[Static Masking] Improve Selective Masking
Selective Masking allows user to reduce the "scope" of the maskings rules applied on a table with
SECURITY LABEL FOR anon ON COLUMN user.login
IS "MASKED WITH FUNCTION anon.dummy_username()";
SECURITY LABEL FOR anon ON TABLE user
IS "MASKED WHEN NOT is_admin";
Which would currenlty be translated into
UPDATE user
SET login = CASE
WHEN is_admin
THEN anon.dummy_username()
ELSE login
;
This rewrite the entire table and if the WHEN clause has a high selectivity we're going to waste a lot of I/O rewriting the same values in most lines...
A better approach would be to apply the predicate at the lower level:
UPDATE user
SET login = anon.dummy_username();
WHERE is_admin
;
Edited by damien clochard