Examples with HivePrincipal io.trino.plugin.hive.metastore.HivePrincipal used on opensource projects

Example 6 with HivePrincipal

use of io.trino.plugin.hive.metastore.HivePrincipal in project trino by trinodb.

the class ThriftMetastoreUtil method listEnabledRoles.

public static Stream<String> listEnabledRoles(ConnectorIdentity identity, Function<HivePrincipal, Set<RoleGrant>> listRoleGrants) {
    if (identity.getConnectorRole().isPresent() && identity.getConnectorRole().get().getType() == SelectedRole.Type.NONE) {
        return Stream.of(PUBLIC_ROLE_NAME);
    }
    HivePrincipal principal = HivePrincipal.from(identity);
    Stream<String> roles = Stream.of(PUBLIC_ROLE_NAME);
    if (principal.getType() == ROLE) {
        roles = Stream.concat(roles, Stream.of(principal.getName()));
    }
    return Stream.concat(roles, listApplicableRoles(principal, listRoleGrants).map(RoleGrant::getRoleName).filter(Predicate.isEqual(ADMIN_ROLE_NAME).negate())).distinct();
}

Example 7 with HivePrincipal

use of io.trino.plugin.hive.metastore.HivePrincipal in project trino by trinodb.

the class ThriftMetastoreUtil method parsePrivilege.

public static Set<HivePrivilegeInfo> parsePrivilege(PrivilegeGrantInfo userGrant, Optional<HivePrincipal> grantee) {
    boolean grantOption = userGrant.isGrantOption();
    String name = userGrant.getPrivilege().toUpperCase(ENGLISH);
    HivePrincipal grantor = new HivePrincipal(fromMetastoreApiPrincipalType(userGrant.getGrantorType()), userGrant.getGrantor());
    switch(name) {
        case "ALL":
            return Arrays.stream(HivePrivilegeInfo.HivePrivilege.values()).map(hivePrivilege -> new HivePrivilegeInfo(hivePrivilege, grantOption, grantor, grantee.orElse(grantor))).collect(toImmutableSet());
        case "SELECT":
            return ImmutableSet.of(new HivePrivilegeInfo(SELECT, grantOption, grantor, grantee.orElse(grantor)));
        case "INSERT":
            return ImmutableSet.of(new HivePrivilegeInfo(INSERT, grantOption, grantor, grantee.orElse(grantor)));
        case "UPDATE":
            return ImmutableSet.of(new HivePrivilegeInfo(UPDATE, grantOption, grantor, grantee.orElse(grantor)));
        case "DELETE":
            return ImmutableSet.of(new HivePrivilegeInfo(DELETE, grantOption, grantor, grantee.orElse(grantor)));
        case "OWNERSHIP":
            return ImmutableSet.of(new HivePrivilegeInfo(OWNERSHIP, grantOption, grantor, grantee.orElse(grantor)));
        default:
            throw new IllegalArgumentException("Unsupported privilege name: " + name);
    }
}

Example 8 with HivePrincipal

use of io.trino.plugin.hive.metastore.HivePrincipal in project trino by trinodb.

the class SqlStandardAccessControl method isDatabaseOwner.

private boolean isDatabaseOwner(ConnectorSecurityContext context, String databaseName) {
    // all users are "owners" of the default database
    if (DEFAULT_DATABASE_NAME.equalsIgnoreCase(databaseName)) {
        return true;
    }
    if (isAdmin(context)) {
        return true;
    }
    Optional<Database> databaseMetadata = metastore.getDatabase(context, databaseName);
    if (databaseMetadata.isEmpty()) {
        return false;
    }
    Database database = databaseMetadata.get();
    // a database can be owned by a user or role
    ConnectorIdentity identity = context.getIdentity();
    if (database.getOwnerName().isPresent()) {
        if (database.getOwnerType().orElse(null) == USER && identity.getUser().equals(database.getOwnerName().get())) {
            return true;
        }
        if (database.getOwnerType().orElse(null) == ROLE && isRoleEnabled(identity, hivePrincipal -> metastore.listRoleGrants(context, hivePrincipal), database.getOwnerName().get())) {
            return true;
        }
    }
    return false;
}

Example 9 with HivePrincipal

use of io.trino.plugin.hive.metastore.HivePrincipal in project trino by trinodb.

the class TestCachingHiveMetastore method testSetTableAuthorization.

