Examples with ConnectorAccessControl io.trino.spi.connector.ConnectorAccessControl used on opensource projects

Example 11 with ConnectorAccessControl

use of io.trino.spi.connector.ConnectorAccessControl in project trino by trinodb.

the class DropStatsProcedure method doDropStats.

private void doDropStats(ConnectorSession session, ConnectorAccessControl accessControl, String schema, String table, List<?> partitionValues) {
    TransactionalMetadata hiveMetadata = hiveMetadataFactory.create(session.getIdentity(), true);
    HiveTableHandle handle = (HiveTableHandle) hiveMetadata.getTableHandle(session, new SchemaTableName(schema, table));
    if (handle == null) {
        throw new TrinoException(INVALID_PROCEDURE_ARGUMENT, format("Table '%s' does not exist", new SchemaTableName(schema, table)));
    }
    accessControl.checkCanInsertIntoTable(null, new SchemaTableName(schema, table));
    Map<String, ColumnHandle> columns = hiveMetadata.getColumnHandles(session, handle);
    List<String> partitionColumns = columns.values().stream().map(HiveColumnHandle.class::cast).filter(HiveColumnHandle::isPartitionKey).map(HiveColumnHandle::getName).collect(toImmutableList());
    HiveMetastoreClosure metastore = hiveMetadata.getMetastore().unsafeGetRawHiveMetastoreClosure();
    if (partitionValues != null) {
        // drop stats for specified partitions
        List<List<String>> partitionStringValues = partitionValues.stream().map(DropStatsProcedure::validateParameterType).collect(toImmutableList());
        validatePartitions(partitionStringValues, partitionColumns);
        partitionStringValues.forEach(values -> metastore.updatePartitionStatistics(schema, table, makePartName(partitionColumns, values), stats -> PartitionStatistics.empty()));
    } else {
        // no partition specified, so drop stats for the entire table
        if (partitionColumns.isEmpty()) {
            // for non-partitioned tables, just wipe table stats
            metastore.updateTableStatistics(schema, table, NO_ACID_TRANSACTION, stats -> PartitionStatistics.empty());
        } else {
            // the table is partitioned; remove stats for every partition
            metastore.getPartitionNamesByFilter(handle.getSchemaName(), handle.getTableName(), partitionColumns, TupleDomain.all()).ifPresent(partitions -> partitions.forEach(partitionName -> metastore.updatePartitionStatistics(schema, table, partitionName, stats -> PartitionStatistics.empty())));
        }
    }
    hiveMetadata.commit();
}

Example 12 with ConnectorAccessControl

use of io.trino.spi.connector.ConnectorAccessControl in project trino by trinodb.

the class TestFileBasedAccessControl method testSchemaRules.

