return -1;
   if (tEncodeSEpSet(&encoder, &pRsp->epSet) < 0) return -1;
   if (tEncodeI32(&encoder, pRsp->svrTimestamp) < 0) return -1;
@@ -3652,6 +3653,7 @@ int32_t tDeserializeSConnectRsp(void *buf, int32_t bufLen, SConnectRsp *pRsp) {
   if (tDecodeU32(&decoder, &pRsp->connId) < 0) return -1;
   if (tDecodeI32(&decoder, &pRsp->dnodeNum) < 0) return -1;
   if (tDecodeI8(&decoder, &pRsp->superUser) < 0) return -1;
+  if (tDecodeI8(&decoder, &pRsp->sysInfo) < 0) return -1;
   if (tDecodeI8(&decoder, &pRsp->connType) < 0) return -1;
   if (tDecodeSEpSet(&decoder, &pRsp->epSet) < 0) return -1;
   if (tDecodeI32(&decoder, &pRsp->svrTimestamp) < 0) return -1;

source/dnode/mnode/impl/inc/mndInfoSchema.h

@@ -24,7 +24,8 @@ extern "C" {
 
 int32_t mndInitInfos(SMnode *pMnode);
 void    mndCleanupInfos(SMnode *pMnode);
-int32_t mndBuildInsTableSchema(SMnode *pMnode, const char *dbFName, const char *tbName, STableMetaRsp *pRsp);
+int32_t mndBuildInsTableSchema(SMnode *pMnode, const char *dbFName, const char *tbName, bool sysinfo,
+                               STableMetaRsp *pRsp);
 int32_t mndBuildInsTableCfg(SMnode *pMnode, const char *dbFName, const char *tbName, STableCfgRsp *pRsp);
 
 #ifdef __cplusplus

source/dnode/mnode/impl/src/mndDb.c

@@ -1731,7 +1731,7 @@ static int32_t mndRetrieveDbs(SRpcMsg *pReq, SShowObj *pShow, SSDataBlock *pBloc
     SDbObj infoschemaDb = {0};
     setInformationSchemaDbCfg(&infoschemaDb);
     size_t numOfTables = 0;
-    getInfosDbMeta(NULL, &numOfTables);
+    getVisibleInfosTablesNum(sysinfo, &numOfTables);
     mndDumpDbInfoData(pMnode, pBlock, &infoschemaDb, pShow, numOfRows, numOfTables, true, 0, 1);
 
     numOfRows += 1;

source/dnode/mnode/impl/src/mndInfoSchema.c

@@ -14,8 +14,8 @@
  */
 
 #define _DEFAULT_SOURCE
-#include "systable.h"
 #include "mndInt.h"
+#include "systable.h"
 
 static int32_t mndInitInfosTableSchema(const SSysDbTableSchema *pSrc, int32_t colNum, SSchema **pDst) {
   SSchema *schema = taosMemoryCalloc(colNum, sizeof(SSchema));
@@ -29,6 +29,9 @@ static int32_t mndInitInfosTableSchema(const SSysDbTableSchema *pSrc, int32_t co
     schema[i].type = pSrc[i].type;
     schema[i].colId = i + 1;
     schema[i].bytes = pSrc[i].bytes;
+    if (pSrc[i].sysInfo) {
+      schema[i].flags |= COL_IS_SYSINFO;
+    }
   }
 
   *pDst = schema;
@@ -44,12 +47,13 @@ static int32_t mndInsInitMeta(SHashObj *hash) {
   meta.tversion = 1;
 
   size_t               size = 0;
-  const SSysTableMeta* pInfosTableMeta = NULL;
+  const SSysTableMeta *pInfosTableMeta = NULL;
   getInfosDbMeta(&pInfosTableMeta, &size);
 
   for (int32_t i = 0; i < size; ++i) {
     tstrncpy(meta.tbName, pInfosTableMeta[i].name, sizeof(meta.tbName));
     meta.numOfColumns = pInfosTableMeta[i].colNum;
+    meta.sysInfo = pInfosTableMeta[i].sysInfo;
 
     if (mndInitInfosTableSchema(pInfosTableMeta[i].schema, pInfosTableMeta[i].colNum, &meta.pSchemas)) {
       return -1;
@@ -64,14 +68,15 @@ static int32_t mndInsInitMeta(SHashObj *hash) {
   return 0;
 }
 
