/*
 * JBoss, Home of Professional Open Source.
 * See the COPYRIGHT.txt file distributed with this work for information
 * regarding copyright ownership.  Some portions may be licensed
 * to Red Hat, Inc. under one or more contributor license agreements.
 * 
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 * 
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 * 
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301 USA.
 * Modified by
 * @author  Data Virtuality GmbH
 * @date    $Date$
 *
 */
// https://issues.jboss.org/browse/TEIID-2311
// https://issues.jboss.org/browse/TEIID-2484
// https://issues.jboss.org/browse/TEIID-2327
// https://issues.jboss.org/browse/TEIID-2506
// https://issues.jboss.org/browse/TEIID-3325
// https://issues.jboss.org/browse/TEIID-2939
// https://issues.jboss.org/browse/TEIID-2504
package org.teiid.query.processor;

import static org.teiid.query.processor.TestProcessor.*;

import java.util.Arrays;
import java.util.HashMap;
import java.util.List;

import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;
import org.teiid.adminapi.DataPolicy;
import org.teiid.adminapi.impl.DataPolicyMetadata;
import org.teiid.adminapi.impl.DataPolicyMetadata.PermissionMetaData;
import org.teiid.api.exception.query.QueryMetadataException;
import org.teiid.api.exception.query.QueryPlannerException;
import org.teiid.api.exception.query.QueryProcessingException;
import org.teiid.core.TeiidProcessingException;
import org.teiid.dqp.internal.process.DQPWorkContext;
import org.teiid.query.metadata.TransformationMetadata;
import org.teiid.query.optimizer.TestOptimizer;
import org.teiid.query.optimizer.capabilities.BasicSourceCapabilities;
import org.teiid.query.optimizer.capabilities.DefaultCapabilitiesFinder;
import org.teiid.query.optimizer.capabilities.SourceCapabilities.Capability;
import org.teiid.query.unittest.RealMetadataFactory;
import org.teiid.query.util.CommandContext;
import static org.junit.jupiter.api.Assertions.assertThrows;

@SuppressWarnings({"nls", "unchecked"})
public class TestRowBasedSecurity {

	CommandContext context;
	private static PermissionMetaData pmd;

	@BeforeEach public void setup() {
		context = createContext();
	}

	private static CommandContext createContext() {
		CommandContext context = createCommandContext();
		DQPWorkContext workContext = new DQPWorkContext();
		HashMap<String, DataPolicy> policies = new HashMap<String, DataPolicy>();
		DataPolicyMetadata policy = new DataPolicyMetadata();
		pmd = new PermissionMetaData();
		pmd.setResourceName("pm1.g1");
		pmd.setCondition("e1 = user()");

		PermissionMetaData pmd1 = new PermissionMetaData();
		pmd1.setResourceName("pm1.g2");
		pmd1.setCondition("foo = bar");

		PermissionMetaData pmd2 = new PermissionMetaData();
		pmd2.setResourceName("pm1.g4");
		pmd2.setCondition("e1 = max(e2)");

		PermissionMetaData pmd3 = new PermissionMetaData();
		pmd3.setResourceName("pm1.g3");
		pmd3.setAllowDelete(true);

		PermissionMetaData pmd4 = new PermissionMetaData();
		pmd4.setResourceName("pm1.sp1");
		pmd4.setCondition("e1 = 'a'");

		policy.addPermission(pmd, pmd1, pmd2, pmd3, pmd4);
		policy.setName("some-role");
		policies.put("some-role", policy);

		workContext.setPolicies(policies);
		context.setDQPWorkContext(workContext);
		return context;
	}

	@Test public void testSelectFilter() throws Exception {
		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("SELECT pm1.g1.e1, pm1.g1.e2 FROM pm1.g1", new List<?>[] {Arrays.asList("a", 1), Arrays.asList("b", 2)});
		ProcessorPlan plan = helpGetPlan(helpParse("select e2 from pm1.g1"), RealMetadataFactory.example1Cached(), new DefaultCapabilitiesFinder(), context);
		List<?>[] expectedResults = new List<?>[0]; 
		helpProcess(plan, context, dataManager, expectedResults);
	}

