Add database right for dictionaries

dbms/src/Common/ErrorCodes.cpp

@@ -452,6 +452,7 @@ namespace ErrorCodes
     extern const int INVALID_WITH_FILL_EXPRESSION = 475;
     extern const int WITH_TIES_WITHOUT_ORDER_BY = 476;
     extern const int INVALID_USAGE_OF_INPUT = 477;
+    extern const int DICTIONARY_ACCESS_DENIED = 478;
 
     extern const int KEEPER_EXCEPTION = 999;
     extern const int POCO_EXCEPTION = 1000;

dbms/src/Dictionaries/CacheDictionary.cpp

@@ -62,11 +62,13 @@ inline size_t CacheDictionary::getCellIdx(const Key id) const
 
 CacheDictionary::CacheDictionary(
     const std::string & name_,
+    const std::unordered_set<std::string> & allowed_databases_,
     const DictionaryStructure & dict_struct_,
     DictionarySourcePtr source_ptr_,
     const DictionaryLifetime dict_lifetime_,
     const size_t size_)
     : name{name_}
+    , allowed_databases{allowed_databases_}
     , dict_struct(dict_struct_)
     , source_ptr{std::move(source_ptr_)}
     , dict_lifetime(dict_lifetime_)
@@ -585,6 +587,7 @@ std::exception_ptr CacheDictionary::getLastException() const
 void registerDictionaryCache(DictionaryFactory & factory)
 {
     auto create_layout = [=](const std::string & name,
+                             const std::unordered_set<std::string> & allowed_databases,
                              const DictionaryStructure & dict_struct,
                              const Poco::Util::AbstractConfiguration & config,
                              const std::string & config_prefix,
@@ -609,7 +612,7 @@ void registerDictionaryCache(DictionaryFactory & factory)
                             ErrorCodes::BAD_ARGUMENTS};
 
         const DictionaryLifetime dict_lifetime{config, config_prefix + ".lifetime"};
-        return std::make_unique<CacheDictionary>(name, dict_struct, std::move(source_ptr), dict_lifetime, size);
+        return std::make_unique<CacheDictionary>(name, allowed_databases, dict_struct, std::move(source_ptr), dict_lifetime, size);
     };
     factory.registerLayout("cache", create_layout);
 }

dbms/src/Dictionaries/CacheDictionary.h

@@ -26,6 +26,7 @@ class CacheDictionary final : public IDictionary
 public:
     CacheDictionary(
         const std::string & name_,
+        const std::unordered_set<std::string> & allowed_databases_,
         const DictionaryStructure & dict_struct_,
         DictionarySourcePtr source_ptr_,
         const DictionaryLifetime dict_lifetime_,
@@ -33,6 +34,8 @@ public:
 
     std::string getName() const override { return name; }
 
+    const std::unordered_set<std::string> & getAllowedDatabases() const override { return allowed_databases; }
+
     std::string getTypeName() const override { return "Cache"; }
 
     size_t getBytesAllocated() const override { return bytes_allocated + (string_arena ? string_arena->size() : 0); }
@@ -52,7 +55,7 @@ public:
 
     std::shared_ptr<const IExternalLoadable> clone() const override
     {
-        return std::make_shared<CacheDictionary>(name, dict_struct, source_ptr->clone(), dict_lifetime, size);
+        return std::make_shared<CacheDictionary>(name, allowed_databases, dict_struct, source_ptr->clone(), dict_lifetime, size);
     }
 
     const IDictionarySource * getSource() const override { return source_ptr.get(); }
@@ -255,6 +258,7 @@ private:
     void isInImpl(const PaddedPODArray<Key> & child_ids, const AncestorType & ancestor_ids, PaddedPODArray<UInt8> & out) const;
 
     const std::string name;
+    const std::unordered_set<std::string> allowed_databases;
     const DictionaryStructure dict_struct;
     mutable DictionarySourcePtr source_ptr;
     const DictionaryLifetime dict_lifetime;

dbms/src/Dictionaries/ComplexKeyCacheDictionary.cpp

@@ -52,11 +52,13 @@ inline UInt64 ComplexKeyCacheDictionary::getCellIdx(const StringRef key) const
 