-int32_t mndBuildInsTableSchema(SMnode *pMnode, const char *dbFName, const char *tbName, STableMetaRsp *pRsp) {
+int32_t mndBuildInsTableSchema(SMnode *pMnode, const char *dbFName, const char *tbName, bool sysinfo,
+                               STableMetaRsp *pRsp) {
   if (NULL == pMnode->infosMeta) {
     terrno = TSDB_CODE_APP_NOT_READY;
     return -1;
   }
 
   STableMetaRsp *pMeta = taosHashGet(pMnode->infosMeta, tbName, strlen(tbName));
-  if (NULL == pMeta) {
+  if (NULL == pMeta || (!sysinfo && pMeta->sysInfo)) {
     mError("invalid information schema table name:%s", tbName);
     terrno = TSDB_CODE_MND_INVALID_SYS_TABLENAME;
     return -1;
@@ -121,7 +126,6 @@ int32_t mndBuildInsTableCfg(SMnode *pMnode, const char *dbFName, const char *tbN
   return 0;
 }
 
-
 int32_t mndInitInfos(SMnode *pMnode) {
   pMnode->infosMeta = taosHashInit(20, taosGetDefaultHashFunction(TSDB_DATA_TYPE_VARCHAR), false, HASH_NO_LOCK);
   if (pMnode->infosMeta == NULL) {

source/dnode/mnode/impl/src/mndProfile.c

@@ -270,6 +270,7 @@ static int32_t mndProcessConnectReq(SRpcMsg *pReq) {
   SConnectRsp connectRsp = {0};
   connectRsp.acctId = pUser->acctId;
   connectRsp.superUser = pUser->superUser;
+  connectRsp.sysInfo = pUser->sysInfo;
   connectRsp.clusterId = pMnode->clusterId;
   connectRsp.connId = pConn->id;
   connectRsp.connType = connReq.connType;

source/dnode/mnode/impl/src/mndStb.c

@@ -2157,6 +2157,10 @@ static int32_t mndProcessTableMetaReq(SRpcMsg *pReq) {
   STableInfoReq infoReq = {0};
   STableMetaRsp metaRsp = {0};
 
+  SUserObj *pUser = mndAcquireUser(pMnode, pReq->info.conn.user);
+  if (pUser == NULL) return 0;
+  bool sysinfo = pUser->sysInfo;
+
   if (tDeserializeSTableInfoReq(pReq->pCont, pReq->contLen, &infoReq) != 0) {
     terrno = TSDB_CODE_INVALID_MSG;
     goto _OVER;
@@ -2164,7 +2168,7 @@ static int32_t mndProcessTableMetaReq(SRpcMsg *pReq) {
 
   if (0 == strcmp(infoReq.dbFName, TSDB_INFORMATION_SCHEMA_DB)) {
     mDebug("information_schema table:%s.%s, start to retrieve meta", infoReq.dbFName, infoReq.tbName);
-    if (mndBuildInsTableSchema(pMnode, infoReq.dbFName, infoReq.tbName, &metaRsp) != 0) {
+    if (mndBuildInsTableSchema(pMnode, infoReq.dbFName, infoReq.tbName, sysinfo, &metaRsp) != 0) {
       goto _OVER;
     }
   } else if (0 == strcmp(infoReq.dbFName, TSDB_PERFORMANCE_SCHEMA_DB)) {
@@ -2203,6 +2207,7 @@ _OVER:
     mError("stb:%s.%s, failed to retrieve meta since %s", infoReq.dbFName, infoReq.tbName, terrstr());
   }
 
+  mndReleaseUser(pMnode, pUser);
   tFreeSTableMetaRsp(&metaRsp);
   return code;
 }

source/libs/command/src/command.c

@@ -17,6 +17,7 @@
 #include "catalog.h"
 #include "commandInt.h"
 #include "scheduler.h"
+#include "systable.h"
 #include "tdatablock.h"
 #include "tglobal.h"
 #include "tgrant.h"
@@ -75,46 +76,41 @@ static SSDataBlock* buildDescResultDataBlock() {
   return pBlock;
 }
 
-static void setDescResultIntoDataBlock(SSDataBlock* pBlock, int32_t numOfRows, STableMeta* pMeta) {
+static void setDescResultIntoDataBlock(bool sysInfoUser, SSDataBlock* pBlock, int32_t numOfRows, STableMeta* pMeta) {
   blockDataEnsureCapacity(pBlock, numOfRows);
-  pBlock->info.rows = numOfRows;
+  pBlock->info.rows = 0;
 
