Search in sources :

Example 96 with QualifiedObjectName

use of io.trino.metadata.QualifiedObjectName in project trino by trinodb.

the class TestRowFilter method testDifferentIdentity.

@Test
public void testDifferentIdentity() {
    accessControl.reset();
    accessControl.rowFilter(new QualifiedObjectName(CATALOG, "tiny", "orders"), RUN_AS_USER, new ViewExpression(RUN_AS_USER, Optional.of(CATALOG), Optional.of("tiny"), "orderkey = 1"));
    accessControl.rowFilter(new QualifiedObjectName(CATALOG, "tiny", "orders"), USER, new ViewExpression(RUN_AS_USER, Optional.of(CATALOG), Optional.of("tiny"), "orderkey IN (SELECT orderkey FROM orders)"));
    assertThat(assertions.query("SELECT count(*) FROM orders")).matches("VALUES BIGINT '1'");
}
Also used : QualifiedObjectName(io.trino.metadata.QualifiedObjectName) ViewExpression(io.trino.spi.security.ViewExpression) Test(org.junit.jupiter.api.Test)

Example 97 with QualifiedObjectName

use of io.trino.metadata.QualifiedObjectName in project trino by trinodb.

the class TestRowFilter method testOtherSchema.

@Test
public void testOtherSchema() {
    accessControl.reset();
    accessControl.rowFilter(new QualifiedObjectName(CATALOG, "tiny", "orders"), USER, // Filter is TRUE only if evaluating against sf1.customer
    new ViewExpression(USER, Optional.of(CATALOG), Optional.of("sf1"), "(SELECT count(*) FROM customer) = 150000"));
    assertThat(assertions.query("SELECT count(*) FROM orders")).matches("VALUES BIGINT '15000'");
}
Also used : QualifiedObjectName(io.trino.metadata.QualifiedObjectName) ViewExpression(io.trino.spi.security.ViewExpression) Test(org.junit.jupiter.api.Test)

Example 98 with QualifiedObjectName

use of io.trino.metadata.QualifiedObjectName in project trino by trinodb.

the class TestRowFilter method testSimpleFilter.

@Test
public void testSimpleFilter() {
    accessControl.reset();
    accessControl.rowFilter(new QualifiedObjectName(CATALOG, "tiny", "orders"), USER, new ViewExpression(USER, Optional.empty(), Optional.empty(), "orderkey < 10"));
    assertThat(assertions.query("SELECT count(*) FROM orders")).matches("VALUES BIGINT '7'");
    accessControl.reset();
    accessControl.rowFilter(new QualifiedObjectName(CATALOG, "tiny", "orders"), USER, new ViewExpression(USER, Optional.empty(), Optional.empty(), "NULL"));
    assertThat(assertions.query("SELECT count(*) FROM orders")).matches("VALUES BIGINT '0'");
}
Also used : QualifiedObjectName(io.trino.metadata.QualifiedObjectName) ViewExpression(io.trino.spi.security.ViewExpression) Test(org.junit.jupiter.api.Test)

Example 99 with QualifiedObjectName

use of io.trino.metadata.QualifiedObjectName in project trino by trinodb.

the class TestRowFilter method testRowFilterOnOptionalColumn.

@Test
public void testRowFilterOnOptionalColumn() {
    accessControl.reset();
    accessControl.rowFilter(new QualifiedObjectName(MOCK_CATALOG_MISSING_COLUMNS, "tiny", "nation_with_optional_column"), USER, new ViewExpression(USER, Optional.empty(), Optional.empty(), "length(optional) > 2"));
    assertions.query("INSERT INTO mockmissingcolumns.tiny.nation_with_optional_column(nationkey, name, regionkey, comment, optional) VALUES (0, 'POLAND', 0, 'No comment', 'some string')").assertThat().skippingTypesCheck().matches("VALUES BIGINT '1'");
    assertThatThrownBy(() -> assertions.query("INSERT INTO mockmissingcolumns.tiny.nation_with_optional_column(nationkey, name, regionkey, comment, optional) VALUES (0, 'POLAND', 0, 'No comment', 'so')")).isInstanceOf(TrinoException.class).hasMessage("Access Denied: Cannot insert row that does not match to a row filter");
    assertThatThrownBy(() -> assertions.query("INSERT INTO mockmissingcolumns.tiny.nation_with_optional_column(nationkey, name, regionkey, comment, optional) VALUES (0, 'POLAND', 0, 'No comment', null)")).isInstanceOf(TrinoException.class).hasMessage("Access Denied: Cannot insert row that does not match to a row filter");
}
Also used : TrinoException(io.trino.spi.TrinoException) QualifiedObjectName(io.trino.metadata.QualifiedObjectName) ViewExpression(io.trino.spi.security.ViewExpression) Test(org.junit.jupiter.api.Test)

Example 100 with QualifiedObjectName

use of io.trino.metadata.QualifiedObjectName in project trino by trinodb.

the class TestRowFilter method testUpdate.

