Repository: ClickHouse/ClickHouse
File: src/Access/AccessRights.cpp (C++)

Code before:
        return true;
    }

    friend bool operator ==(const Node & left, const Node & right)
    {
        if (left.node_name != right.node_name)
            return false;

        if (left.wildcard_grant != right.wildcard_grant)
            return false;

        if (left.flags != right.flags)
            return false;

        if (!left.children)
            return !right.children;

        if (!right.children)
            return false;
        return *left.children == *right.children;
    }

    friend bool operator!=(const Node & left, const Node & right) { return !(left == right); }

    bool contains(const Node & other) const
    {
        if (!flags.contains(other.flags))
            return false;

        if (other.children)
        {
            for (const auto & other_child : *other.children)
            {
                Node this_child = tryGetLeaf(other_child.node_name, other_child.level, !other_child.isLeaf());
                if (!this_child.contains(other_child))
                    return false;
            }
        }

        if (children)
        {
            for (const auto & this_child : *children)
            {
                Node other_child = other.tryGetLeaf(this_child.node_name, this_child.level, !this_child.isLeaf());
                if (!this_child.contains(other_child))
                    return false;
            }
        }

        return true;
    }

Review comment (suggestion):
Really nice reserse traversal！
would you please add necessary comments for the function?and better to have an example to explain why the reserse traversal is necessary.

Code after:
        return true;
    }

    friend bool operator ==(const Node & left, const Node & right)
    {
        if (left.node_name != right.node_name)
            return false;

        if (left.wildcard_grant != right.wildcard_grant)
            return false;

        if (left.flags != right.flags)
            return false;

        if (!left.children)
            return !right.children;

        if (!right.children)
            return false;
        return *left.children == *right.children;
    }

    friend bool operator!=(const Node & left, const Node & right) { return !(left == right); }

    /// Checks whether `this` node's access rights are a superset of `other`'s
    bool contains(const Node & other) const
    {
        /// The check traverses children from both sides:
        /// 1) For each child in `other`, find the matching node in `this` and verify containment.
        /// 2) For each child in `this`, find the matching node in `other` and verify containment.
        ///
        /// The reverse traversal (step 2) is needed to handle partial revokes correctly.
        /// Example: GRANT SELECT ON *.*, REVOKE SELECT ON foo.*
        ///
        ///   this:                   other:
        ///       root (SELECT)         root (SELECT)
        ///        |
        ///      "foo" (SELECT)
        ///        |
        ///        "" (leaf, USAGE)
        ///
        /// Step 1 alone would pass because `other` has no children to check against, but `this` does not contain `other` because
        /// `this` has revoked SELECT on "foo".

        if (!flags.contains(other.flags))
            return false;

        if (other.children)
        {
            for (const auto & other_child : *other.children)
            {