   // field
   SColumnInfoData* pCol1 = taosArrayGet(pBlock->pDataBlock, 0);
-  char             buf[DESCRIBE_RESULT_FIELD_LEN] = {0};
-  for (int32_t i = 0; i < numOfRows; ++i) {
-    STR_TO_VARSTR(buf, pMeta->schema[i].name);
-    colDataAppend(pCol1, i, buf, false);
-  }
-
   // Type
   SColumnInfoData* pCol2 = taosArrayGet(pBlock->pDataBlock, 1);
-  for (int32_t i = 0; i < numOfRows; ++i) {
-    STR_TO_VARSTR(buf, tDataTypes[pMeta->schema[i].type].name);
-    colDataAppend(pCol2, i, buf, false);
-  }
-
   // Length
   SColumnInfoData* pCol3 = taosArrayGet(pBlock->pDataBlock, 2);
-  for (int32_t i = 0; i < numOfRows; ++i) {
-    int32_t bytes = getSchemaBytes(pMeta->schema + i);
-    colDataAppend(pCol3, i, (const char*)&bytes, false);
-  }
-
   // Note
   SColumnInfoData* pCol4 = taosArrayGet(pBlock->pDataBlock, 3);
+  char             buf[DESCRIBE_RESULT_FIELD_LEN] = {0};
   for (int32_t i = 0; i < numOfRows; ++i) {
+    if (invisibleColumn(sysInfoUser, pMeta->tableType, pMeta->schema[i].flags)) {
+      continue;
+    }
+    STR_TO_VARSTR(buf, pMeta->schema[i].name);
+    colDataAppend(pCol1, pBlock->info.rows, buf, false);
+    STR_TO_VARSTR(buf, tDataTypes[pMeta->schema[i].type].name);
+    colDataAppend(pCol2, pBlock->info.rows, buf, false);
+    int32_t bytes = getSchemaBytes(pMeta->schema + i);
+    colDataAppend(pCol3, pBlock->info.rows, (const char*)&bytes, false);
     STR_TO_VARSTR(buf, i >= pMeta->tableInfo.numOfColumns ? "TAG" : "");
-    colDataAppend(pCol4, i, buf, false);
+    colDataAppend(pCol4, pBlock->info.rows, buf, false);
+    ++(pBlock->info.rows);
   }
 }
 
-static int32_t execDescribe(SNode* pStmt, SRetrieveTableRsp** pRsp) {
+static int32_t execDescribe(bool sysInfoUser, SNode* pStmt, SRetrieveTableRsp** pRsp) {
   SDescribeStmt* pDesc = (SDescribeStmt*)pStmt;
   int32_t        numOfRows = TABLE_TOTAL_COL_NUM(pDesc->pMeta);
 
   SSDataBlock* pBlock = buildDescResultDataBlock();
-  setDescResultIntoDataBlock(pBlock, numOfRows, pDesc->pMeta);
+  setDescResultIntoDataBlock(sysInfoUser, pBlock, numOfRows, pDesc->pMeta);
 
   return buildRetrieveTableRsp(pBlock, DESCRIBE_RESULT_COLS, pRsp);
 }
@@ -665,10 +661,10 @@ static int32_t execSelectWithoutFrom(SSelectStmt* pSelect, SRetrieveTableRsp** p
   return code;
 }
 
-int32_t qExecCommand(SNode* pStmt, SRetrieveTableRsp** pRsp) {
+int32_t qExecCommand(bool sysInfoUser, SNode* pStmt, SRetrieveTableRsp** pRsp) {
   switch (nodeType(pStmt)) {
     case QUERY_NODE_DESCRIBE_STMT:
-      return execDescribe(pStmt, pRsp);
+      return execDescribe(sysInfoUser, pStmt, pRsp);
     case QUERY_NODE_RESET_QUERY_CACHE_STMT:
       return execResetQueryCache();
     case QUERY_NODE_SHOW_CREATE_DATABASE_STMT:

source/libs/executor/inc/executorimpl.h

@@ -497,6 +497,7 @@ typedef struct SSysTableScanInfo {
   SReadHandle            readHandle;
   int32_t                accountId;
   const char*            pUser;
+  bool                   sysInfo;
   bool                   showRewrite;
   SNode*                 pCondition;  // db_name filter condition, to discard data that are not in current database
   SMTbCursor*            pCur;        // cursor for iterate the local table meta store.