 ComplexKeyCacheDictionary::ComplexKeyCacheDictionary(
     const std::string & name_,
+    const std::unordered_set<std::string> & allowed_databases_,
     const DictionaryStructure & dict_struct_,
     DictionarySourcePtr source_ptr_,
     const DictionaryLifetime dict_lifetime_,
     const size_t size_)
     : name{name_}
+    , allowed_databases{allowed_databases_}
     , dict_struct(dict_struct_)
     , source_ptr{std::move(source_ptr_)}
     , dict_lifetime(dict_lifetime_)
@@ -395,6 +397,7 @@ BlockInputStreamPtr ComplexKeyCacheDictionary::getBlockInputStream(const Names &
 void registerDictionaryComplexKeyCache(DictionaryFactory & factory)
 {
     auto create_layout = [=](const std::string & name,
+                             const std::unordered_set<std::string> & allowed_databases,
                              const DictionaryStructure & dict_struct,
                              const Poco::Util::AbstractConfiguration & config,
                              const std::string & config_prefix,
@@ -413,7 +416,7 @@ void registerDictionaryComplexKeyCache(DictionaryFactory & factory)
                             ErrorCodes::BAD_ARGUMENTS};
 
         const DictionaryLifetime dict_lifetime{config, config_prefix + ".lifetime"};
-        return std::make_unique<ComplexKeyCacheDictionary>(name, dict_struct, std::move(source_ptr), dict_lifetime, size);
+        return std::make_unique<ComplexKeyCacheDictionary>(name, allowed_databases, dict_struct, std::move(source_ptr), dict_lifetime, size);
     };
     factory.registerLayout("complex_key_cache", create_layout);
 }

dbms/src/Dictionaries/ComplexKeyCacheDictionary.h

@@ -43,6 +43,7 @@ class ComplexKeyCacheDictionary final : public IDictionaryBase
 public:
     ComplexKeyCacheDictionary(
         const std::string & name_,
+        const std::unordered_set<std::string> & allowed_databases_,
         const DictionaryStructure & dict_struct_,
         DictionarySourcePtr source_ptr_,
         const DictionaryLifetime dict_lifetime_,
@@ -52,6 +53,8 @@ public:
 
     std::string getName() const override { return name; }
 
+    const std::unordered_set<std::string> & getAllowedDatabases() const override { return allowed_databases; }
+
     std::string getTypeName() const override { return "ComplexKeyCache"; }
 
     size_t getBytesAllocated() const override
@@ -75,7 +78,7 @@ public:
 
     std::shared_ptr<const IExternalLoadable> clone() const override
     {
-        return std::make_shared<ComplexKeyCacheDictionary>(name, dict_struct, source_ptr->clone(), dict_lifetime, size);
+        return std::make_shared<ComplexKeyCacheDictionary>(name, allowed_databases, dict_struct, source_ptr->clone(), dict_lifetime, size);
     }
 
     const IDictionarySource * getSource() const override { return source_ptr.get(); }
@@ -669,6 +672,7 @@ private:
     bool isEmptyCell(const UInt64 idx) const;
 
     const std::string name;
+    const std::unordered_set<std::string> allowed_databases;
     const DictionaryStructure dict_struct;
     const DictionarySourcePtr source_ptr;
     const DictionaryLifetime dict_lifetime;

dbms/src/Dictionaries/ComplexKeyHashedDictionary.cpp

@@ -16,12 +16,14 @@ namespace ErrorCodes
 
 ComplexKeyHashedDictionary::ComplexKeyHashedDictionary(
     const std::string & name_,
+    const std::unordered_set<std::string> & allowed_databases_,
     const DictionaryStructure & dict_struct_,
     DictionarySourcePtr source_ptr_,
     const DictionaryLifetime dict_lifetime_,
     bool require_nonempty_,
     BlockPtr saved_block_)
     : name{name_}
+    , allowed_databases{allowed_databases_}
     , dict_struct(dict_struct_)
     , source_ptr{std::move(source_ptr_)}
     , dict_lifetime(dict_lifetime_)
@@ -743,6 +745,7 @@ BlockInputStreamPtr ComplexKeyHashedDictionary::getBlockInputStream(const Names
 void registerDictionaryComplexKeyHashed(DictionaryFactory & factory)
 {
     auto create_layout = [=](const std::string & name,
+                             const std::unordered_set<std::string> & allowed_databases,
                              const DictionaryStructure & dict_struct,
                              const Poco::Util::AbstractConfiguration & config,
                              const std::string & config_prefix,
@@ -753,7 +756,7 @@ void registerDictionaryComplexKeyHashed(DictionaryFactory & factory)
 
         const DictionaryLifetime dict_lifetime{config, config_prefix + ".lifetime"};
         const bool require_nonempty = config.getBool(config_prefix + ".require_nonempty", false);
-        return std::make_unique<ComplexKeyHashedDictionary>(name, dict_struct, std::move(source_ptr), dict_lifetime, require_nonempty);
+        return std::make_unique<ComplexKeyHashedDictionary>(name, allowed_databases, dict_struct, std::move(source_ptr), dict_lifetime, require_nonempty);
     };
     factory.registerLayout("complex_key_hashed", create_layout);
 }