@Test
public void testSchemaRules() {
    ConnectorAccessControl accessControl = createAccessControl("schema.json");
    accessControl.checkCanCreateSchema(ADMIN, "bob");
    accessControl.checkCanCreateSchema(ADMIN, "staff");
    accessControl.checkCanCreateSchema(ADMIN, "authenticated");
    accessControl.checkCanCreateSchema(ADMIN, "test");
    accessControl.checkCanCreateSchema(BOB, "bob");
    accessControl.checkCanCreateSchema(BOB, "staff");
    accessControl.checkCanCreateSchema(BOB, "authenticated");
    assertDenied(() -> accessControl.checkCanCreateSchema(BOB, "test"));
    assertDenied(() -> accessControl.checkCanCreateSchema(CHARLIE, "bob"));
    assertDenied(() -> accessControl.checkCanCreateSchema(CHARLIE, "staff"));
    accessControl.checkCanCreateSchema(CHARLIE, "authenticated");
    assertDenied(() -> accessControl.checkCanCreateSchema(CHARLIE, "test"));
    accessControl.checkCanDropSchema(ADMIN, "bob");
    accessControl.checkCanDropSchema(ADMIN, "staff");
    accessControl.checkCanDropSchema(ADMIN, "authenticated");
    accessControl.checkCanDropSchema(ADMIN, "test");
    accessControl.checkCanDropSchema(BOB, "bob");
    accessControl.checkCanDropSchema(BOB, "staff");
    accessControl.checkCanDropSchema(BOB, "authenticated");
    assertDenied(() -> accessControl.checkCanDropSchema(BOB, "test"));
    assertDenied(() -> accessControl.checkCanDropSchema(CHARLIE, "bob"));
    assertDenied(() -> accessControl.checkCanDropSchema(CHARLIE, "staff"));
    accessControl.checkCanDropSchema(CHARLIE, "authenticated");
    assertDenied(() -> accessControl.checkCanDropSchema(CHARLIE, "test"));
    accessControl.checkCanRenameSchema(ADMIN, "bob", "new_schema");
    accessControl.checkCanRenameSchema(ADMIN, "staff", "new_schema");
    accessControl.checkCanRenameSchema(ADMIN, "authenticated", "new_schema");
    accessControl.checkCanRenameSchema(ADMIN, "test", "new_schema");
    accessControl.checkCanRenameSchema(BOB, "bob", "staff");
    accessControl.checkCanRenameSchema(BOB, "staff", "authenticated");
    accessControl.checkCanRenameSchema(BOB, "authenticated", "bob");
    assertDenied(() -> accessControl.checkCanRenameSchema(BOB, "test", "bob"));
    assertDenied(() -> accessControl.checkCanRenameSchema(BOB, "bob", "test"));
    assertDenied(() -> accessControl.checkCanRenameSchema(CHARLIE, "bob", "new_schema"));
    assertDenied(() -> accessControl.checkCanRenameSchema(CHARLIE, "staff", "new_schema"));
    accessControl.checkCanRenameSchema(CHARLIE, "authenticated", "authenticated");
    assertDenied(() -> accessControl.checkCanRenameSchema(CHARLIE, "test", "new_schema"));
    accessControl.checkCanSetSchemaAuthorization(ADMIN, "test", new TrinoPrincipal(PrincipalType.ROLE, "some_role"));
    accessControl.checkCanSetSchemaAuthorization(ADMIN, "test", new TrinoPrincipal(PrincipalType.USER, "some_user"));
    accessControl.checkCanSetSchemaAuthorization(BOB, "bob", new TrinoPrincipal(PrincipalType.ROLE, "some_role"));
    accessControl.checkCanSetSchemaAuthorization(BOB, "bob", new TrinoPrincipal(PrincipalType.USER, "some_user"));
    assertDenied(() -> accessControl.checkCanSetSchemaAuthorization(BOB, "test", new TrinoPrincipal(PrincipalType.ROLE, "some_role")));
    assertDenied(() -> accessControl.checkCanSetSchemaAuthorization(BOB, "test", new TrinoPrincipal(PrincipalType.USER, "some_user")));
    accessControl.checkCanShowCreateSchema(ADMIN, "bob");
    accessControl.checkCanShowCreateSchema(ADMIN, "staff");
    accessControl.checkCanShowCreateSchema(ADMIN, "authenticated");
    accessControl.checkCanShowCreateSchema(ADMIN, "test");
    accessControl.checkCanShowCreateSchema(BOB, "bob");
    accessControl.checkCanShowCreateSchema(BOB, "staff");
    accessControl.checkCanShowCreateSchema(BOB, "authenticated");
    assertDenied(() -> accessControl.checkCanShowCreateSchema(BOB, "test"));
    assertDenied(() -> accessControl.checkCanShowCreateSchema(CHARLIE, "bob"));
    assertDenied(() -> accessControl.checkCanShowCreateSchema(CHARLIE, "staff"));
    accessControl.checkCanShowCreateSchema(CHARLIE, "authenticated");
    assertDenied(() -> accessControl.checkCanShowCreateSchema(CHARLIE, "test"));
}

Example 13 with ConnectorAccessControl

use of io.trino.spi.connector.ConnectorAccessControl in project trino by trinodb.

the class TestFileBasedAccessControl method testRevokeSchemaPrivilege.