source/libs/executor/src/scanoperator.c

@@ -36,8 +36,8 @@
 #define SWITCH_ORDER(n)              (((n) = ((n) == TSDB_ORDER_ASC) ? TSDB_ORDER_DESC : TSDB_ORDER_ASC))
 
 static int32_t buildSysDbTableInfo(const SSysTableScanInfo* pInfo, int32_t capacity);
-static int32_t buildDbTableInfoBlock(const SSDataBlock* p, const SSysTableMeta* pSysDbTableMeta, size_t size,
-                                     const char* dbName);
+static int32_t buildDbTableInfoBlock(bool sysInfo, const SSDataBlock* p, const SSysTableMeta* pSysDbTableMeta,
+                                     size_t size, const char* dbName);
 
 static bool processBlockWithProbability(const SSampleExecInfo* pInfo);
 
@@ -2428,10 +2428,10 @@ int32_t buildSysDbTableInfo(const SSysTableScanInfo* pInfo, int32_t capacity) {
   const SSysTableMeta* pSysDbTableMeta = NULL;
 
   getInfosDbMeta(&pSysDbTableMeta, &size);
-  p->info.rows = buildDbTableInfoBlock(p, pSysDbTableMeta, size, TSDB_INFORMATION_SCHEMA_DB);
+  p->info.rows = buildDbTableInfoBlock(pInfo->sysInfo, p, pSysDbTableMeta, size, TSDB_INFORMATION_SCHEMA_DB);
 
   getPerfDbMeta(&pSysDbTableMeta, &size);
-  p->info.rows = buildDbTableInfoBlock(p, pSysDbTableMeta, size, TSDB_PERFORMANCE_SCHEMA_DB);
+  p->info.rows = buildDbTableInfoBlock(pInfo->sysInfo, p, pSysDbTableMeta, size, TSDB_PERFORMANCE_SCHEMA_DB);
 
   pInfo->pRes->info.rows = p->info.rows;
   relocateColumnData(pInfo->pRes, pInfo->scanCols, p->pDataBlock, false);
@@ -2440,13 +2440,16 @@ int32_t buildSysDbTableInfo(const SSysTableScanInfo* pInfo, int32_t capacity) {
   return pInfo->pRes->info.rows;
 }
 
-int32_t buildDbTableInfoBlock(const SSDataBlock* p, const SSysTableMeta* pSysDbTableMeta, size_t size,
+int32_t buildDbTableInfoBlock(bool sysInfo, const SSDataBlock* p, const SSysTableMeta* pSysDbTableMeta, size_t size,
                               const char* dbName) {
   char    n[TSDB_TABLE_FNAME_LEN + VARSTR_HEADER_SIZE] = {0};
   int32_t numOfRows = p->info.rows;
 
   for (int32_t i = 0; i < size; ++i) {
     const SSysTableMeta* pm = &pSysDbTableMeta[i];
+    if (!sysInfo && pm->sysInfo) {
+      continue;
+    }
 
     SColumnInfoData* pColInfoData = taosArrayGet(p->pDataBlock, 0);
 
@@ -2500,6 +2503,7 @@ SOperatorInfo* createSysTableScanOperatorInfo(void* readHandle, SSystemTableScan
 
   pInfo->accountId = pScanPhyNode->accountId;
   pInfo->pUser = taosMemoryStrDup((void*)pUser);
+  pInfo->sysInfo = pScanPhyNode->sysInfo;
   pInfo->showRewrite = pScanPhyNode->showRewrite;
   pInfo->pRes = pResBlock;
   pInfo->pCondition = pScanNode->node.pConditions;

source/libs/nodes/src/nodesCloneFuncs.c

@@ -545,6 +545,7 @@ static int32_t physiSysTableScanCopy(const SSystemTableScanPhysiNode* pSrc, SSys
   COPY_OBJECT_FIELD(mgmtEpSet, sizeof(SEpSet));
   COPY_SCALAR_FIELD(showRewrite);
   COPY_SCALAR_FIELD(accountId);
+  COPY_SCALAR_FIELD(sysInfo);
   return TSDB_CODE_SUCCESS;
 }
 

source/libs/nodes/src/nodesCodeFuncs.c

@@ -1654,6 +1654,7 @@ static int32_t jsonToPhysiTableScanNode(const SJson* pJson, void* pObj) {
 static const char* jkSysTableScanPhysiPlanMnodeEpSet = "MnodeEpSet";
 static const char* jkSysTableScanPhysiPlanShowRewrite = "ShowRewrite";
 static const char* jkSysTableScanPhysiPlanAccountId = "AccountId";
+static const char* jkSysTableScanPhysiPlanSysInfo = "SysInfo";
 
