Activate the user authentication logic by compiling SQLite with 

the -DSQLITE_USER_AUTHENTICATION compile-time option.







The following new APIs are available when user authentication is
activated:

   int sqlite3_user_authenticate(
     sqlite3 *db,           /* The database connection */
     const char *zUsername, /* Username */
................................................................................
     int isAdmin            /* Modified admin privilege for the user */
   );
   
   int sqlite3_user_delete(
     sqlite3 *db,           /* Database connection */
     const char *zUsername  /* Username to remove */
   );
   



The sqlite3_open(), sqlite3_open16(), and sqlite3_open_v2() interfaces
work as before: they open a new database connection.  However, if the
database being opened requires authentication, then the database

connection will be unusable until after sqlite3_user_authenticate()
has been called successfully [1c].  The sqlite3_user_authenticate() call
will return SQLITE_OK if the authentication credentials are accepted
and SQLITE_ERROR if not.

Calling sqlite3_user_authenticate() on a no-authentication-required
database connection is a harmless no-op.  

If the database is encrypted, then sqlite3_key_v2() must be called first,
................................................................................

When opening a no-authentication-required database, the database
connection is treated as if it was authenticated as an admin user.

When ATTACH-ing new database files to a connection, each newly attached
database that is an authentication-required database is checked using
the same username and password as supplied to the main database.  If that
check fails, then the ATTACH-ed database is unreadable [1g].

The sqlite3_user_add() interface can be used (by an admin user only)
to create a new user.  When called on a no-authentication-required
database and when A is true, the sqlite3_user_add(D,U,P,N,A) routine
converts the database into an authentication-required database and
logs the database connection D in using user U with password P,N.
To convert a no-authentication-required database into an authentication-
required database, the isAdmin parameter must be true.  If
sqlite3_user_add(D,U,P,N,A) is called on a no-authentication-required
database and A is false, then the call fails with an SQLITE_AUTH error.

Any call to sqlite3_user_add() by a non-admin user results in an error.

................................................................................
    sqlite3_key_v2();
    sqlite3_user_add();

The sqlite3_user_delete() interface can be used (by an admin user only)
to delete a user.  The currently logged-in user cannot be deleted,
which guarantees that there is always an admin user and hence that
the database cannot be converted into a no-authentication-required
database [3].

The sqlite3_user_change() interface can be used to change a users
login credentials or admin privilege.  Any user can change their own
login credentials [1b].  Only an admin user can change another users login
credentials or admin privilege setting.  No user may change their own 
admin privilege setting.

The sqlite3_set_authorizer() callback is modified to take a 7th parameter
which is the username of the currently logged in user, or NULL for a
no-authentication-required database [1d].

-----------------------------------------------------------------------------
Implementation notes:

An authentication-required database is identified by the presence of a
new table:

................................................................................
anybody and writeable by anybody if the "PRAGMA writable_schema=ON"
statement is run first.

The sqlite_user.pw field is encoded by a built-in SQL function
"sqlite_crypt(X,Y)".  The two arguments are both BLOBs.  The first argument
is the plaintext password supplied to the sqlite3_user_authenticate()
interface.  The second argument is the sqlite_user.pw value and is supplied
so that the function can extra the "salt" used by the password encoder.
the result of sqlite_crypt(X,Y) is another blob which is the value that
ends up being stored in sqlite_user.pw.  To verify credentials X supplied
by the sqlite3_user_authenticate() routine, SQLite runs:

    sqlite_user.pw == sqlite_crypt(X, sqlite_user.pw)

To compute an appropriate sqlite_user.pw value from a new or modified
password X, sqlite_crypt(X,NULL) is run.  A new random salt is selected
when the second argument is NULL.

The built-in version of of sqlite_crypt() uses a simple Ceasar-cypher
which prevents passwords from being revealed by search the raw database
for ASCII text, but is otherwise trivally broken.  To truly secure the
passwords, the database should be encrypted using the SQLite Encryption
Extension or similar technology.  Or, the application can use the
sqlite3_create_function() interface to provide an alternative
implementation of sqlite_crypt() that computes a stronger password hash,
perhaps using a cryptographic hash function like SHA1.

Activate the user authentication logic by including the
ext/userauth/userauth.c source code file in the build and
adding the -DSQLITE_USER_AUTHENTICATION compile-time option.
The ext/userauth/sqlite3userauth.h header file is available to
applications to define the interface.

When using the SQLite amalgamation, it is sufficient to append
the ext/userauth/userauth.c source file onto the end of the
amalgamation.

The following new APIs are available when user authentication is
activated:

   int sqlite3_user_authenticate(
     sqlite3 *db,           /* The database connection */
     const char *zUsername, /* Username */
................................................................................
     int isAdmin            /* Modified admin privilege for the user */
   );
   
   int sqlite3_user_delete(
     sqlite3 *db,           /* Database connection */
     const char *zUsername  /* Username to remove */
   );

With this extension, a database can be marked as requiring authentication.
By default a database does not require authentication.

The sqlite3_open(), sqlite3_open16(), and sqlite3_open_v2() interfaces
work as before: they open a new database connection.  However, if the
database being opened requires authentication, then attempts to prepare
SQL statements (using sqlite3_prepare_v2(), for example) will fail
with an SQLITE_AUTH error until after sqlite3_user_authenticate()
has been called successfully.  The sqlite3_user_authenticate() call
will return SQLITE_OK if the authentication credentials are accepted
and SQLITE_ERROR if not.

Calling sqlite3_user_authenticate() on a no-authentication-required
database connection is a harmless no-op.  

If the database is encrypted, then sqlite3_key_v2() must be called first,
................................................................................

When opening a no-authentication-required database, the database
connection is treated as if it was authenticated as an admin user.

When ATTACH-ing new database files to a connection, each newly attached
database that is an authentication-required database is checked using
the same username and password as supplied to the main database.  If that
check fails, then the ATTACH command fails with an SQLITE_AUTH error.

The sqlite3_user_add() interface can be used (by an admin user only)
to create a new user.  When called on a no-authentication-required
database and when A is true, the sqlite3_user_add(D,U,P,N,A) routine
converts the database into an authentication-required database and
logs in the database connection D as user U with password P,N.
To convert a no-authentication-required database into an authentication-
required database, the isAdmin parameter must be true.  If
sqlite3_user_add(D,U,P,N,A) is called on a no-authentication-required
database and A is false, then the call fails with an SQLITE_AUTH error.

Any call to sqlite3_user_add() by a non-admin user results in an error.

................................................................................
    sqlite3_key_v2();
    sqlite3_user_add();

The sqlite3_user_delete() interface can be used (by an admin user only)
to delete a user.  The currently logged-in user cannot be deleted,
which guarantees that there is always an admin user and hence that
the database cannot be converted into a no-authentication-required
database.

The sqlite3_user_change() interface can be used to change a users
login credentials or admin privilege.  Any user can change their own
password.  Only an admin user can change another users login
credentials or admin privilege setting.  No user may change their own 
admin privilege setting.

The sqlite3_set_authorizer() callback is modified to take a 7th parameter
which is the username of the currently logged in user, or NULL for a
no-authentication-required database.

-----------------------------------------------------------------------------
Implementation notes:

An authentication-required database is identified by the presence of a
new table:

................................................................................
anybody and writeable by anybody if the "PRAGMA writable_schema=ON"
statement is run first.

The sqlite_user.pw field is encoded by a built-in SQL function
"sqlite_crypt(X,Y)".  The two arguments are both BLOBs.  The first argument
is the plaintext password supplied to the sqlite3_user_authenticate()
interface.  The second argument is the sqlite_user.pw value and is supplied
so that the function can extract the "salt" used by the password encoder.
The result of sqlite_crypt(X,Y) is another blob which is the value that
ends up being stored in sqlite_user.pw.  To verify credentials X supplied
by the sqlite3_user_authenticate() routine, SQLite runs:

    sqlite_user.pw == sqlite_crypt(X, sqlite_user.pw)

To compute an appropriate sqlite_user.pw value from a new or modified
password X, sqlite_crypt(X,NULL) is run.  A new random salt is selected
when the second argument is NULL.

The built-in version of of sqlite_crypt() uses a simple Ceasar-cypher
which prevents passwords from being revealed by searching the raw database
for ASCII text, but is otherwise trivally broken.  For better password
security, the database should be encrypted using the SQLite Encryption
Extension or similar technology.  Or, the application can use the
sqlite3_create_function() interface to provide an alternative
implementation of sqlite_crypt() that computes a stronger password hash,
perhaps using a cryptographic hash function like SHA1.

  ** we found it.
  */
  if( rc==SQLITE_OK ){
    sqlite3BtreeEnterAll(db);
    rc = sqlite3Init(db, &zErrDyn);
    sqlite3BtreeLeaveAll(db);
  }









  if( rc ){
    int iDb = db->nDb - 1;
    assert( iDb>=2 );
    if( db->aDb[iDb].pBt ){
      sqlite3BtreeClose(db->aDb[iDb].pBt);
      db->aDb[iDb].pBt = 0;
      db->aDb[iDb].pSchema = 0;

  ** we found it.
  */
  if( rc==SQLITE_OK ){
    sqlite3BtreeEnterAll(db);
    rc = sqlite3Init(db, &zErrDyn);
    sqlite3BtreeLeaveAll(db);
  }
#ifdef SQLITE_USER_AUTHENTICATION
  if( rc==SQLITE_OK ){
    u8 newAuth = 0;
    rc = sqlite3UserAuthCheckLogin(db, zName, &newAuth);
    if( newAuth<db->auth.authLevel ){
      rc = SQLITE_AUTH;
    }
  }
#endif
  if( rc ){
    int iDb = db->nDb - 1;
    assert( iDb>=2 );
    if( db->aDb[iDb].pBt ){
      sqlite3BtreeClose(db->aDb[iDb].pBt);
      db->aDb[iDb].pBt = 0;
      db->aDb[iDb].pSchema = 0;

*/
int sqlite3_set_authorizer(
  sqlite3 *db,
  int (*xAuth)(void*,int,const char*,const char*,const char*,const char*),
  void *pArg
){
  sqlite3_mutex_enter(db->mutex);
  db->xAuth = xAuth;
  db->pAuthArg = pArg;
  sqlite3ExpirePreparedStatements(db);
  sqlite3_mutex_leave(db->mutex);
  return SQLITE_OK;
}

/*
................................................................................
  const char *zCol,               /* Column name */
  int iDb                         /* Index of containing database. */
){
  sqlite3 *db = pParse->db;       /* Database handle */
  char *zDb = db->aDb[iDb].zName; /* Name of attached database */
  int rc;                         /* Auth callback return code */

  rc = db->xAuth(db->pAuthArg, SQLITE_READ, zTab,zCol,zDb,pParse->zAuthContext);




  if( rc==SQLITE_DENY ){
    if( db->nDb>2 || iDb!=0 ){
      sqlite3ErrorMsg(pParse, "access to %s.%s.%s is prohibited",zDb,zTab,zCol);
    }else{
      sqlite3ErrorMsg(pParse, "access to %s.%s is prohibited", zTab, zCol);
    }
    pParse->rc = SQLITE_AUTH;
................................................................................
  if( db->init.busy || IN_DECLARE_VTAB ){
    return SQLITE_OK;
  }

  if( db->xAuth==0 ){
    return SQLITE_OK;
  }
  rc = db->xAuth(db->pAuthArg, code, zArg1, zArg2, zArg3, pParse->zAuthContext);




  if( rc==SQLITE_DENY ){
    sqlite3ErrorMsg(pParse, "not authorized");
    pParse->rc = SQLITE_AUTH;
  }else if( rc!=SQLITE_OK && rc!=SQLITE_IGNORE ){
    rc = SQLITE_DENY;
    sqliteAuthBadReturnCode(pParse);
  }