dbms/src/Dictionaries/ComplexKeyHashedDictionary.h

@@ -24,6 +24,7 @@ class ComplexKeyHashedDictionary final : public IDictionaryBase
 public:
     ComplexKeyHashedDictionary(
         const std::string & name_,
+        const std::unordered_set<std::string> & allowed_databases_,
         const DictionaryStructure & dict_struct_,
         DictionarySourcePtr source_ptr_,
         const DictionaryLifetime dict_lifetime_,
@@ -34,6 +35,8 @@ public:
 
     std::string getName() const override { return name; }
 
+    const std::unordered_set<std::string> & getAllowedDatabases() const override { return allowed_databases; }
+
     std::string getTypeName() const override { return "ComplexKeyHashed"; }
 
     size_t getBytesAllocated() const override { return bytes_allocated; }
@@ -50,7 +53,7 @@ public:
 
     std::shared_ptr<const IExternalLoadable> clone() const override
     {
-        return std::make_shared<ComplexKeyHashedDictionary>(name, dict_struct, source_ptr->clone(), dict_lifetime, require_nonempty, saved_block);
+        return std::make_shared<ComplexKeyHashedDictionary>(name, allowed_databases, dict_struct, source_ptr->clone(), dict_lifetime, require_nonempty, saved_block);
     }
 
     const IDictionarySource * getSource() const override { return source_ptr.get(); }
@@ -236,6 +239,7 @@ private:
     std::vector<StringRef> getKeys(const Attribute & attribute) const;
 
     const std::string name;
+    const std::unordered_set<std::string> allowed_databases;
     const DictionaryStructure dict_struct;
     const DictionarySourcePtr source_ptr;
     const DictionaryLifetime dict_lifetime;

dbms/src/Dictionaries/DictionaryFactory.cpp

@@ -33,14 +33,31 @@ DictionaryPtr DictionaryFactory::create(
 
     auto source_ptr = DictionarySourceFactory::instance().create(name, config, config_prefix + ".source", dict_struct, context);
 
-    const auto & layout_type = keys.front();
+    /// Fill list of allowed databases.
+    std::unordered_set<std::string> allowed_databases;
+
+    const auto config_sub_elem = config_prefix + ".allow_databases";
+    if (config.has(config_sub_elem))
+    {
+        Poco::Util::AbstractConfiguration::Keys config_keys;
+        config.keys(config_sub_elem, config_keys);
 
+        allowed_databases.reserve(config_keys.size());
+        for (const auto & key : config_keys)
+        {
+            const auto database_name = config.getString(config_sub_elem + "." + key);
+            allowed_databases.insert(database_name);
+        }
+    }
+
+
+    const auto & layout_type = keys.front();
     {
         const auto found = registered_layouts.find(layout_type);
         if (found != registered_layouts.end())
         {
             const auto & create_layout = found->second;
-            return create_layout(name, dict_struct, config, config_prefix, std::move(source_ptr));
+            return create_layout(name, allowed_databases, dict_struct, config, config_prefix, std::move(source_ptr));
         }
     }
 

dbms/src/Dictionaries/DictionaryFactory.h

@@ -31,6 +31,7 @@ public:
 
     using Creator = std::function<DictionaryPtr(
         const std::string & name,
+        const std::unordered_set<std::string> & allowed_databases,
         const DictionaryStructure & dict_struct,
         const Poco::Util::AbstractConfiguration & config,
         const std::string & config_prefix,

dbms/src/Dictionaries/FlatDictionary.cpp

@@ -22,12 +22,14 @@ static const auto max_array_size = 500000;
 
 FlatDictionary::FlatDictionary(
     const std::string & name_,
+    const std::unordered_set<std::string> & allowed_databases_,
     const DictionaryStructure & dict_struct_,
     DictionarySourcePtr source_ptr_,
     const DictionaryLifetime dict_lifetime_,
     bool require_nonempty_,
     BlockPtr saved_block_)
     : name{name_}
+    , allowed_databases{allowed_databases_}
     , dict_struct(dict_struct_)
     , source_ptr{std::move(source_ptr_)}
     , dict_lifetime(dict_lifetime_)
@@ -707,6 +709,7 @@ BlockInputStreamPtr FlatDictionary::getBlockInputStream(const Names & column_nam
 void registerDictionaryFlat(DictionaryFactory & factory)
 {
     auto create_layout = [=](const std::string & name,
+                             const std::unordered_set<std::string> & allowed_databases,
                              const DictionaryStructure & dict_struct,
                              const Poco::Util::AbstractConfiguration & config,
                              const std::string & config_prefix,
@@ -722,7 +725,7 @@ void registerDictionaryFlat(DictionaryFactory & factory)
                             ErrorCodes::BAD_ARGUMENTS};
         const DictionaryLifetime dict_lifetime{config, config_prefix + ".lifetime"};
         const bool require_nonempty = config.getBool(config_prefix + ".require_nonempty", false);
-        return std::make_unique<FlatDictionary>(name, dict_struct, std::move(source_ptr), dict_lifetime, require_nonempty);
+        return std::make_unique<FlatDictionary>(name, allowed_databases, dict_struct, std::move(source_ptr), dict_lifetime, require_nonempty);
     };
     factory.registerLayout("flat", create_layout);
 }

