Merge #142270

142270: sql/opt: add policy information to EXPLAIN for writes r=spilchen a=spilchen

This builds on the previous change that annotated verbose EXPLAIN output with policy information, which applied only to read operations. This update extends that functionality to INSERT, UPDATE, DELETE, and UPSERT operations.

Epic: CRDB-45203
Release note: none
Informs #136704

Co-authored-by: Matt Spilchen <[email protected]>

Author: craig[bot]

pkg/sql/opt/exec/execbuilder/mutation.go

@@ -648,32 +648,42 @@ func (b *Builder) buildDelete(del *memo.DeleteExpr) (_ execPlan, outputCols colO
 	return ep, outputCols, nil
 }
 
-// tryBuildDeleteRange attempts to construct a fast DeleteRange execution for a
-// logical Delete operator, checking all required conditions. See
-// exec.Factory.ConstructDeleteRange.
-func (b *Builder) tryBuildDeleteRange(del *memo.DeleteExpr) (_ execPlan, ok bool, _ error) {
+// canUseDeleteRange checks whether the memo.DeleteExpr can be built into
+// a delete range plan.
+func (b *Builder) canUseDeleteRange(del *memo.DeleteExpr) bool {
 	// If rows need to be returned from the Delete operator (i.e. RETURNING
 	// clause), no fast path is possible, because row values must be fetched.
 	if del.NeedResults() {
-		return execPlan{}, false, nil
+		return false
 	}
 
 	// Check for simple Scan input operator without a limit; anything else is not
 	// supported by a range delete.
 	if scan, ok := del.Input.(*memo.ScanExpr); !ok || scan.HardLimit != 0 {
-		return execPlan{}, false, nil
+		return false
 	}
 
 	tab := b.mem.Metadata().Table(del.Table)
 	if tab.DeletableIndexCount() > 1 {
 		// Any secondary index prevents fast path, because separate delete batches
 		// must be formulated to delete rows from them.
-		return execPlan{}, false, nil
+		return false
 	}
 
 	// We can use the fast path if we don't need to buffer the input to the
 	// delete operator (for foreign key checks/cascades).
 	if del.WithID != 0 {
+		return false
+	}
+
+	return true
+}
+
+// tryBuildDeleteRange attempts to construct a fast DeleteRange execution for a
+// logical Delete operator, checking all required conditions. See
+// exec.Factory.ConstructDeleteRange.
+func (b *Builder) tryBuildDeleteRange(del *memo.DeleteExpr) (_ execPlan, ok bool, _ error) {
+	if !b.canUseDeleteRange(del) {
 		return execPlan{}, false, nil
 	}
 

pkg/sql/opt/exec/execbuilder/relational.go

@@ -458,13 +458,17 @@ func (b *Builder) maybeAnnotatePolicyInfo(node exec.Node, e memo.RelExpr) {
 			return
 		}
 		// Helper to annotate a node for the given table ID.
-		annotateNodeForTable := func(tabID opt.TableID) {
+		annotateNodeForTable := func(tabID opt.TableID, applyFilterExpr bool) {
 			// Pull out the policy information for the table the node was built for.
 			policies, found := rlsMeta.PoliciesApplied[tabID]
 			if found {
 				val := exec.RLSPoliciesApplied{
 					PoliciesSkippedForRole: rlsMeta.HasAdminRole,
-					Policies:               policies,
+				}
+				if applyFilterExpr {
+					val.Policies = policies.Filter
+				} else {
+					val.Policies = policies.Check
 				}
 				ef.AnnotateNode(node, exec.PolicyInfoID, &val)
 			}
@@ -479,20 +483,36 @@ func (b *Builder) maybeAnnotatePolicyInfo(node exec.Node, e memo.RelExpr) {
 				ef.AnnotateNode(node, exec.PolicyInfoID, &exec.RLSPoliciesApplied{})
 			}
 		case *memo.ScanExpr:
-			annotateNodeForTable(e.Table)
+			annotateNodeForTable(e.Table, true /* applyFilterExpr */)
 		case *memo.LookupJoinExpr:
-			annotateNodeForTable(e.Table)
+			annotateNodeForTable(e.Table, true /* applyFilterExpr */)
 		case *memo.ZigzagJoinExpr:
-			annotateNodeForTable(e.LeftTable)
-			annotateNodeForTable(e.RightTable)
+			annotateNodeForTable(e.LeftTable, true /* applyFilterExpr */)
+			annotateNodeForTable(e.RightTable, true /* applyFilterExpr */)
 		case *memo.InvertedJoinExpr:
-			annotateNodeForTable(e.Table)
+			annotateNodeForTable(e.Table, true /* applyFilterExpr */)
 		case *memo.PlaceholderScanExpr:
-			annotateNodeForTable(e.Table)
+			annotateNodeForTable(e.Table, true /* applyFilterExpr */)
 		case *memo.IndexJoinExpr:
-			annotateNodeForTable(e.Table)
+			annotateNodeForTable(e.Table, true /* applyFilterExpr */)
 		case *memo.VectorSearchExpr:
-			annotateNodeForTable(e.Table)
+			annotateNodeForTable(e.Table, true /* applyFilterExpr */)
+		case *memo.DeleteExpr:
+			// Typically, policy information is displayed in the scan node. However,
+			// a `DeleteExpr` built for a delete range operation does not emit a scan node,
+			// as everything is included within the `deleteRangeOp` node.
+			// To ensure policy information is included, we handle that case here.
+			if b.canUseDeleteRange(e) {
+				if scan, ok := e.Input.(*memo.ScanExpr); ok {
+					annotateNodeForTable(scan.Table, true /* applyFilterExpr */)
+				}
+			}
+		case *memo.InsertExpr:
+			annotateNodeForTable(e.Table, false /* applyFilterExpr */)
+		case *memo.UpdateExpr:
+			annotateNodeForTable(e.Table, false /* applyFilterExpr */)
+		case *memo.UpsertExpr:
+			annotateNodeForTable(e.Table, false /* applyFilterExpr */)
 		}
 	}
 }