	/**
	 * Note that we create an inline view to keep the proper position of the filter
	 */
	@Disabled("DVCORE-7868, determinism of some functions is changed")
	@Test public void testSelectFilterOuterJoin() throws Exception {
		BasicSourceCapabilities caps = TestOptimizer.getTypicalCapabilities();
		caps.setCapabilitySupport(Capability.QUERY_FROM_JOIN_OUTER, true);
		caps.setCapabilitySupport(Capability.QUERY_FROM_JOIN_OUTER_FULL, true);
		caps.setCapabilitySupport(Capability.QUERY_FROM_INLINE_VIEWS, true);
		ProcessorPlan plan = helpGetPlan(helpParse("SELECT pm1.g1.e1, pm1.g1.e2 FROM pm1.g1 full outer join pm1.g3 on (pm1.g1.e1=pm1.g3.e1)"), RealMetadataFactory.example1Cached(), new DefaultCapabilitiesFinder(caps), context);
		TestOptimizer.checkAtomicQueries(new String[] {"SELECT v_0.c_0, v_0.c_1 FROM (SELECT g_0.e1 AS c_0, g_0.e2 AS c_1 FROM pm1.g1 AS g_0 WHERE g_0.e1 = 'user') AS v_0 FULL OUTER JOIN pm1.g3 AS g_1 ON v_0.c_0 = g_1.e1"}, plan);
	}

	@Disabled("DVCORE-7868, determinism of some functions is changed")
	@Test public void testSelectFilterOuterJoin1() throws Exception {
		TransformationMetadata tm = RealMetadataFactory.fromDDL("create foreign table t (x string, y integer); create foreign table t1 (x string, y integer) create view v as select t.x, t1.y from t left outer join t1 on t.y = t1.y", "x", "y");
		BasicSourceCapabilities caps = TestOptimizer.getTypicalCapabilities();
		caps.setCapabilitySupport(Capability.QUERY_FROM_JOIN_OUTER, false);
		caps.setCapabilitySupport(Capability.QUERY_FROM_JOIN_INNER, false);
		caps.setCapabilitySupport(Capability.QUERY_FROM_INLINE_VIEWS, false);

		CommandContext context = createCommandContext();
		DQPWorkContext workContext = new DQPWorkContext();
		HashMap<String, DataPolicy> policies = new HashMap<String, DataPolicy>();
		DataPolicyMetadata policy = new DataPolicyMetadata();
		pmd = new PermissionMetaData();
		pmd.setResourceName("y.v");
		pmd.setCondition("x = user()");

		policy.addPermission(pmd);
		policy.setName("some-role");
		policies.put("some-role", policy);

		workContext.setPolicies(policies);
		context.setDQPWorkContext(workContext);

		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("SELECT g_0.y AS c_0, g_0.x AS c_1 FROM y.t AS g_0 ORDER BY c_0", new List<?>[] {Arrays.asList(1, "a"), Arrays.asList(2, "b")});
		dataManager.addData("SELECT g_0.y AS c_0 FROM y.t1 AS g_0 ORDER BY c_0", new List<?>[] {Arrays.asList(1)});

		ProcessorPlan plan = helpGetPlan(helpParse("select count(1) from v"), tm, new DefaultCapabilitiesFinder(caps), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList(0L)};
		helpProcess(plan, context, dataManager, expectedResults);

		plan = helpGetPlan(helpParse("select count(1) from v where y is not null"), tm, new DefaultCapabilitiesFinder(caps), context);
		//dataManager.addData("SELECT g_0.y AS c_0 FROM y.t AS g_0 WHERE g_0.x = 'user' ORDER BY c_0", new List<?>[] {Arrays.asList(1), Arrays.asList(2)});
		dataManager.addData("SELECT g_0.y FROM y.t AS g_0 WHERE g_0.x = 'user'", new List<?>[] {Arrays.asList(1), Arrays.asList(2)});
		dataManager.addData("SELECT g_0.y AS c_0 FROM y.t1 AS g_0 WHERE g_0.y IS NOT NULL ORDER BY c_0", new List<?>[] {Arrays.asList(1)});
		expectedResults = new List<?>[] {Arrays.asList(1L)};
		helpProcess(plan, context, dataManager, expectedResults);
	}

	/**
	 * Same as above, but ensures it's still in effect under a proceudre
	 */
	@Test public void testTransitiveFilter() throws Exception {
		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("SELECT pm1.g1.e1, pm1.g1.e2 FROM pm1.g1", new List<?>[] {Arrays.asList("a", 1), Arrays.asList("b", 2)});
		dataManager.addData("exec pm1.sq1()", new List<?>[] {Arrays.asList("a", 1), Arrays.asList("b", 2)});
		ProcessorPlan plan = helpGetPlan(helpParse("exec pm1.sq1()"), RealMetadataFactory.example1Cached(), new DefaultCapabilitiesFinder(), context);
		List<?>[] expectedResults = new List<?>[0];
		helpProcess(plan, context, dataManager, expectedResults);
	}