*/
int sqlite3_set_authorizer(
  sqlite3 *db,
  int (*xAuth)(void*,int,const char*,const char*,const char*,const char*),
  void *pArg
){
  sqlite3_mutex_enter(db->mutex);
  db->xAuth = (sqlite3_xauth)xAuth;
  db->pAuthArg = pArg;
  sqlite3ExpirePreparedStatements(db);
  sqlite3_mutex_leave(db->mutex);
  return SQLITE_OK;
}

/*
................................................................................
  const char *zCol,               /* Column name */
  int iDb                         /* Index of containing database. */
){
  sqlite3 *db = pParse->db;       /* Database handle */
  char *zDb = db->aDb[iDb].zName; /* Name of attached database */
  int rc;                         /* Auth callback return code */

  rc = db->xAuth(db->pAuthArg, SQLITE_READ, zTab,zCol,zDb,pParse->zAuthContext
#ifdef SQLITE_USER_AUTHENTICATION
                 ,db->auth.zAuthUser
#endif
                );
  if( rc==SQLITE_DENY ){
    if( db->nDb>2 || iDb!=0 ){
      sqlite3ErrorMsg(pParse, "access to %s.%s.%s is prohibited",zDb,zTab,zCol);
    }else{
      sqlite3ErrorMsg(pParse, "access to %s.%s is prohibited", zTab, zCol);
    }
    pParse->rc = SQLITE_AUTH;
................................................................................
  if( db->init.busy || IN_DECLARE_VTAB ){
    return SQLITE_OK;
  }

  if( db->xAuth==0 ){
    return SQLITE_OK;
  }
  rc = db->xAuth(db->pAuthArg, code, zArg1, zArg2, zArg3, pParse->zAuthContext
#ifdef SQLITE_USER_AUTHENTICATION
                 ,db->auth.zAuthUser
#endif
                );
  if( rc==SQLITE_DENY ){
    sqlite3ErrorMsg(pParse, "not authorized");
    pParse->rc = SQLITE_AUTH;
  }else if( rc!=SQLITE_OK && rc!=SQLITE_IGNORE ){
    rc = SQLITE_DENY;
    sqliteAuthBadReturnCode(pParse);
  }

*/
int sqlite3ViewGetColumnNames(Parse *pParse, Table *pTable){
  Table *pSelTab;   /* A fake table from which we get the result set */
  Select *pSel;     /* Copy of the SELECT that implements the view */
  int nErr = 0;     /* Number of errors encountered */
  int n;            /* Temporarily holds the number of cursors assigned */
  sqlite3 *db = pParse->db;  /* Database connection for malloc errors */
  int (*xAuth)(void*,int,const char*,const char*,const char*,const char*);

  assert( pTable );

#ifndef SQLITE_OMIT_VIRTUALTABLE
  if( sqlite3VtabCallConnect(pParse, pTable) ){
    return SQLITE_ERROR;
  }

*/
int sqlite3ViewGetColumnNames(Parse *pParse, Table *pTable){
  Table *pSelTab;   /* A fake table from which we get the result set */
  Select *pSel;     /* Copy of the SELECT that implements the view */
  int nErr = 0;     /* Number of errors encountered */
  int n;            /* Temporarily holds the number of cursors assigned */
  sqlite3 *db = pParse->db;  /* Database connection for malloc errors */
  sqlite3_xauth xAuth;       /* Saved xAuth pointer */

  assert( pTable );

#ifndef SQLITE_OMIT_VIRTUALTABLE
  if( sqlite3VtabCallConnect(pParse, pTable) ){
    return SQLITE_ERROR;
  }

  {
    char *zSql;
    zSql = sqlite3MPrintf(db, 
        "SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid",
        db->aDb[iDb].zName, zMasterName);
#ifndef SQLITE_OMIT_AUTHORIZATION
    {
      int (*xAuth)(void*,int,const char*,const char*,const char*,const char*);
      xAuth = db->xAuth;
      db->xAuth = 0;
#endif
      rc = sqlite3_exec(db, zSql, sqlite3InitCallback, &initData, 0);
#ifndef SQLITE_OMIT_AUTHORIZATION
      db->xAuth = xAuth;
    }

  {
    char *zSql;
    zSql = sqlite3MPrintf(db, 
        "SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid",
        db->aDb[iDb].zName, zMasterName);
#ifndef SQLITE_OMIT_AUTHORIZATION
    {
      sqlite3_xauth xAuth;
      xAuth = db->xAuth;
      db->xAuth = 0;
#endif
      rc = sqlite3_exec(db, zSql, sqlite3InitCallback, &initData, 0);
#ifndef SQLITE_OMIT_AUTHORIZATION
      db->xAuth = xAuth;
    }

#define UAUTH_Admin       3     /* Authenticated as an administrator */

/* Functions used only by user authorization logic */
int sqlite3UserAuthTable(const char*);
int sqlite3UserAuthCheckLogin(sqlite3*,const char*,u8*);
void sqlite3CryptFunc(sqlite3_context*,int,sqlite3_value**);






#endif /* SQLITE_USER_AUTHENTICATION */








/*
** Each database connection is an instance of the following structure.
*/
struct sqlite3 {
  sqlite3_vfs *pVfs;            /* OS Interface */
  struct Vdbe *pVdbe;           /* List of active virtual machines */
................................................................................
  sqlite3_value *pErr;          /* Most recent error message */
  union {
    volatile int isInterrupted; /* True if sqlite3_interrupt has been called */
    double notUsed1;            /* Spacer */
  } u1;
  Lookaside lookaside;          /* Lookaside malloc configuration */
#ifndef SQLITE_OMIT_AUTHORIZATION
  int (*xAuth)(void*,int,const char*,const char*,const char*,const char*);
                                /* Access authorization function */
  void *pAuthArg;               /* 1st argument to the access auth function */
#endif
#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
  int (*xProgress)(void *);     /* The progress callback */
  void *pProgressArg;           /* Argument to the progress callback */
  unsigned nProgressOps;        /* Number of opcodes for progress callback */
#endif

#define UAUTH_Admin       3     /* Authenticated as an administrator */

/* Functions used only by user authorization logic */
int sqlite3UserAuthTable(const char*);
int sqlite3UserAuthCheckLogin(sqlite3*,const char*,u8*);
void sqlite3CryptFunc(sqlite3_context*,int,sqlite3_value**);

#endif /* SQLITE_USER_AUTHENTICATION */

/*
** typedef for the authorization callback function.
*/
#ifdef SQLITE_USER_AUTHENTICATION
  typedef int (*sqlite3_xauth)(void*,int,const char*,const char*,const char*,
                               const char*, const char*);
#else
  typedef int (*sqlite3_xauth)(void*,int,const char*,const char*,const char*,
                               const char*);
#endif


/*
** Each database connection is an instance of the following structure.
*/
struct sqlite3 {
  sqlite3_vfs *pVfs;            /* OS Interface */
  struct Vdbe *pVdbe;           /* List of active virtual machines */
................................................................................
  sqlite3_value *pErr;          /* Most recent error message */
  union {
    volatile int isInterrupted; /* True if sqlite3_interrupt has been called */
    double notUsed1;            /* Spacer */
  } u1;
  Lookaside lookaside;          /* Lookaside malloc configuration */
#ifndef SQLITE_OMIT_AUTHORIZATION

  sqlite3_xauth xAuth;          /* Access authorization function */
  void *pAuthArg;               /* 1st argument to the access auth function */
#endif
#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
  int (*xProgress)(void *);     /* The progress callback */
  void *pProgressArg;           /* Argument to the progress callback */
  unsigned nProgressOps;        /* Number of opcodes for progress callback */
#endif

static int auth_callback(
  void *pArg,
  int code,
  const char *zArg1,
  const char *zArg2,
  const char *zArg3,
  const char *zArg4



){
  const char *zCode;
  Tcl_DString str;
  int rc;
  const char *zReply;
  SqliteDb *pDb = (SqliteDb*)pArg;
  if( pDb->disableAuth ) return SQLITE_OK;
................................................................................
  Tcl_DStringInit(&str);
  Tcl_DStringAppend(&str, pDb->zAuth, -1);
  Tcl_DStringAppendElement(&str, zCode);
  Tcl_DStringAppendElement(&str, zArg1 ? zArg1 : "");
  Tcl_DStringAppendElement(&str, zArg2 ? zArg2 : "");
  Tcl_DStringAppendElement(&str, zArg3 ? zArg3 : "");
  Tcl_DStringAppendElement(&str, zArg4 ? zArg4 : "");



  rc = Tcl_GlobalEval(pDb->interp, Tcl_DStringValue(&str));
  Tcl_DStringFree(&str);
  zReply = rc==TCL_OK ? Tcl_GetStringResult(pDb->interp) : "SQLITE_DENY";
  if( strcmp(zReply,"SQLITE_OK")==0 ){
    rc = SQLITE_OK;
  }else if( strcmp(zReply,"SQLITE_DENY")==0 ){
    rc = SQLITE_DENY;
................................................................................
      if( zAuth && len>0 ){
        pDb->zAuth = Tcl_Alloc( len + 1 );
        memcpy(pDb->zAuth, zAuth, len+1);
      }else{
        pDb->zAuth = 0;
      }
      if( pDb->zAuth ){



        pDb->interp = interp;
        sqlite3_set_authorizer(pDb->db, auth_callback, pDb);
      }else{
        sqlite3_set_authorizer(pDb->db, 0, 0);
      }
    }
#endif
    break;
  }

static int auth_callback(
  void *pArg,
  int code,
  const char *zArg1,
  const char *zArg2,
  const char *zArg3,
  const char *zArg4
#ifdef SQLITE_USER_AUTHENTICATION
  ,const char *zArg5
#endif
){
  const char *zCode;
  Tcl_DString str;
  int rc;
  const char *zReply;
  SqliteDb *pDb = (SqliteDb*)pArg;
  if( pDb->disableAuth ) return SQLITE_OK;
................................................................................
  Tcl_DStringInit(&str);
  Tcl_DStringAppend(&str, pDb->zAuth, -1);
  Tcl_DStringAppendElement(&str, zCode);
  Tcl_DStringAppendElement(&str, zArg1 ? zArg1 : "");
  Tcl_DStringAppendElement(&str, zArg2 ? zArg2 : "");
  Tcl_DStringAppendElement(&str, zArg3 ? zArg3 : "");
  Tcl_DStringAppendElement(&str, zArg4 ? zArg4 : "");
#ifdef SQLITE_USER_AUTHENTICATION
  Tcl_DStringAppendElement(&str, zArg5 ? zArg5 : "");
#endif  
  rc = Tcl_GlobalEval(pDb->interp, Tcl_DStringValue(&str));
  Tcl_DStringFree(&str);
  zReply = rc==TCL_OK ? Tcl_GetStringResult(pDb->interp) : "SQLITE_DENY";
  if( strcmp(zReply,"SQLITE_OK")==0 ){
    rc = SQLITE_OK;
  }else if( strcmp(zReply,"SQLITE_DENY")==0 ){
    rc = SQLITE_DENY;
................................................................................
      if( zAuth && len>0 ){
        pDb->zAuth = Tcl_Alloc( len + 1 );
        memcpy(pDb->zAuth, zAuth, len+1);
      }else{
        pDb->zAuth = 0;
      }
      if( pDb->zAuth ){
        typedef int (*sqlite3_auth_cb)(
           void*,int,const char*,const char*,
           const char*,const char*);
        pDb->interp = interp;
        sqlite3_set_authorizer(pDb->db,(sqlite3_auth_cb)auth_callback,pDb);
      }else{
        sqlite3_set_authorizer(pDb->db, 0, 0);
      }
    }
#endif
    break;
  }