 static int32_t physiSysTableScanNodeToJson(const void* pObj, SJson* pJson) {
   const SSystemTableScanPhysiNode* pNode = (const SSystemTableScanPhysiNode*)pObj;
@@ -1668,6 +1669,9 @@ static int32_t physiSysTableScanNodeToJson(const void* pObj, SJson* pJson) {
   if (TSDB_CODE_SUCCESS == code) {
     code = tjsonAddIntegerToObject(pJson, jkSysTableScanPhysiPlanAccountId, pNode->accountId);
   }
+  if (TSDB_CODE_SUCCESS == code) {
+    code = tjsonAddBoolToObject(pJson, jkSysTableScanPhysiPlanSysInfo, pNode->sysInfo);
+  }
 
   return code;
 }
@@ -1684,7 +1688,9 @@ static int32_t jsonToPhysiSysTableScanNode(const SJson* pJson, void* pObj) {
   }
   if (TSDB_CODE_SUCCESS == code) {
     tjsonGetNumberValue(pJson, jkSysTableScanPhysiPlanAccountId, pNode->accountId, code);
-    ;
+  }
+  if (TSDB_CODE_SUCCESS == code) {
+    code = tjsonGetBoolValue(pJson, jkSysTableScanPhysiPlanSysInfo, &pNode->sysInfo);
   }
 
   return code;

source/libs/parser/src/parAuthenticator.c

@@ -108,6 +108,21 @@ static int32_t authQuery(SAuthCxt* pCxt, SNode* pStmt) {
       return authDelete(pCxt, (SDeleteStmt*)pStmt);
     case QUERY_NODE_INSERT_STMT:
       return authInsert(pCxt, (SInsertStmt*)pStmt);
+    case QUERY_NODE_SHOW_DNODES_STMT:
+    case QUERY_NODE_SHOW_MNODES_STMT:
+    case QUERY_NODE_SHOW_MODULES_STMT:
+    case QUERY_NODE_SHOW_QNODES_STMT:
+    case QUERY_NODE_SHOW_SNODES_STMT:
+    case QUERY_NODE_SHOW_BNODES_STMT:
+    case QUERY_NODE_SHOW_CLUSTER_STMT:
+    case QUERY_NODE_SHOW_LICENCES_STMT:
+    case QUERY_NODE_SHOW_VGROUPS_STMT:
+    case QUERY_NODE_SHOW_VARIABLES_STMT:
+    case QUERY_NODE_SHOW_TRANSACTIONS_STMT:
+    case QUERY_NODE_SHOW_TABLE_DISTRIBUTED_STMT:
+    case QUERY_NODE_SHOW_VNODES_STMT:
+    case QUERY_NODE_SHOW_SCORES_STMT:
+      return !pCxt->pParseCxt->enableSysInfo ? TSDB_CODE_PAR_PERMISSION_DENIED : TSDB_CODE_SUCCESS;
     default:
       break;
   }

source/libs/parser/src/parTranslater.c

@@ -784,6 +784,9 @@ static int32_t createColumnsByTable(STranslateContext* pCxt, const STableNode* p
     int32_t           nums = pMeta->tableInfo.numOfColumns +
                    (igTags ? 0 : ((TSDB_SUPER_TABLE == pMeta->tableType) ? pMeta->tableInfo.numOfTags : 0));
     for (int32_t i = 0; i < nums; ++i) {
+      if (invisibleColumn(pCxt->pParseCxt->enableSysInfo, pMeta->tableType, pMeta->schema[i].flags)) {
+        continue;
+      }
       SColumnNode* pCol = (SColumnNode*)nodesMakeNode(QUERY_NODE_COLUMN);
       if (NULL == pCol) {
         return generateSyntaxErrMsg(&pCxt->msgBuf, TSDB_CODE_OUT_OF_MEMORY);
@@ -826,7 +829,8 @@ static int32_t findAndSetColumn(STranslateContext* pCxt, SColumnNode** pColRef,
     }
     int32_t nums = pMeta->tableInfo.numOfTags + pMeta->tableInfo.numOfColumns;
     for (int32_t i = 0; i < nums; ++i) {
-      if (0 == strcmp(pCol->colName, pMeta->schema[i].name)) {
+      if (0 == strcmp(pCol->colName, pMeta->schema[i].name) &&
+          !invisibleColumn(pCxt->pParseCxt->enableSysInfo, pMeta->tableType, pMeta->schema[i].flags)) {
         setColumnInfoBySchema((SRealTableNode*)pTable, pMeta->schema + i, (i - pMeta->tableInfo.numOfColumns), pCol);
         *pFound = true;
         break;
@@ -2192,14 +2196,14 @@ static int32_t translateTable(STranslateContext* pCxt, SNode* pTable) {
           code = setTableCacheLastMode(pCxt, &name, pRealTable);
         }
       }
+      if (TSDB_CODE_SUCCESS == code) {
         pRealTable->table.precision = pRealTable->pMeta->tableInfo.precision;
         pRealTable->table.singleTable = isSingleTable(pRealTable);
-      if (TSDB_CODE_SUCCESS == code) {
-        code = addNamespace(pCxt, pRealTable);
-      }
         if (TSDB_SUPER_TABLE == pRealTable->pMeta->tableType) {
           pCxt->stableQuery = true;
         }
+        code = addNamespace(pCxt, pRealTable);
+      }
       break;
     }
     case QUERY_NODE_TEMP_TABLE: {
@@ -2594,8 +2598,7 @@ static int32_t getQueryTimeRange(STranslateContext* pCxt, SNode* pWhere, STimeWi
   return code;
 }
 