dbms/src/Dictionaries/FlatDictionary.h

@@ -23,6 +23,7 @@ class FlatDictionary final : public IDictionary
 public:
     FlatDictionary(
         const std::string & name_,
+        const std::unordered_set<std::string> & allowed_databases_,
         const DictionaryStructure & dict_struct_,
         DictionarySourcePtr source_ptr_,
         const DictionaryLifetime dict_lifetime_,
@@ -31,6 +32,8 @@ public:
 
     std::string getName() const override { return name; }
 
+    const std::unordered_set<std::string> & getAllowedDatabases() const override { return allowed_databases; }
+
     std::string getTypeName() const override { return "Flat"; }
 
     size_t getBytesAllocated() const override { return bytes_allocated; }
@@ -47,7 +50,7 @@ public:
 
     std::shared_ptr<const IExternalLoadable> clone() const override
     {
-        return std::make_shared<FlatDictionary>(name, dict_struct, source_ptr->clone(), dict_lifetime, require_nonempty, saved_block);
+        return std::make_shared<FlatDictionary>(name, allowed_databases, dict_struct, source_ptr->clone(), dict_lifetime, require_nonempty, saved_block);
     }
 
     const IDictionarySource * getSource() const override { return source_ptr.get(); }
@@ -225,6 +228,7 @@ private:
     PaddedPODArray<Key> getIds() const;
 
     const std::string name;
+    const std::unordered_set<std::string> allowed_databases;
     const DictionaryStructure dict_struct;
     const DictionarySourcePtr source_ptr;
     const DictionaryLifetime dict_lifetime;

dbms/src/Dictionaries/HashedDictionary.cpp

@@ -17,12 +17,14 @@ namespace ErrorCodes
 
 HashedDictionary::HashedDictionary(
     const std::string & name_,
+    const std::unordered_set<std::string> & allowed_databases_,
     const DictionaryStructure & dict_struct_,
     DictionarySourcePtr source_ptr_,
     const DictionaryLifetime dict_lifetime_,
     bool require_nonempty_,
     BlockPtr saved_block_)
     : name{name_}
+    , allowed_databases{allowed_databases_}
     , dict_struct(dict_struct_)
     , source_ptr{std::move(source_ptr_)}
     , dict_lifetime(dict_lifetime_)
@@ -699,6 +701,7 @@ BlockInputStreamPtr HashedDictionary::getBlockInputStream(const Names & column_n
 void registerDictionaryHashed(DictionaryFactory & factory)
 {
     auto create_layout = [=](const std::string & name,
+                             const std::unordered_set<std::string> & allowed_databases,
                              const DictionaryStructure & dict_struct,
                              const Poco::Util::AbstractConfiguration & config,
                              const std::string & config_prefix,
@@ -714,7 +717,7 @@ void registerDictionaryHashed(DictionaryFactory & factory)
                             ErrorCodes::BAD_ARGUMENTS};
         const DictionaryLifetime dict_lifetime{config, config_prefix + ".lifetime"};
         const bool require_nonempty = config.getBool(config_prefix + ".require_nonempty", false);
-        return std::make_unique<HashedDictionary>(name, dict_struct, std::move(source_ptr), dict_lifetime, require_nonempty);
+        return std::make_unique<HashedDictionary>(name, allowed_databases, dict_struct, std::move(source_ptr), dict_lifetime, require_nonempty);
     };
     factory.registerLayout("hashed", create_layout);
 }

dbms/src/Dictionaries/HashedDictionary.h

@@ -22,6 +22,7 @@ class HashedDictionary final : public IDictionary
 public:
     HashedDictionary(
         const std::string & name_,
+        const std::unordered_set<std::string> & allowed_databases_,
         const DictionaryStructure & dict_struct_,
         DictionarySourcePtr source_ptr_,
         const DictionaryLifetime dict_lifetime_,
@@ -30,6 +31,8 @@ public:
 
     std::string getName() const override { return name; }
 
+    const std::unordered_set<std::string> & getAllowedDatabases() const override { return allowed_databases; }
+
     std::string getTypeName() const override { return "Hashed"; }
 
     size_t getBytesAllocated() const override { return bytes_allocated; }
@@ -46,7 +49,7 @@ public:
 
     std::shared_ptr<const IExternalLoadable> clone() const override
     {
-        return std::make_shared<HashedDictionary>(name, dict_struct, source_ptr->clone(), dict_lifetime, require_nonempty, saved_block);
+        return std::make_shared<HashedDictionary>(name, allowed_databases, dict_struct, source_ptr->clone(), dict_lifetime, require_nonempty, saved_block);
     }
 
     const IDictionarySource * getSource() const override { return source_ptr.get(); }
@@ -230,6 +233,7 @@ private:
     void isInImpl(const ChildType & child_ids, const AncestorType & ancestor_ids, PaddedPODArray<UInt8> & out) const;
 
     const std::string name;
+    const std::unordered_set<std::string> allowed_databases;
     const DictionaryStructure dict_struct;
     const DictionarySourcePtr source_ptr;
     const DictionaryLifetime dict_lifetime;

dbms/src/Dictionaries/IDictionary.h

@@ -40,6 +40,8 @@ struct IDictionaryBase : public IExternalLoadable
 
     virtual bool isCached() const = 0;
 