@Test
public void testSetTableAuthorization() {
    assertEquals(mockClient.getAccessCount(), 0);
    assertNotNull(metastore.getTable(TEST_DATABASE, TEST_TABLE));
    assertNotNull(metastore.getDatabase(TEST_DATABASE));
    assertEquals(mockClient.getAccessCount(), 2);
    metastore.setTableOwner(TEST_DATABASE, TEST_TABLE, new HivePrincipal(USER, "ignore"));
    assertEquals(mockClient.getAccessCount(), 3);
    assertNotNull(metastore.getTable(TEST_DATABASE, TEST_TABLE));
    assertEquals(mockClient.getAccessCount(), 4);
    // Assert that database cache has not been invalidated
    assertNotNull(metastore.getDatabase(TEST_DATABASE));
    assertEquals(mockClient.getAccessCount(), 4);
}

Example 10 with HivePrincipal

use of io.trino.plugin.hive.metastore.HivePrincipal in project trino by trinodb.

the class TestRecordingHiveMetastore method validateMetadata.

private void validateMetadata(HiveMetastore hiveMetastore) {
    assertEquals(hiveMetastore.getDatabase("database"), Optional.of(DATABASE));
    assertEquals(hiveMetastore.getAllDatabases(), ImmutableList.of("database"));
    assertEquals(hiveMetastore.getTable("database", "table"), Optional.of(TABLE));
    assertEquals(hiveMetastore.getSupportedColumnStatistics(createVarcharType(123)), ImmutableSet.of(MIN_VALUE, MAX_VALUE));
    assertEquals(hiveMetastore.getTableStatistics(TABLE), PARTITION_STATISTICS);
    assertEquals(hiveMetastore.getPartitionStatistics(TABLE, ImmutableList.of(PARTITION)), ImmutableMap.of("value", PARTITION_STATISTICS));
    assertEquals(hiveMetastore.getAllTables("database"), ImmutableList.of("table"));
    assertEquals(hiveMetastore.getTablesWithParameter("database", "param", "value3"), ImmutableList.of("table"));
    assertEquals(hiveMetastore.getAllViews("database"), ImmutableList.of());
    assertEquals(hiveMetastore.getPartition(TABLE, ImmutableList.of("value")), Optional.of(PARTITION));
    assertEquals(hiveMetastore.getPartitionNamesByFilter("database", "table", PARTITION_COLUMN_NAMES, TupleDomain.all()), Optional.of(ImmutableList.of("value")));
    assertEquals(hiveMetastore.getPartitionNamesByFilter("database", "table", PARTITION_COLUMN_NAMES, TUPLE_DOMAIN), Optional.of(ImmutableList.of("value")));
    assertEquals(hiveMetastore.getPartitionsByNames(TABLE, ImmutableList.of("value")), ImmutableMap.of("value", Optional.of(PARTITION)));
    assertEquals(hiveMetastore.listTablePrivileges("database", "table", Optional.of("owner"), Optional.of(new HivePrincipal(USER, "user"))), ImmutableSet.of(PRIVILEGE_INFO));
    assertEquals(hiveMetastore.listRoles(), ImmutableSet.of("role"));
    assertEquals(hiveMetastore.listRoleGrants(new HivePrincipal(USER, "user")), ImmutableSet.of(ROLE_GRANT));
    assertEquals(hiveMetastore.listGrantedPrincipals("role"), ImmutableSet.of(ROLE_GRANT));
}