	/**
	 * restricted to e1 = a
	 */
	/* TODO these tests will be fixed after backporting the huge TEIID-2253 issue
	   TODO More precisely these tests fail because of check lack on original metadata id (if it's instance of Procedure type)
	   TODO in TempMetadataAdapter.getModelID method
	@Test public void testProcedureFilter() throws Exception {
		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("EXEC pm1.sp1()", new List<?>[] {Arrays.asList("a", 1), Arrays.asList("b", 2)});
		ProcessorPlan plan = helpGetPlan(helpParse("exec pm1.sp1()"), RealMetadataFactory.example1Cached(), new DefaultCapabilitiesFinder(), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList("a", 1)};
		helpProcess(plan, context, dataManager, expectedResults);
	}

	@Test public void testProcedureRelationalFilter() throws Exception {
		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("EXEC pm1.sp1()", new List<?>[] {Arrays.asList("a", 1), Arrays.asList("b", 2)});
		ProcessorPlan plan = helpGetPlan(helpParse("select * from pm1.sp1"), RealMetadataFactory.example1Cached(), new DefaultCapabilitiesFinder(), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList("a", 1)};
		helpProcess(plan, context, dataManager, expectedResults);
	}*/
	
	/**
	 * Shouldn't even execute as 'user' <> 'a'
	 */
	@Disabled("DVCORE-7868, determinism of some functions is changed")
	@Test public void testDeleteFilter() throws Exception {
		HardcodedDataManager dataManager = new HardcodedDataManager();
		ProcessorPlan plan = helpGetPlan(helpParse("delete from pm1.g1 where e1 = 'a'"), RealMetadataFactory.example1Cached(), TestOptimizer.getGenericFinder(), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList(0)}; 
		helpProcess(plan, context, dataManager, expectedResults);
	}

	@Test public void testInsertDisabledConstraint() throws Exception {
		pmd.setConstraint(false);
		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("INSERT INTO pm1.g1 (e1) VALUES ('a')", new List<?>[] {Arrays.asList(1)});
		ProcessorPlan plan = helpGetPlan(helpParse("insert into pm1.g1 (e1) values ('a')"), RealMetadataFactory.example1Cached(), TestOptimizer.getGenericFinder(), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList(1)};
		helpProcess(plan, context, dataManager, expectedResults);
	}
	
	/**
	 * invalid insert value
	 */
	@Disabled("DVCORE-7868, determinism of some functions is changed")
	@Test public void testInsertConstraint() throws Exception {
		assertThrows(QueryPlannerException.class, () -> {
			HardcodedDataManager dataManager = new HardcodedDataManager();
			ProcessorPlan plan = helpGetPlan(helpParse("insert into pm1.g1 (e1) values ('a')"), RealMetadataFactory.example1Cached(), TestOptimizer.getGenericFinder(), context);
			helpProcess(plan, context, dataManager, null);
		});
	}

	/**
	 * Assumes the null value for e1, which results in a violation
	 */
	@Test public void testInsertConstraint1() throws Exception {
		assertThrows(QueryPlannerException.class, () -> {
			HardcodedDataManager dataManager = new HardcodedDataManager();
			ProcessorPlan plan = helpGetPlan(helpParse("insert into pm1.g1 (e2) values (1)"), RealMetadataFactory.example1Cached(), TestOptimizer.getGenericFinder(), context);
			helpProcess(plan, context, dataManager, null);
		});
	}

	@Test public void testInsertConstraintCorrelatedSubquery() throws Exception {
		assertThrows(TeiidProcessingException.class, () -> {
			DataPolicyMetadata policy1 = new DataPolicyMetadata();
			PermissionMetaData pmd3 = new PermissionMetaData();
			pmd3.setResourceName("pm1.g1");
			pmd3.setCondition("e1 = (select min(e1) from pm1.g3 where pm1.g1.e2 = e2)");
			policy1.addPermission(pmd3);
			policy1.setName("some-other-role");
			context.getAllowedDataPolicies().put("some-other-role", policy1);