    db authorizer ::auth
  }
}

do_test auth-1.1.1 {
  db close
  set ::DB [sqlite3 db test.db]
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  db authorizer ::auth
  catchsql {CREATE TABLE t1(a,b,c)}
................................................................................
    SELECT x;
  }
} {1 {no such column: x}}
do_test auth-1.2 {
  execsql {SELECT name FROM sqlite_master}
} {}
do_test auth-1.3.1 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE TABLE t1(a,b,c)}
................................................................................
} {t1 {} main {}}
do_test auth-1.4 {
  execsql {SELECT name FROM sqlite_master}
} {}

ifcapable tempdb {
  do_test auth-1.5 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMP TABLE t1(a,b,c)}
  } {1 {not authorized}}
  do_test auth-1.6 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {}
  do_test auth-1.7.1 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_CREATE_TEMP_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMP TABLE t1(a,b,c)}
................................................................................
  } {t1 {} temp {}}
  do_test auth-1.8 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {}
}

do_test auth-1.9 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE TABLE t1(a,b,c)}
} {0 {}}
do_test auth-1.10 {
  execsql {SELECT name FROM sqlite_master}
} {}
do_test auth-1.11 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE TABLE t1(a,b,c)}
................................................................................
} {0 {}}
do_test auth-1.12 {
  execsql {SELECT name FROM sqlite_master}
} {}

ifcapable tempdb {
  do_test auth-1.13 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMP TABLE t1(a,b,c)}
  } {0 {}}
  do_test auth-1.14 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {}
  do_test auth-1.15 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_CREATE_TEMP_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMP TABLE t1(a,b,c)}
  } {0 {}}
  do_test auth-1.16 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {}
  
  do_test auth-1.17 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_CREATE_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMP TABLE t1(a,b,c)}
................................................................................
  do_test auth-1.18 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.19.1 {
  set ::authargs {}
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_TEMP_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE TABLE t2(a,b,c)}
................................................................................
  set ::authargs
} {}
do_test auth-1.20 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

do_test auth-1.21.1 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
................................................................................
do_test auth-1.21.2 {
  set ::authargs
} {t2 {} main {}}
do_test auth-1.22 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.23.1 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
................................................................................
} {t2 {} main {}}
do_test auth-1.24 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.25 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DROP_TEMP_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
  } {1 {not authorized}}
  do_test auth-1.26 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.27 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DROP_TEMP_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
................................................................................
  } {0 {}}
  do_test auth-1.28 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.29 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="t2"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {INSERT INTO t2 VALUES(1,2,3)}
} {1 {not authorized}}
do_test auth-1.30 {
  execsql {SELECT * FROM t2}
} {}
do_test auth-1.31 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="t2"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {INSERT INTO t2 VALUES(1,2,3)}
} {0 {}}
do_test auth-1.32 {
  execsql {SELECT * FROM t2}
} {}
do_test auth-1.33 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="t1"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {INSERT INTO t2 VALUES(1,2,3)}
} {0 {}}
do_test auth-1.34 {
  execsql {SELECT * FROM t2}
} {1 2 3}

do_test auth-1.35.1 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2}
} {1 {access to t2.b is prohibited}}
................................................................................
  do_test auth-1.35.2 {
    execsql {ATTACH DATABASE 'test.db' AS two}
    catchsql {SELECT * FROM two.t2}
  } {1 {access to two.t2.b is prohibited}}
  execsql {DETACH DATABASE two}
}
do_test auth-1.36 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2}
} {0 {1 {} 3}}
do_test auth-1.37 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2 WHERE b=2}
} {0 {}}
do_test auth-1.38 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="a"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2 WHERE b=2}
} {0 {{} 2 3}}
do_test auth-1.39 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2 WHERE b IS NULL}
} {0 {1 {} 3}}
do_test auth-1.40 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {SELECT a,c FROM t2 WHERE b IS NULL}
} {1 {access to t2.b is prohibited}}
  
do_test auth-1.41 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_UPDATE" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {UPDATE t2 SET a=11}
} {0 {}}
do_test auth-1.42 {
  execsql {SELECT * FROM t2}
} {11 2 3}
do_test auth-1.43 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_UPDATE" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {UPDATE t2 SET b=22, c=33}
} {1 {not authorized}}
do_test auth-1.44 {
  execsql {SELECT * FROM t2}
} {11 2 3}
do_test auth-1.45 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_UPDATE" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {UPDATE t2 SET b=22, c=33}
} {0 {}}
do_test auth-1.46 {
  execsql {SELECT * FROM t2}
} {11 2 33}

do_test auth-1.47 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="t2"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DELETE FROM t2 WHERE a=11}
} {1 {not authorized}}
do_test auth-1.48 {
  execsql {SELECT * FROM t2}
} {11 2 33}
do_test auth-1.49 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="t2"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DELETE FROM t2 WHERE a=11}
} {0 {}}
................................................................................
  execsql {SELECT * FROM t2}
} {}
do_test auth-1.50.2 {
  execsql {INSERT INTO t2 VALUES(11, 2, 33)}
} {}

do_test auth-1.51 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_SELECT"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2}
} {1 {not authorized}}
do_test auth-1.52 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_SELECT"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2}
} {0 {}}
do_test auth-1.53 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_SELECT"} {
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2}
} {0 {11 2 33}}
................................................................................
  execsql {INSERT INTO t2 VALUES(7, 8, 9);}
} {}
do_test auth-1.55 {
  execsql {SELECT * FROM t2}
} {11 2 33 7 8 9}

do_test auth-1.63 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
       return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
} {1 {not authorized}}
do_test auth-1.64 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.65 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="t2"} {
       return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
} {1 {not authorized}}
do_test auth-1.66 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.67 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
         return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
  } {1 {not authorized}}
  do_test auth-1.68 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.69 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DELETE" && $arg1=="t1"} {
         return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
  } {1 {not authorized}}
  do_test auth-1.70 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.71 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
       return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
} {0 {}}
do_test auth-1.72 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.73 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="t2"} {
       return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
} {0 {}}
do_test auth-1.74 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.75 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
         return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
  } {0 {}}
  do_test auth-1.76 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.77 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DELETE" && $arg1=="t1"} {
         return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
  } {0 {}}
................................................................................
  } {t1}
}

# Test cases auth-1.79 to auth-1.124 test creating and dropping views.
# Omit these if the library was compiled with views omitted.
ifcapable view {
do_test auth-1.79 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_VIEW"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4] 
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE VIEW v1 AS SELECT a+1,b+1 FROM t2}
................................................................................
do_test auth-1.80 {
  set ::authargs
} {v1 {} main {}}
do_test auth-1.81 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.82 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_VIEW"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4] 
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE VIEW v1 AS SELECT a+1,b+1 FROM t2}
................................................................................
} {v1 {} main {}}
do_test auth-1.84 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.85 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_CREATE_TEMP_VIEW"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4] 
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMPORARY VIEW v1 AS SELECT a+1,b+1 FROM t2}
................................................................................
  do_test auth-1.86 {
    set ::authargs
  } {v1 {} temp {}}
  do_test auth-1.87 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.88 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_CREATE_TEMP_VIEW"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4] 
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMPORARY VIEW v1 AS SELECT a+1,b+1 FROM t2}
................................................................................
  } {v1 {} temp {}}
  do_test auth-1.90 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.91 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE VIEW v1 AS SELECT a+1,b+1 FROM t2}
} {1 {not authorized}}
do_test auth-1.92 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.93 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE VIEW v1 AS SELECT a+1,b+1 FROM t2}
} {0 {}}
do_test auth-1.94 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.95 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMPORARY VIEW v1 AS SELECT a+1,b+1 FROM t2}
  } {1 {not authorized}}
  do_test auth-1.96 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.97 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMPORARY VIEW v1 AS SELECT a+1,b+1 FROM t2}
  } {0 {}}
  do_test auth-1.98 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.99 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
    CREATE VIEW v2 AS SELECT a+1,b+1 FROM t2;
................................................................................
    DROP VIEW v2
  }
} {1 {not authorized}}
do_test auth-1.100 {
  execsql {SELECT name FROM sqlite_master}
} {t2 v2}
do_test auth-1.101 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_VIEW"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP VIEW v2}
................................................................................
do_test auth-1.102 {
  set ::authargs
} {v2 {} main {}}
do_test auth-1.103 {
  execsql {SELECT name FROM sqlite_master}
} {t2 v2}
do_test auth-1.104 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP VIEW v2}
} {0 {}}
do_test auth-1.105 {
  execsql {SELECT name FROM sqlite_master}
} {t2 v2}
do_test auth-1.106 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_VIEW"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP VIEW v2}
................................................................................
do_test auth-1.107 {
  set ::authargs
} {v2 {} main {}}
do_test auth-1.108 {
  execsql {SELECT name FROM sqlite_master}
} {t2 v2}
do_test auth-1.109 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_VIEW"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {DROP VIEW v2}
................................................................................
do_test auth-1.111 {
  execsql {SELECT name FROM sqlite_master}
} {t2}


ifcapable tempdb {
  do_test auth-1.112 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {
      CREATE TEMP VIEW v1 AS SELECT a+1,b+1 FROM t1;
................................................................................
      DROP VIEW v1
    }
  } {1 {not authorized}}
  do_test auth-1.113 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 v1}
  do_test auth-1.114 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DROP_TEMP_VIEW"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP VIEW v1}
................................................................................
  do_test auth-1.115 {
    set ::authargs
  } {v1 {} temp {}}
  do_test auth-1.116 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 v1}
  do_test auth-1.117 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP VIEW v1}
  } {0 {}}
  do_test auth-1.118 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 v1}
  do_test auth-1.119 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DROP_TEMP_VIEW"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP VIEW v1}
................................................................................
  do_test auth-1.120 {
    set ::authargs
  } {v1 {} temp {}}
  do_test auth-1.121 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 v1}
  do_test auth-1.122 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DROP_TEMP_VIEW"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_OK
      }
      return SQLITE_OK
    }
    catchsql {DROP VIEW v1}
................................................................................
} ;# ifcapable view

# Test cases auth-1.125 to auth-1.176 test creating and dropping triggers.
# Omit these if the library was compiled with triggers omitted.
#
ifcapable trigger&&tempdb {
do_test auth-1.125 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.126 {
  set ::authargs
} {r2 t2 main {}}
do_test auth-1.127 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.128 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
    CREATE TRIGGER r2 DELETE on t2 BEGIN
................................................................................
    END;
  }
} {1 {not authorized}}
do_test auth-1.129 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.130 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.131 {
  set ::authargs
} {r2 t2 main {}}
do_test auth-1.132 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.133 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {
    CREATE TRIGGER r2 DELETE on t2 BEGIN
................................................................................
    END;
  }
} {0 {}}
do_test auth-1.134 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.135 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
} {r2 t2 main {}}
do_test auth-1.136.2 {
  execsql {
    SELECT name FROM sqlite_master WHERE type='trigger'
  }
} {r2}
do_test auth-1.136.3 {
  proc auth {code arg1 arg2 arg3 arg4} {
    lappend ::authargs $code $arg1 $arg2 $arg3 $arg4
    return SQLITE_OK
  }
  set ::authargs {}
  execsql {
    INSERT INTO t2 VALUES(1,2,3);
  }
................................................................................
    SELECT * FROM tx;
  }
} {3}
do_test auth-1.137 {
  execsql {SELECT name FROM sqlite_master}
} {t2 tx r2}
do_test auth-1.138 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.139 {
  set ::authargs
} {r1 t1 temp {}}
do_test auth-1.140 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1}
do_test auth-1.141 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
    CREATE TRIGGER r1 DELETE on t1 BEGIN
................................................................................
    END;
  }
} {1 {not authorized}}
do_test auth-1.142 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1}
do_test auth-1.143 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.144 {
  set ::authargs
} {r1 t1 temp {}}
do_test auth-1.145 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1}
do_test auth-1.146 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {
    CREATE TRIGGER r1 DELETE on t1 BEGIN
................................................................................
    END;
  }
} {0 {}}
do_test auth-1.147 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1}
do_test auth-1.148 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
  set ::authargs
} {r1 t1 temp {}}
do_test auth-1.150 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1 r1}