+    virtual const std::unordered_set<std::string> & getAllowedDatabases() const = 0;
+
     virtual const IDictionarySource * getSource() const = 0;
 
     virtual const DictionaryStructure & getStructure() const = 0;
@@ -67,6 +69,13 @@ struct IDictionaryBase : public IExternalLoadable
     {
         return std::static_pointer_cast<const IDictionaryBase>(IExternalLoadable::shared_from_this());
     }
+
+    bool isAllowed(const std::string & database_name) const
+    {
+        auto allowed_databases = getAllowedDatabases();
+
+        return allowed_databases.size() == 0 || allowed_databases.find(database_name) != allowed_databases.end();
+    }
 };
 
 

dbms/src/Dictionaries/RangeHashedDictionary.cpp

@@ -69,11 +69,13 @@ bool operator<(const RangeHashedDictionary::Range & left, const RangeHashedDicti
 
 RangeHashedDictionary::RangeHashedDictionary(
     const std::string & dictionary_name_,
+    const std::unordered_set<std::string> & allowed_databases_,
     const DictionaryStructure & dict_struct_,
     DictionarySourcePtr source_ptr_,
     const DictionaryLifetime dict_lifetime_,
     bool require_nonempty_)
     : dictionary_name{dictionary_name_}
+    , allowed_databases{allowed_databases_}
     , dict_struct(dict_struct_)
     , source_ptr{std::move(source_ptr_)}
     , dict_lifetime(dict_lifetime_)
@@ -675,6 +677,7 @@ BlockInputStreamPtr RangeHashedDictionary::getBlockInputStream(const Names & col
 void registerDictionaryRangeHashed(DictionaryFactory & factory)
 {
     auto create_layout = [=](const std::string & name,
+                             const std::unordered_set<std::string> & allowed_databases,
                              const DictionaryStructure & dict_struct,
                              const Poco::Util::AbstractConfiguration & config,
                              const std::string & config_prefix,
@@ -689,7 +692,7 @@ void registerDictionaryRangeHashed(DictionaryFactory & factory)
 
         const DictionaryLifetime dict_lifetime{config, config_prefix + ".lifetime"};
         const bool require_nonempty = config.getBool(config_prefix + ".require_nonempty", false);
-        return std::make_unique<RangeHashedDictionary>(name, dict_struct, std::move(source_ptr), dict_lifetime, require_nonempty);
+        return std::make_unique<RangeHashedDictionary>(name, allowed_databases, dict_struct, std::move(source_ptr), dict_lifetime, require_nonempty);
     };
     factory.registerLayout("range_hashed", create_layout);
 }

dbms/src/Dictionaries/RangeHashedDictionary.h

@@ -19,6 +19,7 @@ class RangeHashedDictionary final : public IDictionaryBase
 public:
     RangeHashedDictionary(
         const std::string & dictionary_name_,
+        const std::unordered_set<std::string> & allowed_databases_,
         const DictionaryStructure & dict_struct_,
         DictionarySourcePtr source_ptr_,
         const DictionaryLifetime dict_lifetime_,
@@ -26,6 +27,8 @@ public:
 
     std::string getName() const override { return dictionary_name; }
 
+    const std::unordered_set<std::string> & getAllowedDatabases() const override { return allowed_databases; }
+
     std::string getTypeName() const override { return "RangeHashed"; }
 
     size_t getBytesAllocated() const override { return bytes_allocated; }
@@ -42,7 +45,7 @@ public:
 
     std::shared_ptr<const IExternalLoadable> clone() const override
     {
-        return std::make_shared<RangeHashedDictionary>(dictionary_name, dict_struct, source_ptr->clone(), dict_lifetime, require_nonempty);
+        return std::make_shared<RangeHashedDictionary>(dictionary_name, allowed_databases, dict_struct, source_ptr->clone(), dict_lifetime, require_nonempty);
     }
 
     const IDictionarySource * getSource() const override { return source_ptr.get(); }
@@ -211,6 +214,7 @@ private:
     friend struct RangeHashedDIctionaryCallGetBlockInputStreamImpl;
 