pkg/sql/opt/exec/explain/emit.go

@@ -705,20 +705,15 @@ func (e *emitter) emitNodeAttributes(ctx context.Context, evalCtx *eval.Context,
 			ob.VAttr("parallel", "")
 		}
 		e.emitLockingPolicy(a.Params.Locking)
-
-		if val, ok := n.annotations[exec.PolicyInfoID]; ok {
-			e.emitPolicies(ob, a.Table, val.(*exec.RLSPoliciesApplied))
-		}
+		e.emitPolicies(ob, a.Table, n)
 
 	case valuesOp:
 		a := n.args.(*valuesArgs)
 		// Don't emit anything, except policy info, for the "norows" and "emptyrow" cases.
 		if len(a.Rows) > 0 && (len(a.Rows) > 1 || len(a.Columns) > 0) {
 			e.emitTuples(tree.RawRows(a.Rows), len(a.Columns))
 		} else if len(a.Rows) == 0 {
-			if val, ok := n.annotations[exec.PolicyInfoID]; ok {
-				e.emitPolicies(ob, nil, val.(*exec.RLSPoliciesApplied))
-			}
+			e.emitPolicies(ob, nil, n)
 		}
 
 	case filterOp:
@@ -1003,6 +998,7 @@ func (e *emitter) emitNodeAttributes(ctx context.Context, evalCtx *eval.Context,
 			}
 			ob.LeaveNode()
 		}
+		e.emitPolicies(ob, a.Table, n)
 
 	case insertFastPathOp:
 		a := n.args.(*insertFastPathArgs)
@@ -1037,6 +1033,7 @@ func (e *emitter) emitNodeAttributes(ctx context.Context, evalCtx *eval.Context,
 			// triggers.
 			return errors.AssertionFailedf("insert fast path with before-triggers")
 		}
+		e.emitPolicies(ob, a.Table, n)
 
 	case upsertOp:
 		a := n.args.(*upsertArgs)
@@ -1076,6 +1073,7 @@ func (e *emitter) emitNodeAttributes(ctx context.Context, evalCtx *eval.Context,
 			}
 			ob.LeaveNode()
 		}
+		e.emitPolicies(ob, a.Table, n)
 
 	case updateOp:
 		a := n.args.(*updateArgs)
@@ -1097,6 +1095,7 @@ func (e *emitter) emitNodeAttributes(ctx context.Context, evalCtx *eval.Context,
 			}
 			ob.LeaveNode()
 		}
+		e.emitPolicies(ob, a.Table, n)
 
 	case deleteOp:
 		a := n.args.(*deleteArgs)
@@ -1131,6 +1130,7 @@ func (e *emitter) emitNodeAttributes(ctx context.Context, evalCtx *eval.Context,
 			// DeleteRange should not be planned if there are applicable triggers.
 			return errors.AssertionFailedf("delete range with before-triggers")
 		}
+		e.emitPolicies(ob, a.Table, n)
 
 	case showCompletionsOp:
 		a := n.args.(*showCompletionsArgs)
@@ -1387,12 +1387,15 @@ func (e *emitter) emitJoinAttributes(
 	e.ob.Expr("pred", extraOnCond, appendColumns(leftCols, rightCols...))
 }
 
-func (e *emitter) emitPolicies(
-	ob *OutputBuilder, table cat.Table, applied *exec.RLSPoliciesApplied,
-) {
+func (e *emitter) emitPolicies(ob *OutputBuilder, table cat.Table, n *Node) {
 	if !ob.flags.ShowPolicyInfo {
 		return
 	}
+	val, ok := n.annotations[exec.PolicyInfoID]
+	if !ok {
+		return
+	}
+	applied := val.(*exec.RLSPoliciesApplied)
 
 	if applied.PoliciesSkippedForRole {
 		ob.AddField("policies", "exempt for role")