do_test auth-1.151 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r2}
} {1 {not authorized}}
do_test auth-1.152 {
  execsql {SELECT name FROM sqlite_master}
} {t2 tx r2}
do_test auth-1.153 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r2}
................................................................................
do_test auth-1.154 {
  set ::authargs
} {r2 t2 main {}}
do_test auth-1.155 {
  execsql {SELECT name FROM sqlite_master}
} {t2 tx r2}
do_test auth-1.156 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r2}
} {0 {}}
do_test auth-1.157 {
  execsql {SELECT name FROM sqlite_master}
} {t2 tx r2}
do_test auth-1.158 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r2}
................................................................................
do_test auth-1.159 {
  set ::authargs
} {r2 t2 main {}}
do_test auth-1.160 {
  execsql {SELECT name FROM sqlite_master}
} {t2 tx r2}
do_test auth-1.161 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r2}
................................................................................
    DROP TABLE tx;
    DELETE FROM t2 WHERE a=1 AND b=2 AND c=3;
    SELECT name FROM sqlite_master;
  }
} {t2}

do_test auth-1.164 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r1}
} {1 {not authorized}}
do_test auth-1.165 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1 r1}
do_test auth-1.166 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r1}
................................................................................
do_test auth-1.167 {
  set ::authargs
} {r1 t1 temp {}}
do_test auth-1.168 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1 r1}
do_test auth-1.169 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r1}
} {0 {}}
do_test auth-1.170 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1 r1}
do_test auth-1.171 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r1}
................................................................................
do_test auth-1.172 {
  set ::authargs
} {r1 t1 temp {}}
do_test auth-1.173 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1 r1}
do_test auth-1.174 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r1}
................................................................................
} {r1 t1 temp {}}
do_test auth-1.176 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1}
} ;# ifcapable trigger

do_test auth-1.177 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE INDEX i2 ON t2(a)}
................................................................................
do_test auth-1.178 {
  set ::authargs
} {i2 t2 main {}}
do_test auth-1.179 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.180 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE INDEX i2 ON t2(a)}
} {1 {not authorized}}
do_test auth-1.181 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.182 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE INDEX i2 ON t2(b)}
................................................................................
do_test auth-1.183 {
  set ::authargs
} {i2 t2 main {}}
do_test auth-1.184 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.185 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE INDEX i2 ON t2(b)}
} {0 {}}
do_test auth-1.186 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.187 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_CREATE_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {CREATE INDEX i2 ON t2(a)}
................................................................................
} {i2 t2 main {}}
do_test auth-1.189 {
  execsql {SELECT name FROM sqlite_master}
} {t2 i2}

ifcapable tempdb {
  do_test auth-1.190 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_CREATE_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE INDEX i1 ON t1(a)}
................................................................................
  do_test auth-1.191 {
    set ::authargs
  } {i1 t1 temp {}}
  do_test auth-1.192 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.193 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE INDEX i1 ON t1(b)}
  } {1 {not authorized}}
  do_test auth-1.194 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.195 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_CREATE_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE INDEX i1 ON t1(b)}
................................................................................
  do_test auth-1.196 {
    set ::authargs
  } {i1 t1 temp {}}
  do_test auth-1.197 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.198 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE INDEX i1 ON t1(c)}
  } {0 {}}
  do_test auth-1.199 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.200 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_CREATE_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_OK
      }
      return SQLITE_OK
    }
    catchsql {CREATE INDEX i1 ON t1(a)}
................................................................................
  } {i1 t1 temp {}}
  do_test auth-1.202 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 i1}
}

do_test auth-1.203 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP INDEX i2}
} {1 {not authorized}}
do_test auth-1.204 {
  execsql {SELECT name FROM sqlite_master}
} {t2 i2}
do_test auth-1.205 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP INDEX i2}
................................................................................
do_test auth-1.206 {
  set ::authargs
} {i2 t2 main {}}
do_test auth-1.207 {
  execsql {SELECT name FROM sqlite_master}
} {t2 i2}
do_test auth-1.208 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP INDEX i2}
} {0 {}}
do_test auth-1.209 {
  execsql {SELECT name FROM sqlite_master}
} {t2 i2}
do_test auth-1.210 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP INDEX i2}
................................................................................
do_test auth-1.211 {
  set ::authargs
} {i2 t2 main {}}
do_test auth-1.212 {
  execsql {SELECT name FROM sqlite_master}
} {t2 i2}
do_test auth-1.213 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_DROP_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {DROP INDEX i2}
................................................................................
} {i2 t2 main {}}
do_test auth-1.215 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.216 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP INDEX i1}
  } {1 {not authorized}}
  do_test auth-1.217 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 i1}
  do_test auth-1.218 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DROP_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP INDEX i1}
................................................................................
  do_test auth-1.219 {
    set ::authargs
  } {i1 t1 temp {}}
  do_test auth-1.220 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 i1}
  do_test auth-1.221 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP INDEX i1}
  } {0 {}}
  do_test auth-1.222 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 i1}
  do_test auth-1.223 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DROP_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP INDEX i1}
................................................................................
  do_test auth-1.224 {
    set ::authargs
  } {i1 t1 temp {}}
  do_test auth-1.225 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 i1}
  do_test auth-1.226 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DROP_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_OK
      }
      return SQLITE_OK
    }
    catchsql {DROP INDEX i1}
................................................................................
  } {i1 t1 temp {}}
  do_test auth-1.228 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.229 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_PRAGMA"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {PRAGMA full_column_names=on}
................................................................................
do_test auth-1.230 {
  set ::authargs
} {full_column_names on {} {}}
do_test auth-1.231 {
  execsql2 {SELECT a FROM t2}
} {a 11 a 7}
do_test auth-1.232 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_PRAGMA"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {PRAGMA full_column_names=on}
................................................................................
do_test auth-1.233 {
  set ::authargs
} {full_column_names on {} {}}
do_test auth-1.234 {
  execsql2 {SELECT a FROM t2}
} {a 11 a 7}
do_test auth-1.235 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_PRAGMA"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {PRAGMA full_column_names=on}
} {0 {}}
do_test auth-1.236 {
  execsql2 {SELECT a FROM t2}
} {t2.a 11 t2.a 7}
do_test auth-1.237 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_PRAGMA"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {PRAGMA full_column_names=OFF}
................................................................................
  set ::authargs
} {full_column_names OFF {} {}}
do_test auth-1.239 {
  execsql2 {SELECT a FROM t2}
} {a 11 a 7}

do_test auth-1.240 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_TRANSACTION"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {BEGIN}
} {1 {not authorized}}
do_test auth-1.241 {
  set ::authargs
} {BEGIN {} {} {}}
do_test auth-1.242 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_TRANSACTION" && $arg1!="BEGIN"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {BEGIN; INSERT INTO t2 VALUES(44,55,66); COMMIT}
................................................................................
} {11 2 33 7 8 9}

# ticket #340 - authorization for ATTACH and DETACH.
#
ifcapable attach {
  do_test auth-1.251 {
    db authorizer ::auth
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_ATTACH"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      }
      return SQLITE_OK
    }
    catchsql {
      ATTACH DATABASE ':memory:' AS test1
................................................................................
  do_test auth-1.252c {
    db eval {DETACH test1}
    db eval {ATTACH ':mem' || 'ory:' AS test1}
    set ::authargs
  } {{} {} {} {}}
  do_test auth-1.253 {
    catchsql {DETACH DATABASE test1}
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_ATTACH"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
    }
  } {1 {not authorized}}
  do_test auth-1.254 {
    lindex [execsql {PRAGMA database_list}] 7
  } {}
  do_test auth-1.255 {
    catchsql {DETACH DATABASE test1}
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_ATTACH"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
      ATTACH DATABASE ':memory:' AS test1;
    }
  } {0 {}}
  do_test auth-1.256 {
    lindex [execsql {PRAGMA database_list}] 7
  } {}
  do_test auth-1.257 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DETACH"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_OK
      }
      return SQLITE_OK
    }
    execsql {ATTACH DATABASE ':memory:' AS test1}
................................................................................
    }
  } {0 {}}
  do_test auth-1.258 {
    lindex [execsql {PRAGMA database_list}] 7
  } {}
  do_test auth-1.259 {
    execsql {ATTACH DATABASE ':memory:' AS test1}
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_DETACH"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
  ifcapable tempdb {
    ifcapable schema_pragmas {
    do_test auth-1.260 {
      lindex [execsql {PRAGMA database_list}] 7
    } {test1}
    } ;# ifcapable schema_pragmas
    do_test auth-1.261 {
      proc auth {code arg1 arg2 arg3 arg4} {
        if {$code=="SQLITE_DETACH"} {
          set ::authargs [list $arg1 $arg2 $arg3 $arg4]
          return SQLITE_DENY
        }
        return SQLITE_OK
      }
      catchsql {
................................................................................
    db authorizer ::auth
    
    # Authorization for ALTER TABLE. These tests are omitted if the library
    # was built without ALTER TABLE support.
    ifcapable altertable {
    
      do_test auth-1.263 {
        proc auth {code arg1 arg2 arg3 arg4} {
          if {$code=="SQLITE_ALTER_TABLE"} {
            set ::authargs [list $arg1 $arg2 $arg3 $arg4]
            return SQLITE_OK
          }
          return SQLITE_OK
        }
        catchsql {
................................................................................
      do_test auth-1.264 {
        execsql {SELECT name FROM sqlite_temp_master WHERE type='table'}
      } {t1x}
      do_test auth-1.265 {
        set authargs
      } {temp t1 {} {}}
      do_test auth-1.266 {
        proc auth {code arg1 arg2 arg3 arg4} {
          if {$code=="SQLITE_ALTER_TABLE"} {
            set ::authargs [list $arg1 $arg2 $arg3 $arg4]
            return SQLITE_IGNORE
          }
          return SQLITE_OK
        }
        catchsql {
................................................................................
      do_test auth-1.267 {
        execsql {SELECT name FROM sqlite_temp_master WHERE type='table'}
      } {t1x}
      do_test auth-1.268 {
        set authargs
      } {temp t1x {} {}}
      do_test auth-1.269 {
        proc auth {code arg1 arg2 arg3 arg4} {
          if {$code=="SQLITE_ALTER_TABLE"} {
            set ::authargs [list $arg1 $arg2 $arg3 $arg4]
            return SQLITE_DENY
          }
          return SQLITE_OK
        }
        catchsql {
................................................................................
}

ifcapable  altertable {
db authorizer {}
catchsql {ALTER TABLE t1x RENAME TO t1}
db authorizer ::auth
do_test auth-1.272 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_ALTER_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.273 {
  execsql {SELECT name FROM sqlite_master WHERE type='table'}
} {t2x}
do_test auth-1.274 {
  set authargs
} {main t2 {} {}}
do_test auth-1.275 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_ALTER_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.276 {
  execsql {SELECT name FROM sqlite_master WHERE type='table'}
} {t2x}
do_test auth-1.277 {
  set authargs
} {main t2x {} {}}
do_test auth-1.278 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_ALTER_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
} ;# ifcapable altertable

# Test the authorization callbacks for the REINDEX command.
ifcapable reindex {

proc auth {code args} {
  if {$code=="SQLITE_REINDEX"} {
    set ::authargs [concat $::authargs $args]
  }
  return SQLITE_OK
}
db authorizer auth
do_test auth-1.281 {
  execsql {
    CREATE TABLE t3(a PRIMARY KEY, b, c);
................................................................................
    execsql {
      REINDEX temp.t3;
    }
    set ::authargs
  } {t3_idx2 {} temp {} t3_idx1 {} temp {} sqlite_autoindex_t3_1 {} temp {}}
  proc auth {code args} {
    if {$code=="SQLITE_REINDEX"} {
      set ::authargs [concat $::authargs $args]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  do_test auth-1.292 {
    set ::authargs {}
    catchsql {
................................................................................
}

} ;# ifcapable reindex 

ifcapable analyze {
  proc auth {code args} {
    if {$code=="SQLITE_ANALYZE"} {
      set ::authargs [concat $::authargs $args]
    }
    return SQLITE_OK
  }
  do_test auth-1.294 {
    set ::authargs {}
    execsql {
      CREATE TABLE t4(a,b,c);
................................................................................