     const std::string dictionary_name;
+    const std::unordered_set<std::string> allowed_databases;
     const DictionaryStructure dict_struct;
     const DictionarySourcePtr source_ptr;
     const DictionaryLifetime dict_lifetime;

dbms/src/Dictionaries/TrieDictionary.cpp

@@ -36,11 +36,13 @@ namespace ErrorCodes
 
 TrieDictionary::TrieDictionary(
     const std::string & name_,
+    const std::unordered_set<std::string> & allowed_databases_,
     const DictionaryStructure & dict_struct_,
     DictionarySourcePtr source_ptr_,
     const DictionaryLifetime dict_lifetime_,
     bool require_nonempty_)
     : name{name_}
+    , allowed_databases{allowed_databases_}
     , dict_struct(dict_struct_)
     , source_ptr{std::move(source_ptr_)}
     , dict_lifetime(dict_lifetime_)
@@ -754,6 +756,7 @@ BlockInputStreamPtr TrieDictionary::getBlockInputStream(const Names & column_nam
 void registerDictionaryTrie(DictionaryFactory & factory)
 {
     auto create_layout = [=](const std::string & name,
+                             const std::unordered_set<std::string> & allowed_databases,
                              const DictionaryStructure & dict_struct,
                              const Poco::Util::AbstractConfiguration & config,
                              const std::string & config_prefix,
@@ -765,7 +768,7 @@ void registerDictionaryTrie(DictionaryFactory & factory)
         const DictionaryLifetime dict_lifetime{config, config_prefix + ".lifetime"};
         const bool require_nonempty = config.getBool(config_prefix + ".require_nonempty", false);
         // This is specialised trie for storing IPv4 and IPv6 prefixes.
-        return std::make_unique<TrieDictionary>(name, dict_struct, std::move(source_ptr), dict_lifetime, require_nonempty);
+        return std::make_unique<TrieDictionary>(name, allowed_databases, dict_struct, std::move(source_ptr), dict_lifetime, require_nonempty);
     };
     factory.registerLayout("ip_trie", create_layout);
 }

dbms/src/Dictionaries/TrieDictionary.h

@@ -24,6 +24,7 @@ class TrieDictionary final : public IDictionaryBase
 public:
     TrieDictionary(
         const std::string & name_,
+        const std::unordered_set<std::string> & allowed_databases,
         const DictionaryStructure & dict_struct_,
         DictionarySourcePtr source_ptr_,
         const DictionaryLifetime dict_lifetime_,
@@ -35,6 +36,8 @@ public:
 
     std::string getName() const override { return name; }
 
+    const std::unordered_set<std::string> & getAllowedDatabases() const override { return allowed_databases; }
+
     std::string getTypeName() const override { return "Trie"; }
 
     size_t getBytesAllocated() const override { return bytes_allocated; }
@@ -51,7 +54,7 @@ public:
 
     std::shared_ptr<const IExternalLoadable> clone() const override
     {
-        return std::make_shared<TrieDictionary>(name, dict_struct, source_ptr->clone(), dict_lifetime, require_nonempty);
+        return std::make_shared<TrieDictionary>(name, allowed_databases, dict_struct, source_ptr->clone(), dict_lifetime, require_nonempty);
     }
 
     const IDictionarySource * getSource() const override { return source_ptr.get(); }
@@ -235,6 +238,7 @@ private:
     Columns getKeyColumns() const;
 
     const std::string name;
+    const std::unordered_set<std::string> allowed_databases;
     const DictionaryStructure dict_struct;
     const DictionarySourcePtr source_ptr;
     const DictionaryLifetime dict_lifetime;

dbms/src/Functions/FunctionsExternalDictionaries.h

@@ -48,6 +48,7 @@ namespace ErrorCodes
     extern const int TYPE_MISMATCH;
     extern const int ILLEGAL_COLUMN;
     extern const int BAD_ARGUMENTS;
+    extern const int DICTIONARY_ACCESS_DENIED;
 }
 
 /** Functions that use plug-ins (external) dictionaries.
@@ -72,10 +73,12 @@ public:
 
     static FunctionPtr create(const Context & context)
     {
-        return std::make_shared<FunctionDictHas>(context.getExternalDictionaries());
+        return std::make_shared<FunctionDictHas>(context.getExternalDictionaries(), context);
     }
 
-    FunctionDictHas(const ExternalDictionaries & dictionaries_) : dictionaries(dictionaries_) {}
+    FunctionDictHas(const ExternalDictionaries & dictionaries_, const Context & context_)
+        : dictionaries(dictionaries_)
+        , context(context_) {}
 
     String getName() const override { return name; }
 
@@ -124,6 +127,12 @@ private:
         auto dict = dictionaries.getDictionary(dict_name_col->getValue<String>());
         const auto dict_ptr = dict.get();
 