			HardcodedDataManager dataManager = new HardcodedDataManager();
			ProcessorPlan plan = helpGetPlan(helpParse("insert into pm1.g1 (e1, e2) values ('a', 1)"), RealMetadataFactory.example1Cached(), TestOptimizer.getGenericFinder(), context);
			List<?>[] expectedResults = new List<?>[]{Arrays.asList(0)};
			helpProcess(plan, context, dataManager, expectedResults);
		});
	}

	@Test public void testInsertConstraintSubquery() throws Exception {
		DataPolicyMetadata policy1 = new DataPolicyMetadata();
		PermissionMetaData pmd3 = new PermissionMetaData();
		pmd3.setResourceName("pm1.g1");
		pmd3.setCondition("e1 = (select min(e1) from pm1.g3)");
		policy1.addPermission(pmd3);
		policy1.setName("some-other-role");
		context.getAllowedDataPolicies().put("some-other-role", policy1);

		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("SELECT g_0.e1 FROM pm1.g3 AS g_0", new List<?>[] {Arrays.asList("a"), Arrays.asList("b")});
		dataManager.addData("INSERT INTO pm1.g1 (e1, e2) VALUES ('a', 1)", new List<?>[] {Arrays.asList(1)});
		ProcessorPlan plan = helpGetPlan(helpParse("insert into pm1.g1 (e1, e2) values ('a', 1)"), RealMetadataFactory.example1Cached(), TestOptimizer.getGenericFinder(), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList(1)};
		helpProcess(plan, context, dataManager, expectedResults);
	}
	
	/**
	 * should fail since it doesn't match the condition
	 */
	@Test public void testInsertConstraintWithQueryExpression() throws Exception {
		assertThrows(QueryProcessingException.class, () -> {
			HardcodedDataManager dataManager = new HardcodedDataManager();
			dataManager.addData("SELECT pm1.g3.e1 FROM pm1.g3", new List<?>[]{Arrays.asList("a"), Arrays.asList("b")});
			BasicSourceCapabilities bsc = new BasicSourceCapabilities();
			bsc.setCapabilitySupport(Capability.INSERT_WITH_QUERYEXPRESSION, true);
			DefaultCapabilitiesFinder capFinder = new DefaultCapabilitiesFinder(bsc);
			ProcessorPlan plan = helpGetPlan(helpParse("insert into pm1.g1 (e1) select e1 from pm1.g3"), RealMetadataFactory.example1Cached(), capFinder, context);
			List<?>[] expectedResults = new List<?>[]{Arrays.asList(0)};
			helpProcess(plan, context, dataManager, expectedResults);
		});
	}
	
	/**
	 * should succeed since it matches the condition
	 */
	@Test public void testInsertConstraintWithQueryExpression1() throws Exception {
		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("SELECT pm1.g3.e1 FROM pm1.g3", new List<?>[] {Arrays.asList("a")});
		dataManager.addData("INSERT INTO pm1.g1 (e1) VALUES ('user')", new List<?>[] {Arrays.asList(1)});
		BasicSourceCapabilities bsc = new BasicSourceCapabilities();
		bsc.setCapabilitySupport(Capability.INSERT_WITH_QUERYEXPRESSION, true);
		DefaultCapabilitiesFinder capFinder = new DefaultCapabilitiesFinder(bsc);
		ProcessorPlan plan = helpGetPlan(helpParse("insert into pm1.g1 (e1) select user() from pm1.g3"), RealMetadataFactory.example1Cached(), capFinder, context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList(1)}; 
		helpProcess(plan, context, dataManager, expectedResults);
	}
	
	@Test public void testInsertFilter1() throws Exception {
		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("INSERT INTO pm1.g1 (e1) VALUES ('user')", new List<?>[] {Arrays.asList(1)});
		ProcessorPlan plan = helpGetPlan(helpParse("insert into pm1.g1 (e1) values ('user')"), RealMetadataFactory.example1Cached(), TestOptimizer.getGenericFinder(), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList(1)}; 
		helpProcess(plan, context, dataManager, expectedResults);
	}
	
	/**
	 * not a valid value for e1
	 */
	@Test public void testUpdateFilter() throws Exception {
		assertThrows(QueryPlannerException.class, () -> {
			HardcodedDataManager dataManager = new HardcodedDataManager();
			ProcessorPlan plan = helpGetPlan(helpParse("update pm1.g1 set e1 = 'a' where e2 = 5"), RealMetadataFactory.example1Cached(), TestOptimizer.getGenericFinder(), context);
			List<?>[] expectedResults = new List<?>[]{Arrays.asList(0)};
			helpProcess(plan, context, dataManager, expectedResults);
		});
	}
	