# Authorization for ALTER TABLE ADD COLUMN.
# These tests are omitted if the library
# was built without ALTER TABLE support.
ifcapable {altertable} {
  do_test auth-1.300 {
    execsql {CREATE TABLE t5(x)}
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_ALTER_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_OK
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
    set x [execsql {SELECT sql FROM sqlite_master WHERE name='t5'}]
    regexp new_col_1 $x
  } {1}
  do_test auth-1.302 {
    set authargs
  } {main t5 {} {}}
  do_test auth-1.303 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_ALTER_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
    set x [execsql {SELECT sql FROM sqlite_master WHERE name='t5'}]
    regexp new_col_2 $x
  } {0}
  do_test auth-1.305 {
    set authargs
  } {main t5 {} {}}
  do_test auth-1.306 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_ALTER_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
    set authargs
  } {main t5 {} {}}
  execsql {DROP TABLE t5}
} ;# ifcapable altertable

ifcapable {cte} {
  do_test auth-1.310 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_RECURSIVE"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    db eval {
       DROP TABLE IF EXISTS t1;
................................................................................
    WITH RECURSIVE
       auth1314(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM auth1314 WHERE x<5)
    SELECT * FROM t1 LEFT JOIN auth1314;
  } {1 {not authorized}}
} ;# ifcapable cte

do_test auth-2.1 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t3" && $arg2=="x"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  db authorizer ::auth
  execsql {CREATE TABLE t3(x INTEGER PRIMARY KEY, y, z)}
................................................................................
do_test auth-2.2 {
  catchsql {SELECT ROWID,y,z FROM t3}
} {1 {access to t3.x is prohibited}}
do_test auth-2.3 {
  catchsql {SELECT OID,y,z FROM t3}
} {1 {access to t3.x is prohibited}}
do_test auth-2.4 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t3" && $arg2=="x"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  execsql {INSERT INTO t3 VALUES(44,55,66)}
  catchsql {SELECT * FROM t3}
} {0 {{} 55 66}}
do_test auth-2.5 {
  catchsql {SELECT rowid,y,z FROM t3}
} {0 {{} 55 66}}
do_test auth-2.6 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t3" && $arg2=="ROWID"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t3}
} {0 {44 55 66}}
do_test auth-2.7 {
  catchsql {SELECT ROWID,y,z FROM t3}
} {0 {44 55 66}}
do_test auth-2.8 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="ROWID"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT ROWID,b,c FROM t2}
} {0 {{} 2 33 {} 8 9}}
................................................................................
  # trying to recompile the statement, the authorization error is encountered.
  # If we do not flush the cache, the correct error message is returned, but
  # the error code is SQLITE_SCHEMA, not SQLITE_ERROR as required by the test
  # case after this one.
  #
  db cache flush

  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="ROWID"} {
      return bogus
    }
    return SQLITE_OK
  }
  catchsql {SELECT ROWID,b,c FROM t2}
} {1 {authorizer malfunction}}
do_test auth-2.9.2 {
  db errorcode
} {1}
do_test auth-2.10 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_SELECT"} {
      return bogus
    }
    return SQLITE_OK
  }
  catchsql {SELECT ROWID,b,c FROM t2}
} {1 {authorizer malfunction}}
do_test auth-2.11.1 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg2=="a"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2, t3}
} {0 {{} 2 33 44 55 66 {} 8 9 44 55 66}}
do_test auth-2.11.2 {
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_READ" && $arg2=="x"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2, t3}
} {0 {11 2 33 {} 55 66 7 8 9 {} 55 66}}

# Make sure the OLD and NEW pseudo-tables of a trigger get authorized.
#
ifcapable trigger {
  do_test auth-3.1 {
    proc auth {code arg1 arg2 arg3 arg4} {
      return SQLITE_OK
    }
    execsql {
      CREATE TABLE tx(a1,a2,b1,b2,c1,c2);
      CREATE TRIGGER r1 AFTER UPDATE ON t2 FOR EACH ROW BEGIN
        INSERT INTO tx VALUES(OLD.a,NEW.a,OLD.b,NEW.b,OLD.c,NEW.c);
      END;
      UPDATE t2 SET a=a+1;
      SELECT * FROM tx;
    }
  } {11 12 2 2 33 33 7 8 8 8 9 9}
  do_test auth-3.2 {
    proc auth {code arg1 arg2 arg3 arg4} {
      if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="c"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    execsql {
      DELETE FROM tx;
................................................................................
  } {12 112 2 2 {} {} 8 108 8 8 {} {}}
} ;# ifcapable trigger

# Make sure the names of views and triggers are passed on on arg4.
#
ifcapable trigger {
do_test auth-4.1 {
  proc auth {code arg1 arg2 arg3 arg4} {
    lappend ::authargs $code $arg1 $arg2 $arg3 $arg4
    return SQLITE_OK
  }
  set authargs {}
  execsql {
    UPDATE t2 SET a=a+1;
  }
................................................................................

} ;# ifcapable view && trigger

# Ticket #1338:  Make sure authentication works in the presence of an AS
# clause.
#
do_test auth-5.1 {
  proc auth {code arg1 arg2 arg3 arg4} {
    return SQLITE_OK
  }
  execsql {
    SELECT count(a) AS cnt FROM t4 ORDER BY cnt
  }
} {1}

................................................................................
      CREATE TRIGGER t5_tr1 AFTER INSERT ON t5 BEGIN 
        UPDATE t5 SET x = 1 WHERE NEW.x = 0;
      END;
    }
  } {}
  set ::authargs [list]
  proc auth {args} {
    eval lappend ::authargs $args
    return SQLITE_OK
  }
  do_test auth-5.3.2 {
    execsql { INSERT INTO t5 (x) values(0) }
    set ::authargs
  } [list SQLITE_INSERT t5 {} main {}    \
          SQLITE_UPDATE t5 x main t5_tr1 \
................................................................................
  execsql {
    CREATE TABLE t6(a,b,c,d,e,f,g,h);
    INSERT INTO t6 VALUES(1,2,3,4,5,6,7,8);
  }
} {}
set ::authargs [list]
proc auth {args} {
  eval lappend ::authargs $args
  return SQLITE_OK
}
do_test auth-6.2 {
  execsql {UPDATE t6 SET rowID=rowID+100}
  set ::authargs
} [list SQLITE_READ   t6 ROWID main {} \
        SQLITE_UPDATE t6 ROWID main {} \

    db authorizer ::auth
  }
}

do_test auth-1.1.1 {
  db close
  set ::DB [sqlite3 db test.db]
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  db authorizer ::auth
  catchsql {CREATE TABLE t1(a,b,c)}
................................................................................
    SELECT x;
  }
} {1 {no such column: x}}
do_test auth-1.2 {
  execsql {SELECT name FROM sqlite_master}
} {}
do_test auth-1.3.1 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE TABLE t1(a,b,c)}
................................................................................
} {t1 {} main {}}
do_test auth-1.4 {
  execsql {SELECT name FROM sqlite_master}
} {}

ifcapable tempdb {
  do_test auth-1.5 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMP TABLE t1(a,b,c)}
  } {1 {not authorized}}
  do_test auth-1.6 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {}
  do_test auth-1.7.1 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_CREATE_TEMP_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMP TABLE t1(a,b,c)}
................................................................................
  } {t1 {} temp {}}
  do_test auth-1.8 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {}
}

do_test auth-1.9 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE TABLE t1(a,b,c)}
} {0 {}}
do_test auth-1.10 {
  execsql {SELECT name FROM sqlite_master}
} {}
do_test auth-1.11 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE TABLE t1(a,b,c)}
................................................................................
} {0 {}}
do_test auth-1.12 {
  execsql {SELECT name FROM sqlite_master}
} {}

ifcapable tempdb {
  do_test auth-1.13 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMP TABLE t1(a,b,c)}
  } {0 {}}
  do_test auth-1.14 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {}
  do_test auth-1.15 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_CREATE_TEMP_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMP TABLE t1(a,b,c)}
  } {0 {}}
  do_test auth-1.16 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {}
  
  do_test auth-1.17 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_CREATE_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMP TABLE t1(a,b,c)}
................................................................................
  do_test auth-1.18 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.19.1 {
  set ::authargs {}
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_TEMP_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE TABLE t2(a,b,c)}
................................................................................
  set ::authargs
} {}
do_test auth-1.20 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

do_test auth-1.21.1 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
................................................................................
do_test auth-1.21.2 {
  set ::authargs
} {t2 {} main {}}
do_test auth-1.22 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.23.1 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
................................................................................
} {t2 {} main {}}
do_test auth-1.24 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.25 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DROP_TEMP_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
  } {1 {not authorized}}
  do_test auth-1.26 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.27 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DROP_TEMP_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
................................................................................
  } {0 {}}
  do_test auth-1.28 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.29 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="t2"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {INSERT INTO t2 VALUES(1,2,3)}
} {1 {not authorized}}
do_test auth-1.30 {
  execsql {SELECT * FROM t2}
} {}
do_test auth-1.31 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="t2"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {INSERT INTO t2 VALUES(1,2,3)}
} {0 {}}
do_test auth-1.32 {
  execsql {SELECT * FROM t2}
} {}
do_test auth-1.33 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="t1"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {INSERT INTO t2 VALUES(1,2,3)}
} {0 {}}
do_test auth-1.34 {
  execsql {SELECT * FROM t2}
} {1 2 3}

do_test auth-1.35.1 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2}
} {1 {access to t2.b is prohibited}}
................................................................................
  do_test auth-1.35.2 {
    execsql {ATTACH DATABASE 'test.db' AS two}
    catchsql {SELECT * FROM two.t2}
  } {1 {access to two.t2.b is prohibited}}
  execsql {DETACH DATABASE two}
}
do_test auth-1.36 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2}
} {0 {1 {} 3}}
do_test auth-1.37 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2 WHERE b=2}
} {0 {}}
do_test auth-1.38 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="a"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2 WHERE b=2}
} {0 {{} 2 3}}
do_test auth-1.39 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2 WHERE b IS NULL}
} {0 {1 {} 3}}
do_test auth-1.40 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {SELECT a,c FROM t2 WHERE b IS NULL}
} {1 {access to t2.b is prohibited}}
  
do_test auth-1.41 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_UPDATE" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {UPDATE t2 SET a=11}
} {0 {}}
do_test auth-1.42 {
  execsql {SELECT * FROM t2}
} {11 2 3}
do_test auth-1.43 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_UPDATE" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {UPDATE t2 SET b=22, c=33}
} {1 {not authorized}}
do_test auth-1.44 {
  execsql {SELECT * FROM t2}
} {11 2 3}
do_test auth-1.45 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_UPDATE" && $arg1=="t2" && $arg2=="b"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {UPDATE t2 SET b=22, c=33}
} {0 {}}
do_test auth-1.46 {
  execsql {SELECT * FROM t2}
} {11 2 33}

do_test auth-1.47 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="t2"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DELETE FROM t2 WHERE a=11}
} {1 {not authorized}}
do_test auth-1.48 {
  execsql {SELECT * FROM t2}
} {11 2 33}
do_test auth-1.49 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="t2"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DELETE FROM t2 WHERE a=11}
} {0 {}}
................................................................................
  execsql {SELECT * FROM t2}
} {}
do_test auth-1.50.2 {
  execsql {INSERT INTO t2 VALUES(11, 2, 33)}
} {}

do_test auth-1.51 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_SELECT"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2}
} {1 {not authorized}}
do_test auth-1.52 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_SELECT"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2}
} {0 {}}
do_test auth-1.53 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_SELECT"} {
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2}
} {0 {11 2 33}}
................................................................................
  execsql {INSERT INTO t2 VALUES(7, 8, 9);}
} {}
do_test auth-1.55 {
  execsql {SELECT * FROM t2}
} {11 2 33 7 8 9}

do_test auth-1.63 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
       return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
} {1 {not authorized}}
do_test auth-1.64 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.65 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="t2"} {
       return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
} {1 {not authorized}}
do_test auth-1.66 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.67 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
         return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
  } {1 {not authorized}}
  do_test auth-1.68 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.69 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DELETE" && $arg1=="t1"} {
         return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
  } {1 {not authorized}}
  do_test auth-1.70 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.71 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
       return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
} {0 {}}
do_test auth-1.72 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.73 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="t2"} {
       return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TABLE t2}
} {0 {}}
do_test auth-1.74 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.75 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
         return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
  } {0 {}}
  do_test auth-1.76 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.77 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DELETE" && $arg1=="t1"} {
         return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP TABLE t1}
  } {0 {}}
................................................................................
  } {t1}
}