+        if (!dict->isAllowed(context.getCurrentDatabase()))
+        {
+            throw Exception{"For function " + getName() + ", cannot access dictionary "
+                + dict->getName() + " on database " + context.getCurrentDatabase(), ErrorCodes::DICTIONARY_ACCESS_DENIED};
+        }
+
         if (!executeDispatchSimple<FlatDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatchSimple<HashedDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatchSimple<CacheDictionary>(block, arguments, result, dict_ptr) &&
@@ -183,6 +192,7 @@ private:
     }
 
     const ExternalDictionaries & dictionaries;
+    const Context & context;
 };
 
 
@@ -217,10 +227,12 @@ public:
 
     static FunctionPtr create(const Context & context)
     {
-        return std::make_shared<FunctionDictGetString>(context.getExternalDictionaries());
+        return std::make_shared<FunctionDictGetString>(context.getExternalDictionaries(), context);
     }
 
-    FunctionDictGetString(const ExternalDictionaries & dictionaries_) : dictionaries(dictionaries_) {}
+    FunctionDictGetString(const ExternalDictionaries & dictionaries_, const Context & context_)
+        : dictionaries(dictionaries_)
+        , context(context_) {}
 
     String getName() const override { return name; }
 
@@ -290,6 +302,12 @@ private:
         auto dict = dictionaries.getDictionary(dict_name_col->getValue<String>());
         const auto dict_ptr = dict.get();
 
+        if (!dict->isAllowed(context.getCurrentDatabase()))
+        {
+            throw Exception{"For function " + getName() + ", cannot access dictionary "
+                + dict->getName() + " on database " + context.getCurrentDatabase(), ErrorCodes::DICTIONARY_ACCESS_DENIED};
+        }
+
         if (!executeDispatch<FlatDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatch<HashedDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatch<CacheDictionary>(block, arguments, result, dict_ptr) &&
@@ -402,6 +420,7 @@ private:
     }
 
     const ExternalDictionaries & dictionaries;
+    const Context & context;
 };
 
 
@@ -412,10 +431,12 @@ public:
 
     static FunctionPtr create(const Context & context)
     {
-        return std::make_shared<FunctionDictGetStringOrDefault>(context.getExternalDictionaries());
+        return std::make_shared<FunctionDictGetStringOrDefault>(context.getExternalDictionaries(), context);
     }
 
-    FunctionDictGetStringOrDefault(const ExternalDictionaries & dictionaries_) : dictionaries(dictionaries_) {}
+    FunctionDictGetStringOrDefault(const ExternalDictionaries & dictionaries_, const Context & context_)
+        : dictionaries(dictionaries_)
+        , context(context_) {}
 
     String getName() const override { return name; }
 
@@ -467,6 +488,12 @@ private:
         auto dict = dictionaries.getDictionary(dict_name_col->getValue<String>());
         const auto dict_ptr = dict.get();
 
+        if (!dict->isAllowed(context.getCurrentDatabase()))
+        {
+            throw Exception{"For function " + getName() + ", cannot access dictionary "
+                + dict->getName() + " on database " + context.getCurrentDatabase(), ErrorCodes::DICTIONARY_ACCESS_DENIED};
+        }
+
         if (!executeDispatch<FlatDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatch<HashedDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatch<CacheDictionary>(block, arguments, result, dict_ptr) &&
@@ -605,6 +632,7 @@ private:
     }
 
     const ExternalDictionaries & dictionaries;
+    const Context & context;
 };
 
 
@@ -727,11 +755,12 @@ public:
 
     static FunctionPtr create(const Context & context, UInt32 dec_scale = 0)
     {
-        return std::make_shared<FunctionDictGet>(context.getExternalDictionaries(), dec_scale);
+        return std::make_shared<FunctionDictGet>(context.getExternalDictionaries(), context, dec_scale);
     }
 
-    FunctionDictGet(const ExternalDictionaries & dictionaries_, UInt32 dec_scale = 0)
+    FunctionDictGet(const ExternalDictionaries & dictionaries_, const Context & context_, UInt32 dec_scale = 0)
         : dictionaries(dictionaries_)
+        , context(context_)
         , decimal_scale(dec_scale)
     {}
 
@@ -801,6 +830,12 @@ private:
         auto dict = dictionaries.getDictionary(dict_name_col->getValue<String>());
         const auto dict_ptr = dict.get();
 
+        if (!dict->isAllowed(context.getCurrentDatabase()))
+        {
+            throw Exception{"For function " + getName() + ", cannot access dictionary "
+                + dict->getName() + " on database " + context.getCurrentDatabase(), ErrorCodes::DICTIONARY_ACCESS_DENIED};
+        }
+
         if (!executeDispatch<FlatDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatch<HashedDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatch<CacheDictionary>(block, arguments, result, dict_ptr) &&
@@ -949,6 +984,7 @@ private:
     }
 
     const ExternalDictionaries & dictionaries;
+    const Context & context;
     UInt32 decimal_scale;
 };
 