	/**
	 * no primary key for compensation
	 */
	@Test public void testUpdateFilter1() throws Exception {
		assertThrows(QueryPlannerException.class, () -> {
			HardcodedDataManager dataManager = new HardcodedDataManager();
			ProcessorPlan plan = helpGetPlan(helpParse("update pm1.g1 set e1 = e3 where e2 = 5"), RealMetadataFactory.example1Cached(), TestOptimizer.getGenericFinder(), context);
			List<?>[] expectedResults = new List<?>[]{Arrays.asList(0)};
			helpProcess(plan, context, dataManager, expectedResults);
		});
	}
	
	@Test public void testUpdateFilter2() throws Exception {
		assertThrows(QueryProcessingException.class, () -> {
			HardcodedDataManager dataManager = new HardcodedDataManager();
			dataManager.addData("SELECT g_0.e3, g_0.e1 FROM pm1.g1 AS g_0 WHERE (g_0.e1 = 'user') AND (g_0.e2 = 5)", new List<?>[]{Arrays.asList(Boolean.TRUE, "user")});
			ProcessorPlan plan = helpGetPlan(helpParse("update pm1.g1 set e1 = e3 || 'r' where e2 = 5"), RealMetadataFactory.example4(), TestOptimizer.getGenericFinder(), context);
			List<?>[] expectedResults = new List<?>[]{Arrays.asList(0)};
			// had to add it because of https://jira.data-virtuality.com:8443/browse/DVCORE-3832 issue otherwise we will get NPE when trying to get context
			CommandContext.pushThreadLocalContext(context);
			helpProcess(plan, context, dataManager, expectedResults);
		});
	}

	/**
	 * Ensures that the filter still gets applied to the insert
	 */
	@Disabled("DVCORE-7868, determinism of some functions is changed")
	@Test public void testUpdateFilter3() throws Exception {
		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("UPDATE pm1.g1 SET e2 = 1 WHERE (e2 = 5) AND (e1 = 'user')", new List<?>[] {Arrays.asList(1)});
		ProcessorPlan plan = helpGetPlan(helpParse("update pm1.g1 set e2 = 1 where e2 = 5"), RealMetadataFactory.example4(), TestOptimizer.getGenericFinder(), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList(1)};
		helpProcess(plan, context, dataManager, expectedResults);
	}

	/**
	 * Tests an outside column in the constraint
	 */
	@Test public void testUpdateFilter4() throws Exception {
		DataPolicyMetadata policy1 = new DataPolicyMetadata();
		PermissionMetaData pmd3 = new PermissionMetaData();
		pmd3.setResourceName("pm1.g1");
		pmd3.setCondition("e2 = 1 and e3");
		policy1.addPermission(pmd3);
		policy1.setName("some-role");
		context.getAllowedDataPolicies().put("some-role", policy1);

		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("SELECT g_0.e4, g_0.e3, g_0.e1 FROM pm1.g1 AS g_0 WHERE (g_0.e3 = TRUE) AND (g_0.e2 = 1) AND (g_0.e1 IN ('a', 'b'))", new List<?>[] {Arrays.asList(Double.valueOf(1), Boolean.TRUE, "a"), Arrays.asList(Double.valueOf(1), Boolean.TRUE, "b")});
		dataManager.addData("UPDATE pm1.g1 SET e2 = 1 WHERE pm1.g1.e1 = 'a'", new List<?>[] {Arrays.asList(1)});
		dataManager.addData("UPDATE pm1.g1 SET e2 = 1 WHERE pm1.g1.e1 = 'b'", new List<?>[] {Arrays.asList(1)});
		ProcessorPlan plan = helpGetPlan(helpParse("update pm1.g1 set e2 = case when e4 = 1 then 1 else 2 end where e1 in ('a', 'b')"), RealMetadataFactory.example4(), TestOptimizer.getGenericFinder(), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList(2)};
		helpProcess(plan, context, dataManager, expectedResults);
	}
	
	//TODO: should add validation prior to queries being run
	@Test public void testBadFilter() throws Exception {
		assertThrows(QueryMetadataException.class, () -> {
			HardcodedDataManager dataManager = new HardcodedDataManager();
			ProcessorPlan plan = helpGetPlan(helpParse("select e2 from pm1.g2"), RealMetadataFactory.example1Cached(), new DefaultCapabilitiesFinder(), context);
			List<?>[] expectedResults = new List<?>[0];
			helpProcess(plan, context, dataManager, expectedResults);
		});
	}