# Test cases auth-1.79 to auth-1.124 test creating and dropping views.
# Omit these if the library was compiled with views omitted.
ifcapable view {
do_test auth-1.79 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_VIEW"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4] 
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE VIEW v1 AS SELECT a+1,b+1 FROM t2}
................................................................................
do_test auth-1.80 {
  set ::authargs
} {v1 {} main {}}
do_test auth-1.81 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.82 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_VIEW"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4] 
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE VIEW v1 AS SELECT a+1,b+1 FROM t2}
................................................................................
} {v1 {} main {}}
do_test auth-1.84 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.85 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_CREATE_TEMP_VIEW"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4] 
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMPORARY VIEW v1 AS SELECT a+1,b+1 FROM t2}
................................................................................
  do_test auth-1.86 {
    set ::authargs
  } {v1 {} temp {}}
  do_test auth-1.87 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.88 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_CREATE_TEMP_VIEW"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4] 
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMPORARY VIEW v1 AS SELECT a+1,b+1 FROM t2}
................................................................................
  } {v1 {} temp {}}
  do_test auth-1.90 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.91 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE VIEW v1 AS SELECT a+1,b+1 FROM t2}
} {1 {not authorized}}
do_test auth-1.92 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.93 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE VIEW v1 AS SELECT a+1,b+1 FROM t2}
} {0 {}}
do_test auth-1.94 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.95 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMPORARY VIEW v1 AS SELECT a+1,b+1 FROM t2}
  } {1 {not authorized}}
  do_test auth-1.96 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.97 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE TEMPORARY VIEW v1 AS SELECT a+1,b+1 FROM t2}
  } {0 {}}
  do_test auth-1.98 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.99 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
    CREATE VIEW v2 AS SELECT a+1,b+1 FROM t2;
................................................................................
    DROP VIEW v2
  }
} {1 {not authorized}}
do_test auth-1.100 {
  execsql {SELECT name FROM sqlite_master}
} {t2 v2}
do_test auth-1.101 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_VIEW"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP VIEW v2}
................................................................................
do_test auth-1.102 {
  set ::authargs
} {v2 {} main {}}
do_test auth-1.103 {
  execsql {SELECT name FROM sqlite_master}
} {t2 v2}
do_test auth-1.104 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP VIEW v2}
} {0 {}}
do_test auth-1.105 {
  execsql {SELECT name FROM sqlite_master}
} {t2 v2}
do_test auth-1.106 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_VIEW"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP VIEW v2}
................................................................................
do_test auth-1.107 {
  set ::authargs
} {v2 {} main {}}
do_test auth-1.108 {
  execsql {SELECT name FROM sqlite_master}
} {t2 v2}
do_test auth-1.109 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_VIEW"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {DROP VIEW v2}
................................................................................
do_test auth-1.111 {
  execsql {SELECT name FROM sqlite_master}
} {t2}


ifcapable tempdb {
  do_test auth-1.112 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {
      CREATE TEMP VIEW v1 AS SELECT a+1,b+1 FROM t1;
................................................................................
      DROP VIEW v1
    }
  } {1 {not authorized}}
  do_test auth-1.113 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 v1}
  do_test auth-1.114 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DROP_TEMP_VIEW"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP VIEW v1}
................................................................................
  do_test auth-1.115 {
    set ::authargs
  } {v1 {} temp {}}
  do_test auth-1.116 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 v1}
  do_test auth-1.117 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP VIEW v1}
  } {0 {}}
  do_test auth-1.118 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 v1}
  do_test auth-1.119 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DROP_TEMP_VIEW"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP VIEW v1}
................................................................................
  do_test auth-1.120 {
    set ::authargs
  } {v1 {} temp {}}
  do_test auth-1.121 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 v1}
  do_test auth-1.122 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DROP_TEMP_VIEW"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_OK
      }
      return SQLITE_OK
    }
    catchsql {DROP VIEW v1}
................................................................................
} ;# ifcapable view

# Test cases auth-1.125 to auth-1.176 test creating and dropping triggers.
# Omit these if the library was compiled with triggers omitted.
#
ifcapable trigger&&tempdb {
do_test auth-1.125 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.126 {
  set ::authargs
} {r2 t2 main {}}
do_test auth-1.127 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.128 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
    CREATE TRIGGER r2 DELETE on t2 BEGIN
................................................................................
    END;
  }
} {1 {not authorized}}
do_test auth-1.129 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.130 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.131 {
  set ::authargs
} {r2 t2 main {}}
do_test auth-1.132 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.133 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {
    CREATE TRIGGER r2 DELETE on t2 BEGIN
................................................................................
    END;
  }
} {0 {}}
do_test auth-1.134 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.135 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
} {r2 t2 main {}}
do_test auth-1.136.2 {
  execsql {
    SELECT name FROM sqlite_master WHERE type='trigger'
  }
} {r2}
do_test auth-1.136.3 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    lappend ::authargs $code $arg1 $arg2 $arg3 $arg4
    return SQLITE_OK
  }
  set ::authargs {}
  execsql {
    INSERT INTO t2 VALUES(1,2,3);
  }
................................................................................
    SELECT * FROM tx;
  }
} {3}
do_test auth-1.137 {
  execsql {SELECT name FROM sqlite_master}
} {t2 tx r2}
do_test auth-1.138 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.139 {
  set ::authargs
} {r1 t1 temp {}}
do_test auth-1.140 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1}
do_test auth-1.141 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
    CREATE TRIGGER r1 DELETE on t1 BEGIN
................................................................................
    END;
  }
} {1 {not authorized}}
do_test auth-1.142 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1}
do_test auth-1.143 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.144 {
  set ::authargs
} {r1 t1 temp {}}
do_test auth-1.145 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1}
do_test auth-1.146 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {
    CREATE TRIGGER r1 DELETE on t1 BEGIN
................................................................................
    END;
  }
} {0 {}}
do_test auth-1.147 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1}
do_test auth-1.148 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
  set ::authargs
} {r1 t1 temp {}}
do_test auth-1.150 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1 r1}

do_test auth-1.151 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r2}
} {1 {not authorized}}
do_test auth-1.152 {
  execsql {SELECT name FROM sqlite_master}
} {t2 tx r2}
do_test auth-1.153 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r2}
................................................................................
do_test auth-1.154 {
  set ::authargs
} {r2 t2 main {}}
do_test auth-1.155 {
  execsql {SELECT name FROM sqlite_master}
} {t2 tx r2}
do_test auth-1.156 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r2}
} {0 {}}
do_test auth-1.157 {
  execsql {SELECT name FROM sqlite_master}
} {t2 tx r2}
do_test auth-1.158 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r2}
................................................................................
do_test auth-1.159 {
  set ::authargs
} {r2 t2 main {}}
do_test auth-1.160 {
  execsql {SELECT name FROM sqlite_master}
} {t2 tx r2}
do_test auth-1.161 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r2}
................................................................................
    DROP TABLE tx;
    DELETE FROM t2 WHERE a=1 AND b=2 AND c=3;
    SELECT name FROM sqlite_master;
  }
} {t2}

do_test auth-1.164 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r1}
} {1 {not authorized}}
do_test auth-1.165 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1 r1}
do_test auth-1.166 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r1}
................................................................................
do_test auth-1.167 {
  set ::authargs
} {r1 t1 temp {}}
do_test auth-1.168 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1 r1}
do_test auth-1.169 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r1}
} {0 {}}
do_test auth-1.170 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1 r1}
do_test auth-1.171 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r1}
................................................................................
do_test auth-1.172 {
  set ::authargs
} {r1 t1 temp {}}
do_test auth-1.173 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1 r1}
do_test auth-1.174 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_TEMP_TRIGGER"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {DROP TRIGGER r1}
................................................................................
} {r1 t1 temp {}}
do_test auth-1.176 {
  execsql {SELECT name FROM sqlite_temp_master}
} {t1}
} ;# ifcapable trigger

do_test auth-1.177 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE INDEX i2 ON t2(a)}
................................................................................
do_test auth-1.178 {
  set ::authargs
} {i2 t2 main {}}
do_test auth-1.179 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.180 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {CREATE INDEX i2 ON t2(a)}
} {1 {not authorized}}
do_test auth-1.181 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.182 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE INDEX i2 ON t2(b)}
................................................................................
do_test auth-1.183 {
  set ::authargs
} {i2 t2 main {}}
do_test auth-1.184 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.185 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_INSERT" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {CREATE INDEX i2 ON t2(b)}
} {0 {}}
do_test auth-1.186 {
  execsql {SELECT name FROM sqlite_master}
} {t2}
do_test auth-1.187 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_CREATE_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {CREATE INDEX i2 ON t2(a)}
................................................................................
} {i2 t2 main {}}
do_test auth-1.189 {
  execsql {SELECT name FROM sqlite_master}
} {t2 i2}

ifcapable tempdb {
  do_test auth-1.190 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_CREATE_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE INDEX i1 ON t1(a)}
................................................................................
  do_test auth-1.191 {
    set ::authargs
  } {i1 t1 temp {}}
  do_test auth-1.192 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.193 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {CREATE INDEX i1 ON t1(b)}
  } {1 {not authorized}}
  do_test auth-1.194 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.195 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_CREATE_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE INDEX i1 ON t1(b)}
................................................................................
  do_test auth-1.196 {
    set ::authargs
  } {i1 t1 temp {}}
  do_test auth-1.197 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.198 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_INSERT" && $arg1=="sqlite_temp_master"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {CREATE INDEX i1 ON t1(c)}
  } {0 {}}
  do_test auth-1.199 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
  do_test auth-1.200 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_CREATE_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_OK
      }
      return SQLITE_OK
    }
    catchsql {CREATE INDEX i1 ON t1(a)}
................................................................................
  } {i1 t1 temp {}}
  do_test auth-1.202 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 i1}
}

do_test auth-1.203 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP INDEX i2}
} {1 {not authorized}}
do_test auth-1.204 {
  execsql {SELECT name FROM sqlite_master}
} {t2 i2}
do_test auth-1.205 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {DROP INDEX i2}
................................................................................
do_test auth-1.206 {
  set ::authargs
} {i2 t2 main {}}
do_test auth-1.207 {
  execsql {SELECT name FROM sqlite_master}
} {t2 i2}
do_test auth-1.208 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DELETE" && $arg1=="sqlite_master"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP INDEX i2}
} {0 {}}
do_test auth-1.209 {
  execsql {SELECT name FROM sqlite_master}
} {t2 i2}
do_test auth-1.210 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {DROP INDEX i2}
................................................................................
do_test auth-1.211 {
  set ::authargs
} {i2 t2 main {}}
do_test auth-1.212 {
  execsql {SELECT name FROM sqlite_master}
} {t2 i2}
do_test auth-1.213 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_DROP_INDEX"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {DROP INDEX i2}
................................................................................
} {i2 t2 main {}}
do_test auth-1.215 {
  execsql {SELECT name FROM sqlite_master}
} {t2}