-static int32_t checkFill(STranslateContext* pCxt, SFillNode* pFill, SValueNode* pInterval,
-                         bool isInterpFill) {
+static int32_t checkFill(STranslateContext* pCxt, SFillNode* pFill, SValueNode* pInterval, bool isInterpFill) {
   if (FILL_MODE_NONE == pFill->mode) {
     if (isInterpFill) {
       return generateSyntaxErrMsgExt(&pCxt->msgBuf, TSDB_CODE_PAR_WRONG_VALUE_TYPE, "Unsupported fill type");

source/libs/parser/test/parTestUtil.cpp

@@ -207,6 +207,7 @@ class ParserTestBaseImpl {
     pCxt->db = caseEnv_.db_.c_str();
     pCxt->pUser = caseEnv_.user_.c_str();
     pCxt->isSuperUser = caseEnv_.user_ == "root";
+    pCxt->enableSysInfo = true;
     pCxt->pSql = stmtEnv_.sql_.c_str();
     pCxt->sqlLen = stmtEnv_.sql_.length();
     pCxt->pMsg = stmtEnv_.msgBuf_.data();

source/libs/planner/src/planPhysiCreater.c

@@ -576,6 +576,7 @@ static int32_t createSystemTableScanPhysiNode(SPhysiPlanContext* pCxt, SSubplan*
 
   pScan->showRewrite = pScanLogicNode->showRewrite;
   pScan->accountId = pCxt->pPlanCxt->acctId;
+  pScan->sysInfo = pCxt->pPlanCxt->sysInfo;
   if (0 == strcmp(pScanLogicNode->tableName.tname, TSDB_INS_TABLE_TABLES) ||
       0 == strcmp(pScanLogicNode->tableName.tname, TSDB_INS_TABLE_TABLE_DISTRIBUTED) ||
       0 == strcmp(pScanLogicNode->tableName.tname, TSDB_INS_TABLE_TAGS)) {

source/libs/planner/test/planTestUtil.cpp

@@ -343,6 +343,7 @@ class PlannerTestBaseImpl {
     cxt.pMsg = stmtEnv_.msgBuf_.data();
     cxt.msgLen = stmtEnv_.msgBuf_.max_size();
     cxt.svrVer = "3.0.0.0";
+    cxt.enableSysInfo = true;
     if (prepare) {
       SStmtCallback stmtCb = {0};
       cxt.pStmtCb = &stmtCb;

tests/script/tsim/user/privilege_sysinfo.sim

@@ -51,13 +51,13 @@ sql select * from information_schema.ins_tables where db_name = 'db'
 print =============== check show
 sql select * from information_schema.ins_users
 sql_error show cluster
-sql select * from information_schema.ins_dnodes
-sql select * from information_schema.ins_mnodes
+sql_error select * from information_schema.ins_dnodes
+sql_error select * from information_schema.ins_mnodes
 sql_error show snodes
-sql select * from information_schema.ins_qnodes
+sql_error select * from information_schema.ins_qnodes
 sql_error show bnodes
 sql_error show grants
 sql_error show dnode 1 variables;
-sql show variables;
+sql_error show variables;
 
 system sh/exec.sh -n dnode1 -s stop -x SIGINT