	@Test public void testBadFilter1() throws Exception {
		assertThrows(QueryMetadataException.class, () -> {
			HardcodedDataManager dataManager = new HardcodedDataManager();
			ProcessorPlan plan = helpGetPlan(helpParse("select * from pm1.g4"), RealMetadataFactory.example1Cached(), new DefaultCapabilitiesFinder(), context);
			List<?>[] expectedResults = new List<?>[0];
			helpProcess(plan, context, dataManager, expectedResults);
		});
	}

	/**
	 * Here the other role makes the g1 rows visible again
	 */
	@Test public void testMultipleRoles() throws Exception {
		HardcodedDataManager dataManager = new HardcodedDataManager();
		dataManager.addData("SELECT pm1.g1.e1, pm1.g1.e2 FROM pm1.g1", new List<?>[] {Arrays.asList("a", 1), Arrays.asList("b", 2)});
		ProcessorPlan plan = helpGetPlan(helpParse("select e2 from pm1.g1"), RealMetadataFactory.example1Cached(), new DefaultCapabilitiesFinder(), context);
		helpProcess(plan, context, dataManager, new List<?>[0]);

		DataPolicyMetadata policy1 = new DataPolicyMetadata();
		PermissionMetaData pmd3 = new PermissionMetaData();
		pmd3.setResourceName("pm1.g1");
		pmd3.setCondition("true");
		policy1.addPermission(pmd3);
		policy1.setName("some-other-role");
		context.getAllowedDataPolicies().put("some-other-role", policy1);

		dataManager = new HardcodedDataManager();
		dataManager.addData("SELECT pm1.g1.e2 FROM pm1.g1", new List<?>[] {Arrays.asList(1), Arrays.asList(2)});
		plan = helpGetPlan(helpParse("select e2 from pm1.g1"), RealMetadataFactory.example1Cached(), new DefaultCapabilitiesFinder(), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList(1), Arrays.asList(2)};
		helpProcess(plan, context, dataManager, expectedResults);
	}

	@Test public void testSubqueryHint() throws Exception {
		DataPolicyMetadata policy1 = new DataPolicyMetadata();
		PermissionMetaData pmd3 = new PermissionMetaData();
		pmd3.setResourceName("pm1.g1");
		pmd3.setCondition("e1 in /*+ DJ */ (select e1 from pm1.g3)");
		policy1.addPermission(pmd3);
		policy1.setName("some-other-role");
		context.getAllowedDataPolicies().clear();
		context.getAllowedDataPolicies().put("some-other-role", policy1);

		HardcodedDataManager dataManager = new HardcodedDataManager();

		dataManager.addData("SELECT pm1.g3.e1 FROM pm1.g3", new List<?>[] {Arrays.asList("b"), Arrays.asList("a")});
		dataManager.addData("SELECT pm1.g1.e1, pm1.g1.e2 FROM pm1.g1", new List<?>[] {Arrays.asList("b", 1), Arrays.asList("a", 2)});

		ProcessorPlan plan = helpGetPlan(helpParse("select e1, e2 from pm1.g1"), RealMetadataFactory.example1Cached(), new DefaultCapabilitiesFinder(), context);
		List<?>[] expectedResults = new List<?>[] {Arrays.asList("a", 2), Arrays.asList("b", 1)};
		helpProcess(plan, context, dataManager, expectedResults);

		dataManager.addData("SELECT g_0.e1 AS c_0 FROM pm1.g3 AS g_0 ORDER BY c_0", new List<?>[] {Arrays.asList("a"), Arrays.asList("b")});
		dataManager.addData("SELECT g_0.e1 AS c_0, g_0.e2 AS c_1 FROM pm1.g1 AS g_0 WHERE g_0.e1 IN ('a', 'b') ORDER BY c_0", new List<?>[] {Arrays.asList("a", 2), Arrays.asList("b", 1)});

		plan = helpGetPlan(helpParse("select e1, e2 from pm1.g1"), RealMetadataFactory.example1Cached(), TestOptimizer.getGenericFinder(), context);
		expectedResults = new List<?>[] {Arrays.asList("a", 2), Arrays.asList("b", 1)};
		helpProcess(plan, context, dataManager, expectedResults);
	}

}