ifcapable tempdb {
  do_test auth-1.216 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP INDEX i1}
  } {1 {not authorized}}
  do_test auth-1.217 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 i1}
  do_test auth-1.218 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DROP_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {DROP INDEX i1}
................................................................................
  do_test auth-1.219 {
    set ::authargs
  } {i1 t1 temp {}}
  do_test auth-1.220 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 i1}
  do_test auth-1.221 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DELETE" && $arg1=="sqlite_temp_master"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP INDEX i1}
  } {0 {}}
  do_test auth-1.222 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 i1}
  do_test auth-1.223 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DROP_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {DROP INDEX i1}
................................................................................
  do_test auth-1.224 {
    set ::authargs
  } {i1 t1 temp {}}
  do_test auth-1.225 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1 i1}
  do_test auth-1.226 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DROP_TEMP_INDEX"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_OK
      }
      return SQLITE_OK
    }
    catchsql {DROP INDEX i1}
................................................................................
  } {i1 t1 temp {}}
  do_test auth-1.228 {
    execsql {SELECT name FROM sqlite_temp_master}
  } {t1}
}

do_test auth-1.229 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_PRAGMA"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {PRAGMA full_column_names=on}
................................................................................
do_test auth-1.230 {
  set ::authargs
} {full_column_names on {} {}}
do_test auth-1.231 {
  execsql2 {SELECT a FROM t2}
} {a 11 a 7}
do_test auth-1.232 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_PRAGMA"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {PRAGMA full_column_names=on}
................................................................................
do_test auth-1.233 {
  set ::authargs
} {full_column_names on {} {}}
do_test auth-1.234 {
  execsql2 {SELECT a FROM t2}
} {a 11 a 7}
do_test auth-1.235 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_PRAGMA"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {PRAGMA full_column_names=on}
} {0 {}}
do_test auth-1.236 {
  execsql2 {SELECT a FROM t2}
} {t2.a 11 t2.a 7}
do_test auth-1.237 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_PRAGMA"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {PRAGMA full_column_names=OFF}
................................................................................
  set ::authargs
} {full_column_names OFF {} {}}
do_test auth-1.239 {
  execsql2 {SELECT a FROM t2}
} {a 11 a 7}

do_test auth-1.240 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_TRANSACTION"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {BEGIN}
} {1 {not authorized}}
do_test auth-1.241 {
  set ::authargs
} {BEGIN {} {} {}}
do_test auth-1.242 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_TRANSACTION" && $arg1!="BEGIN"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {BEGIN; INSERT INTO t2 VALUES(44,55,66); COMMIT}
................................................................................
} {11 2 33 7 8 9}

# ticket #340 - authorization for ATTACH and DETACH.
#
ifcapable attach {
  do_test auth-1.251 {
    db authorizer ::auth
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_ATTACH"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      }
      return SQLITE_OK
    }
    catchsql {
      ATTACH DATABASE ':memory:' AS test1
................................................................................
  do_test auth-1.252c {
    db eval {DETACH test1}
    db eval {ATTACH ':mem' || 'ory:' AS test1}
    set ::authargs
  } {{} {} {} {}}
  do_test auth-1.253 {
    catchsql {DETACH DATABASE test1}
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_ATTACH"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
    }
  } {1 {not authorized}}
  do_test auth-1.254 {
    lindex [execsql {PRAGMA database_list}] 7
  } {}
  do_test auth-1.255 {
    catchsql {DETACH DATABASE test1}
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_ATTACH"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
      ATTACH DATABASE ':memory:' AS test1;
    }
  } {0 {}}
  do_test auth-1.256 {
    lindex [execsql {PRAGMA database_list}] 7
  } {}
  do_test auth-1.257 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DETACH"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_OK
      }
      return SQLITE_OK
    }
    execsql {ATTACH DATABASE ':memory:' AS test1}
................................................................................
    }
  } {0 {}}
  do_test auth-1.258 {
    lindex [execsql {PRAGMA database_list}] 7
  } {}
  do_test auth-1.259 {
    execsql {ATTACH DATABASE ':memory:' AS test1}
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_DETACH"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
  ifcapable tempdb {
    ifcapable schema_pragmas {
    do_test auth-1.260 {
      lindex [execsql {PRAGMA database_list}] 7
    } {test1}
    } ;# ifcapable schema_pragmas
    do_test auth-1.261 {
      proc auth {code arg1 arg2 arg3 arg4 args} {
        if {$code=="SQLITE_DETACH"} {
          set ::authargs [list $arg1 $arg2 $arg3 $arg4]
          return SQLITE_DENY
        }
        return SQLITE_OK
      }
      catchsql {
................................................................................
    db authorizer ::auth
    
    # Authorization for ALTER TABLE. These tests are omitted if the library
    # was built without ALTER TABLE support.
    ifcapable altertable {
    
      do_test auth-1.263 {
        proc auth {code arg1 arg2 arg3 arg4 args} {
          if {$code=="SQLITE_ALTER_TABLE"} {
            set ::authargs [list $arg1 $arg2 $arg3 $arg4]
            return SQLITE_OK
          }
          return SQLITE_OK
        }
        catchsql {
................................................................................
      do_test auth-1.264 {
        execsql {SELECT name FROM sqlite_temp_master WHERE type='table'}
      } {t1x}
      do_test auth-1.265 {
        set authargs
      } {temp t1 {} {}}
      do_test auth-1.266 {
        proc auth {code arg1 arg2 arg3 arg4 args} {
          if {$code=="SQLITE_ALTER_TABLE"} {
            set ::authargs [list $arg1 $arg2 $arg3 $arg4]
            return SQLITE_IGNORE
          }
          return SQLITE_OK
        }
        catchsql {
................................................................................
      do_test auth-1.267 {
        execsql {SELECT name FROM sqlite_temp_master WHERE type='table'}
      } {t1x}
      do_test auth-1.268 {
        set authargs
      } {temp t1x {} {}}
      do_test auth-1.269 {
        proc auth {code arg1 arg2 arg3 arg4 args} {
          if {$code=="SQLITE_ALTER_TABLE"} {
            set ::authargs [list $arg1 $arg2 $arg3 $arg4]
            return SQLITE_DENY
          }
          return SQLITE_OK
        }
        catchsql {
................................................................................
}

ifcapable  altertable {
db authorizer {}
catchsql {ALTER TABLE t1x RENAME TO t1}
db authorizer ::auth
do_test auth-1.272 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_ALTER_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_OK
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.273 {
  execsql {SELECT name FROM sqlite_master WHERE type='table'}
} {t2x}
do_test auth-1.274 {
  set authargs
} {main t2 {} {}}
do_test auth-1.275 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_ALTER_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
do_test auth-1.276 {
  execsql {SELECT name FROM sqlite_master WHERE type='table'}
} {t2x}
do_test auth-1.277 {
  set authargs
} {main t2x {} {}}
do_test auth-1.278 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_ALTER_TABLE"} {
      set ::authargs [list $arg1 $arg2 $arg3 $arg4]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  catchsql {
................................................................................
} ;# ifcapable altertable

# Test the authorization callbacks for the REINDEX command.
ifcapable reindex {

proc auth {code args} {
  if {$code=="SQLITE_REINDEX"} {
    set ::authargs [concat $::authargs [lrange $args 0 3]]
  }
  return SQLITE_OK
}
db authorizer auth
do_test auth-1.281 {
  execsql {
    CREATE TABLE t3(a PRIMARY KEY, b, c);
................................................................................
    execsql {
      REINDEX temp.t3;
    }
    set ::authargs
  } {t3_idx2 {} temp {} t3_idx1 {} temp {} sqlite_autoindex_t3_1 {} temp {}}
  proc auth {code args} {
    if {$code=="SQLITE_REINDEX"} {
      set ::authargs [concat $::authargs [lrange $args 0 3]]
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  do_test auth-1.292 {
    set ::authargs {}
    catchsql {
................................................................................
}

} ;# ifcapable reindex 

ifcapable analyze {
  proc auth {code args} {
    if {$code=="SQLITE_ANALYZE"} {
      set ::authargs [concat $::authargs [lrange $args 0 3]]
    }
    return SQLITE_OK
  }
  do_test auth-1.294 {
    set ::authargs {}
    execsql {
      CREATE TABLE t4(a,b,c);
................................................................................

# Authorization for ALTER TABLE ADD COLUMN.
# These tests are omitted if the library
# was built without ALTER TABLE support.
ifcapable {altertable} {
  do_test auth-1.300 {
    execsql {CREATE TABLE t5(x)}
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_ALTER_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_OK
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
    set x [execsql {SELECT sql FROM sqlite_master WHERE name='t5'}]
    regexp new_col_1 $x
  } {1}
  do_test auth-1.302 {
    set authargs
  } {main t5 {} {}}
  do_test auth-1.303 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_ALTER_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
    set x [execsql {SELECT sql FROM sqlite_master WHERE name='t5'}]
    regexp new_col_2 $x
  } {0}
  do_test auth-1.305 {
    set authargs
  } {main t5 {} {}}
  do_test auth-1.306 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_ALTER_TABLE"} {
        set ::authargs [list $arg1 $arg2 $arg3 $arg4]
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    catchsql {
................................................................................
    set authargs
  } {main t5 {} {}}
  execsql {DROP TABLE t5}
} ;# ifcapable altertable

ifcapable {cte} {
  do_test auth-1.310 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_RECURSIVE"} {
        return SQLITE_DENY
      }
      return SQLITE_OK
    }
    db eval {
       DROP TABLE IF EXISTS t1;
................................................................................
    WITH RECURSIVE
       auth1314(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM auth1314 WHERE x<5)
    SELECT * FROM t1 LEFT JOIN auth1314;
  } {1 {not authorized}}
} ;# ifcapable cte

do_test auth-2.1 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t3" && $arg2=="x"} {
      return SQLITE_DENY
    }
    return SQLITE_OK
  }
  db authorizer ::auth
  execsql {CREATE TABLE t3(x INTEGER PRIMARY KEY, y, z)}
................................................................................
do_test auth-2.2 {
  catchsql {SELECT ROWID,y,z FROM t3}
} {1 {access to t3.x is prohibited}}
do_test auth-2.3 {
  catchsql {SELECT OID,y,z FROM t3}
} {1 {access to t3.x is prohibited}}
do_test auth-2.4 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t3" && $arg2=="x"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  execsql {INSERT INTO t3 VALUES(44,55,66)}
  catchsql {SELECT * FROM t3}
} {0 {{} 55 66}}
do_test auth-2.5 {
  catchsql {SELECT rowid,y,z FROM t3}
} {0 {{} 55 66}}
do_test auth-2.6 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t3" && $arg2=="ROWID"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t3}
} {0 {44 55 66}}
do_test auth-2.7 {
  catchsql {SELECT ROWID,y,z FROM t3}
} {0 {44 55 66}}
do_test auth-2.8 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="ROWID"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT ROWID,b,c FROM t2}
} {0 {{} 2 33 {} 8 9}}
................................................................................
  # trying to recompile the statement, the authorization error is encountered.
  # If we do not flush the cache, the correct error message is returned, but
  # the error code is SQLITE_SCHEMA, not SQLITE_ERROR as required by the test
  # case after this one.
  #
  db cache flush

  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="ROWID"} {
      return bogus
    }
    return SQLITE_OK
  }
  catchsql {SELECT ROWID,b,c FROM t2}
} {1 {authorizer malfunction}}
do_test auth-2.9.2 {
  db errorcode
} {1}
do_test auth-2.10 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_SELECT"} {
      return bogus
    }
    return SQLITE_OK
  }
  catchsql {SELECT ROWID,b,c FROM t2}
} {1 {authorizer malfunction}}
do_test auth-2.11.1 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg2=="a"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2, t3}
} {0 {{} 2 33 44 55 66 {} 8 9 44 55 66}}
do_test auth-2.11.2 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_READ" && $arg2=="x"} {
      return SQLITE_IGNORE
    }
    return SQLITE_OK
  }
  catchsql {SELECT * FROM t2, t3}
} {0 {11 2 33 {} 55 66 7 8 9 {} 55 66}}