@Test
public void testUpdate() {
    accessControl.reset();
    accessControl.rowFilter(new QualifiedObjectName(MOCK_CATALOG, "tiny", "nation"), USER, new ViewExpression(USER, Optional.empty(), Optional.empty(), "nationkey < 10"));
    // Within allowed row filter
    assertThatThrownBy(() -> assertions.query("UPDATE mock.tiny.nation SET regionkey = regionkey * 2 WHERE nationkey < 3")).hasMessage("line 1:1: Updating a table with a row filter is not supported");
    assertThatThrownBy(() -> assertions.query("UPDATE mock.tiny.nation SET regionkey = regionkey * 2 WHERE nationkey IN (1, 2, 3)")).hasMessage("line 1:1: Updating a table with a row filter is not supported");
    // Outside allowed row filter, only readable rows were update
    assertThatThrownBy(() -> assertions.query("UPDATE mock.tiny.nation SET regionkey = regionkey * 2")).hasMessage("line 1:1: Updating a table with a row filter is not supported");
    assertThatThrownBy(() -> assertions.query("UPDATE mock.tiny.nation SET regionkey = regionkey * 2 WHERE nationkey IN (1, 11)")).hasMessage("line 1:1: Updating a table with a row filter is not supported");
    assertThatThrownBy(() -> assertions.query("UPDATE mock.tiny.nation SET regionkey = regionkey * 2 WHERE nationkey = 11")).hasMessage("line 1:1: Updating a table with a row filter is not supported");
    // Within allowed row filter, but updated rows are outside the row filter
    assertThatThrownBy(() -> assertions.query("UPDATE mock.tiny.nation SET nationkey = 10 WHERE nationkey < 3")).hasMessage("line 1:1: Updating a table with a row filter is not supported");
    assertThatThrownBy(() -> assertions.query("UPDATE mock.tiny.nation SET nationkey = null WHERE nationkey < 3")).hasMessage("line 1:1: Updating a table with a row filter is not supported");
    // Outside allowed row filter, but updated rows are outside the row filter
    assertThatThrownBy(() -> assertions.query("UPDATE mock.tiny.nation SET nationkey = 10 WHERE nationkey = 10")).hasMessage("line 1:1: Updating a table with a row filter is not supported");
    assertThatThrownBy(() -> assertions.query("UPDATE mock.tiny.nation SET nationkey = null WHERE nationkey = null ")).hasMessage("line 1:1: Updating a table with a row filter is not supported");
}
Also used : QualifiedObjectName(io.trino.metadata.QualifiedObjectName) ViewExpression(io.trino.spi.security.ViewExpression) Test(org.junit.jupiter.api.Test)

Aggregations

QualifiedObjectName (io.trino.metadata.QualifiedObjectName)142 ViewExpression (io.trino.spi.security.ViewExpression)51 Test (org.testng.annotations.Test)51 Test (org.junit.jupiter.api.Test)41 Session (io.trino.Session)40 TableHandle (io.trino.metadata.TableHandle)33 MetadataUtil.createQualifiedObjectName (io.trino.metadata.MetadataUtil.createQualifiedObjectName)24 Optional (java.util.Optional)20 Metadata (io.trino.metadata.Metadata)17 Map (java.util.Map)17 Objects.requireNonNull (java.util.Objects.requireNonNull)16 ImmutableList (com.google.common.collect.ImmutableList)15 List (java.util.List)15 ImmutableMap (com.google.common.collect.ImmutableMap)14 TrinoException (io.trino.spi.TrinoException)14 ImmutableSet (com.google.common.collect.ImmutableSet)13 ColumnHandle (io.trino.spi.connector.ColumnHandle)13 Type (io.trino.spi.type.Type)11 Set (java.util.Set)11 CatalogName (io.trino.connector.CatalogName)10