@@ -998,11 +1034,12 @@ public:
 
     static FunctionPtr create(const Context & context, UInt32 dec_scale = 0)
     {
-        return std::make_shared<FunctionDictGetOrDefault>(context.getExternalDictionaries(), dec_scale);
+        return std::make_shared<FunctionDictGetOrDefault>(context.getExternalDictionaries(), context, dec_scale);
     }
 
-    FunctionDictGetOrDefault(const ExternalDictionaries & dictionaries_, UInt32 dec_scale = 0)
+    FunctionDictGetOrDefault(const ExternalDictionaries & dictionaries_, const Context & context_, UInt32 dec_scale = 0)
         : dictionaries(dictionaries_)
+        , context(context_)
         , decimal_scale(dec_scale)
     {}
 
@@ -1057,6 +1094,12 @@ private:
         auto dict = dictionaries.getDictionary(dict_name_col->getValue<String>());
         const auto dict_ptr = dict.get();
 
+        if (!dict->isAllowed(context.getCurrentDatabase()))
+        {
+            throw Exception{"For function " + getName() + ", cannot access dictionary "
+                + dict->getName() + " on database " + context.getCurrentDatabase(), ErrorCodes::DICTIONARY_ACCESS_DENIED};
+        }
+
         if (!executeDispatch<FlatDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatch<HashedDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatch<CacheDictionary>(block, arguments, result, dict_ptr) &&
@@ -1242,6 +1285,7 @@ private:
     }
 
     const ExternalDictionaries & dictionaries;
+    const Context & context;
     UInt32 decimal_scale;
 };
 
@@ -1580,10 +1624,12 @@ public:
 
     static FunctionPtr create(const Context & context)
     {
-        return std::make_shared<FunctionDictGetHierarchy>(context.getExternalDictionaries());
+        return std::make_shared<FunctionDictGetHierarchy>(context.getExternalDictionaries(), context);
     }
 
-    FunctionDictGetHierarchy(const ExternalDictionaries & dictionaries_) : dictionaries(dictionaries_) {}
+    FunctionDictGetHierarchy(const ExternalDictionaries & dictionaries_, const Context & context_)
+        : dictionaries(dictionaries_)
+        , context(context_) {}
 
     String getName() const override { return name; }
 
@@ -1625,6 +1671,12 @@ private:
         auto dict = dictionaries.getDictionary(dict_name_col->getValue<String>());
         const auto dict_ptr = dict.get();
 
+        if (!dict->isAllowed(context.getCurrentDatabase()))
+        {
+            throw Exception{"For function " + getName() + ", cannot access dictionary "
+                + dict->getName() + " on database " + context.getCurrentDatabase(), ErrorCodes::DICTIONARY_ACCESS_DENIED};
+        }
+
         if (!executeDispatch<FlatDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatch<HashedDictionary>(block, arguments, result, dict_ptr) &&
             !executeDispatch<CacheDictionary>(block, arguments, result, dict_ptr))
@@ -1727,6 +1779,7 @@ private:
     }
 
     const ExternalDictionaries & dictionaries;
+    const Context & context;
 };
 
 
@@ -1737,10 +1790,12 @@ public:
 
     static FunctionPtr create(const Context & context)
     {
-        return std::make_shared<FunctionDictIsIn>(context.getExternalDictionaries());
+        return std::make_shared<FunctionDictIsIn>(context.getExternalDictionaries(), context);
     }
 
-    FunctionDictIsIn(const ExternalDictionaries & dictionaries_) : dictionaries(dictionaries_) {}
+    FunctionDictIsIn(const ExternalDictionaries & dictionaries_, const Context & context_)
+        : dictionaries(dictionaries_)
+        , context(context_) {}
 
     String getName() const override { return name; }
 
@@ -1785,6 +1840,12 @@ private:
         auto dict = dictionaries.getDictionary(dict_name_col->getValue<String>());
         const auto dict_ptr = dict.get();
 
+        if (!dict->isAllowed(context.getCurrentDatabase()))
+        {
+            throw Exception{"For function " + getName() + ", cannot access dictionary "
+                + dict->getName() + " on database " + context.getCurrentDatabase(), ErrorCodes::DICTIONARY_ACCESS_DENIED};
+        }
+
         if (!executeDispatch<FlatDictionary>(block, arguments, result, dict_ptr)
             && !executeDispatch<HashedDictionary>(block, arguments, result, dict_ptr)
             && !executeDispatch<CacheDictionary>(block, arguments, result, dict_ptr))
@@ -1889,6 +1950,7 @@ private:
     }
 
     const ExternalDictionaries & dictionaries;
+    const Context & context;
 };