# Make sure the OLD and NEW pseudo-tables of a trigger get authorized.
#
ifcapable trigger {
  do_test auth-3.1 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      return SQLITE_OK
    }
    execsql {
      CREATE TABLE tx(a1,a2,b1,b2,c1,c2);
      CREATE TRIGGER r1 AFTER UPDATE ON t2 FOR EACH ROW BEGIN
        INSERT INTO tx VALUES(OLD.a,NEW.a,OLD.b,NEW.b,OLD.c,NEW.c);
      END;
      UPDATE t2 SET a=a+1;
      SELECT * FROM tx;
    }
  } {11 12 2 2 33 33 7 8 8 8 9 9}
  do_test auth-3.2 {
    proc auth {code arg1 arg2 arg3 arg4 args} {
      if {$code=="SQLITE_READ" && $arg1=="t2" && $arg2=="c"} {
        return SQLITE_IGNORE
      }
      return SQLITE_OK
    }
    execsql {
      DELETE FROM tx;
................................................................................
  } {12 112 2 2 {} {} 8 108 8 8 {} {}}
} ;# ifcapable trigger

# Make sure the names of views and triggers are passed on on arg4.
#
ifcapable trigger {
do_test auth-4.1 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    lappend ::authargs $code $arg1 $arg2 $arg3 $arg4
    return SQLITE_OK
  }
  set authargs {}
  execsql {
    UPDATE t2 SET a=a+1;
  }
................................................................................

} ;# ifcapable view && trigger

# Ticket #1338:  Make sure authentication works in the presence of an AS
# clause.
#
do_test auth-5.1 {
  proc auth {code arg1 arg2 arg3 arg4 args} {
    return SQLITE_OK
  }
  execsql {
    SELECT count(a) AS cnt FROM t4 ORDER BY cnt
  }
} {1}

................................................................................
      CREATE TRIGGER t5_tr1 AFTER INSERT ON t5 BEGIN 
        UPDATE t5 SET x = 1 WHERE NEW.x = 0;
      END;
    }
  } {}
  set ::authargs [list]
  proc auth {args} {
    eval lappend ::authargs [lrange $args 0 4]
    return SQLITE_OK
  }
  do_test auth-5.3.2 {
    execsql { INSERT INTO t5 (x) values(0) }
    set ::authargs
  } [list SQLITE_INSERT t5 {} main {}    \
          SQLITE_UPDATE t5 x main t5_tr1 \
................................................................................
  execsql {
    CREATE TABLE t6(a,b,c,d,e,f,g,h);
    INSERT INTO t6 VALUES(1,2,3,4,5,6,7,8);
  }
} {}
set ::authargs [list]
proc auth {args} {
  eval lappend ::authargs [lrange $args 0 4]
  return SQLITE_OK
}
do_test auth-6.2 {
  execsql {UPDATE t6 SET rowID=rowID+100}
  set ::authargs
} [list SQLITE_READ   t6 ROWID main {} \
        SQLITE_UPDATE t6 ROWID main {} \

do_test auth2-1.1 {
  execsql {
    CREATE TABLE t1(a,b,c);
    INSERT INTO t1 VALUES(1,2,3);
  }
  set ::flist {}
  proc auth {code arg1 arg2 arg3 arg4} {
    if {$code=="SQLITE_FUNCTION"} {
      lappend ::flist $arg2
      if {$arg2=="max"} {
        return SQLITE_DENY
      } elseif {$arg2=="min"} {
        return SQLITE_IGNORE
      } else {
................................................................................
# and when computing the result set of a view.
#
db close
sqlite3 db test.db
sqlite3 db2 test.db
proc auth {args} {
  global authargs
  append authargs $args\n
  return SQLITE_OK
}
db auth auth
do_test auth2-2.1 {
  set ::authargs {}
  db eval {
    CREATE TABLE t2(x,y,z);

do_test auth2-1.1 {
  execsql {
    CREATE TABLE t1(a,b,c);
    INSERT INTO t1 VALUES(1,2,3);
  }
  set ::flist {}
  proc auth {code arg1 arg2 arg3 arg4 args} {
    if {$code=="SQLITE_FUNCTION"} {
      lappend ::flist $arg2
      if {$arg2=="max"} {
        return SQLITE_DENY
      } elseif {$arg2=="min"} {
        return SQLITE_IGNORE
      } else {
................................................................................
# and when computing the result set of a view.
#
db close
sqlite3 db test.db
sqlite3 db2 test.db
proc auth {args} {
  global authargs
  append authargs [lrange $args 0 4]\n
  return SQLITE_OK
}
db auth auth
do_test auth2-2.1 {
  set ::authargs {}
  db eval {
    CREATE TABLE t2(x,y,z);

}

# Disable the statement cache for these tests.
# 
db cache size 0

db authorizer ::auth
proc auth {code arg1 arg2 arg3 arg4} {
  if {$code=="SQLITE_DELETE"} {
    return $::authcode
  }
  return SQLITE_OK
}

#--------------------------------------------------------------------------

}

# Disable the statement cache for these tests.
# 
db cache size 0

db authorizer ::auth
proc auth {code arg1 arg2 arg3 arg4 args} {
  if {$code=="SQLITE_DELETE"} {
    return $::authcode
  }
  return SQLITE_OK
}

#--------------------------------------------------------------------------

    execsql {
      CREATE TABLE long(a, b PRIMARY KEY, c);
      CREATE TABLE short(d, e, f REFERENCES long);
      CREATE TABLE mid(g, h, i REFERENCES long DEFERRABLE INITIALLY DEFERRED);
    }
  } {}

  proc auth {args} {eval lappend ::authargs $args ; return SQLITE_OK}
  db auth auth

  # An insert on the parent table must read the child key of any deferred
  # foreign key constraints. But not the child key of immediate constraints.
  set authargs {}
  do_test fkey2-18.2 {
    execsql { INSERT INTO long VALUES(1, 2, 3) }

    execsql {
      CREATE TABLE long(a, b PRIMARY KEY, c);
      CREATE TABLE short(d, e, f REFERENCES long);
      CREATE TABLE mid(g, h, i REFERENCES long DEFERRABLE INITIALLY DEFERRED);
    }
  } {}

  proc auth {args} {eval lappend ::authargs [lrange $args 0 4]; return SQLITE_OK}
  db auth auth

  # An insert on the parent table must read the child key of any deferred
  # foreign key constraints. But not the child key of immediate constraints.
  set authargs {}
  do_test fkey2-18.2 {
    execsql { INSERT INTO long VALUES(1, 2, 3) }

    db eval {SELECT docid FROM t1 WHERE words MATCH $::q ORDER BY docid}
  } $r
}

# Should get the same search results when an authorizer prevents
# all PRAGMA statements.
#
proc no_pragma_auth {code arg1 arg2 arg3 arg4} {
  if {$code=="SQLITE_PRAGMA"} {return SQLITE_DENY}
  return SQLITE_OK;
}
do_test fts4aa-4.0 {
  db auth ::no_pragma_auth
  db eval {
    DROP TABLE t1;

    db eval {SELECT docid FROM t1 WHERE words MATCH $::q ORDER BY docid}
  } $r
}

# Should get the same search results when an authorizer prevents
# all PRAGMA statements.
#
proc no_pragma_auth {code arg1 arg2 arg3 arg4 args} {
  if {$code=="SQLITE_PRAGMA"} {return SQLITE_DENY}
  return SQLITE_OK;
}
do_test fts4aa-4.0 {
  db auth ::no_pragma_auth
  db eval {
    DROP TABLE t1;

  execsql { RELEASE "including Whitespace " }
} {}

# Test that the authorization callback works.
#
ifcapable auth {
  proc auth {args} {
    eval lappend ::authdata $args
    return SQLITE_OK
  }
  db auth auth

  do_test savepoint-9.1 {
    set ::authdata [list]
    execsql { SAVEPOINT sp1 }
................................................................................
  do_test savepoint-9.3 {
    set ::authdata [list]
    execsql { RELEASE sp1 }
    set ::authdata
  } {SQLITE_SAVEPOINT RELEASE sp1 {} {}}

  proc auth {args} {
    eval lappend ::authdata $args
    return SQLITE_DENY
  }
  db auth auth

  do_test savepoint-9.4 {
    set ::authdata [list]
    set res [catchsql { SAVEPOINT sp1 }]

  execsql { RELEASE "including Whitespace " }
} {}

# Test that the authorization callback works.
#
ifcapable auth {
  proc auth {args} {
    eval lappend ::authdata [lrange $args 0 4]
    return SQLITE_OK
  }
  db auth auth

  do_test savepoint-9.1 {
    set ::authdata [list]
    execsql { SAVEPOINT sp1 }
................................................................................
  do_test savepoint-9.3 {
    set ::authdata [list]
    execsql { RELEASE sp1 }
    set ::authdata
  } {SQLITE_SAVEPOINT RELEASE sp1 {} {}}

  proc auth {args} {
    eval lappend ::authdata [lrange $args 0 4]
    return SQLITE_DENY
  }
  db auth auth

  do_test savepoint-9.4 {
    set ::authdata [list]
    set res [catchsql { SAVEPOINT sp1 }]

  return
}

set ::auth_fail 0
set ::auth_log [list]
set ::auth_filter [list SQLITE_READ SQLITE_UPDATE SQLITE_SELECT SQLITE_PRAGMA]

proc auth {code arg1 arg2 arg3 arg4} {
  if {[lsearch $::auth_filter $code]>-1} {
    return SQLITE_OK
  }
  lappend ::auth_log $code $arg1 $arg2 $arg3 $arg4
  incr ::auth_fail -1
  if {$::auth_fail == 0} {
    return SQLITE_DENY

  return
}

set ::auth_fail 0
set ::auth_log [list]
set ::auth_filter [list SQLITE_READ SQLITE_UPDATE SQLITE_SELECT SQLITE_PRAGMA]

proc auth {code arg1 arg2 arg3 arg4 args} {
  if {[lsearch $::auth_filter $code]>-1} {
    return SQLITE_OK
  }
  lappend ::auth_log $code $arg1 $arg2 $arg3 $arg4
  incr ::auth_fail -1
  if {$::auth_fail == 0} {
    return SQLITE_DENY

    execsql {
      CREATE TABLE long(a, b PRIMARY KEY, c) WITHOUT rowid;
      CREATE TABLE short(d, e, f REFERENCES long);
      CREATE TABLE mid(g, h, i REFERENCES long DEFERRABLE INITIALLY DEFERRED);
    }
  } {}

  proc auth {args} {eval lappend ::authargs $args ; return SQLITE_OK}
  db auth auth

  # An insert on the parent table must read the child key of any deferred
  # foreign key constraints. But not the child key of immediate constraints.
  set authargs {}
  do_test without_rowid3-18.2 {
    execsql { INSERT INTO long VALUES(1, 2, 3) }

    execsql {
      CREATE TABLE long(a, b PRIMARY KEY, c) WITHOUT rowid;
      CREATE TABLE short(d, e, f REFERENCES long);
      CREATE TABLE mid(g, h, i REFERENCES long DEFERRABLE INITIALLY DEFERRED);
    }
  } {}

  proc auth {args} {eval lappend ::authargs [lrange $args 0 4]; return SQLITE_OK}
  db auth auth

  # An insert on the parent table must read the child key of any deferred
  # foreign key constraints. But not the child key of immediate constraints.
  set authargs {}
  do_test without_rowid3-18.2 {
    execsql { INSERT INTO long VALUES(1, 2, 3) }