jcoffey-dev
e15a63408a
Verified live against clickhouse/clickhouse-server:24.8: a freshly created tenant user was NOT default-denied from system.* the way the original design assumed -- system.tables listed every tenant's database/table names to any authenticated user regardless of grants. Fixed with an explicit REVOKE SELECT ON system.* FROM <user> after the existing GRANT SELECT, INSERT. Verifying this live also surfaced a real ClickHouse behavioral split the design didn't anticipate: system.query_log is genuinely access- checked (the REVOKE makes it hard-deny, ACCESS_DENIED), but system.tables is a filtered catalog view that ClickHouse 24.8 never denies outright -- it just returns zero rows for a properly-revoked user. Both outcomes close the actual leak. Corrected TestProvisionedUserCannotReadSystemTables to assert what each table actually does (hard error for query_log, verified-empty-and-no-foreign- database-names for tables) instead of demanding a hard error from both.