@Test(dataProvider = "privilegeGrantOption")
public void testRevokeSchemaPrivilege(Privilege privilege, boolean grantOption) {
    ConnectorAccessControl accessControl = createAccessControl("schema.json");
    TrinoPrincipal grantee = new TrinoPrincipal(PrincipalType.USER, "alice");
    accessControl.checkCanRevokeSchemaPrivilege(ADMIN, privilege, "bob", grantee, grantOption);
    accessControl.checkCanRevokeSchemaPrivilege(ADMIN, privilege, "staff", grantee, grantOption);
    accessControl.checkCanRevokeSchemaPrivilege(ADMIN, privilege, "authenticated", grantee, grantOption);
    accessControl.checkCanRevokeSchemaPrivilege(ADMIN, privilege, "test", grantee, grantOption);
    accessControl.checkCanRevokeSchemaPrivilege(BOB, privilege, "bob", grantee, grantOption);
    accessControl.checkCanRevokeSchemaPrivilege(BOB, privilege, "staff", grantee, grantOption);
    accessControl.checkCanRevokeSchemaPrivilege(BOB, privilege, "authenticated", grantee, grantOption);
    assertDenied(() -> accessControl.checkCanRevokeSchemaPrivilege(BOB, privilege, "test", grantee, grantOption));
    assertDenied(() -> accessControl.checkCanRevokeSchemaPrivilege(CHARLIE, privilege, "bob", grantee, grantOption));
    assertDenied(() -> accessControl.checkCanRevokeSchemaPrivilege(CHARLIE, privilege, "staff", grantee, grantOption));
    accessControl.checkCanRevokeSchemaPrivilege(CHARLIE, privilege, "authenticated", grantee, grantOption);
    assertDenied(() -> accessControl.checkCanRevokeSchemaPrivilege(CHARLIE, privilege, "test", grantee, grantOption));
}

Example 14 with ConnectorAccessControl

use of io.trino.spi.connector.ConnectorAccessControl in project trino by trinodb.

the class TestFileBasedAccessControl method testDenySchemaPrivilege.

@Test
public void testDenySchemaPrivilege() {
    ConnectorAccessControl accessControl = createAccessControl("schema.json");
    TrinoPrincipal grantee = new TrinoPrincipal(PrincipalType.USER, "alice");
    accessControl.checkCanDenySchemaPrivilege(ADMIN, UPDATE, "bob", grantee);
    accessControl.checkCanDenySchemaPrivilege(ADMIN, UPDATE, "staff", grantee);
    accessControl.checkCanDenySchemaPrivilege(ADMIN, UPDATE, "authenticated", grantee);
    accessControl.checkCanDenySchemaPrivilege(ADMIN, UPDATE, "test", grantee);
    accessControl.checkCanDenySchemaPrivilege(BOB, UPDATE, "bob", grantee);
    accessControl.checkCanDenySchemaPrivilege(BOB, UPDATE, "staff", grantee);
    accessControl.checkCanDenySchemaPrivilege(BOB, UPDATE, "authenticated", grantee);
    assertDenied(() -> accessControl.checkCanDenySchemaPrivilege(BOB, UPDATE, "test", grantee));
    assertDenied(() -> accessControl.checkCanDenySchemaPrivilege(CHARLIE, UPDATE, "bob", grantee));
    assertDenied(() -> accessControl.checkCanDenySchemaPrivilege(CHARLIE, UPDATE, "staff", grantee));
    accessControl.checkCanDenySchemaPrivilege(CHARLIE, UPDATE, "authenticated", grantee);
    assertDenied(() -> accessControl.checkCanDenySchemaPrivilege(CHARLIE, UPDATE, "test", grantee));
}

Example 15 with ConnectorAccessControl

use of io.trino.spi.connector.ConnectorAccessControl in project trino by trinodb.

the class TestFileBasedAccessControl method testGrantSchemaPrivilege.

@Test(dataProvider = "privilegeGrantOption")
public void testGrantSchemaPrivilege(Privilege privilege, boolean grantOption) {
    ConnectorAccessControl accessControl = createAccessControl("schema.json");
    TrinoPrincipal grantee = new TrinoPrincipal(PrincipalType.USER, "alice");
    accessControl.checkCanGrantSchemaPrivilege(ADMIN, privilege, "bob", grantee, grantOption);
    accessControl.checkCanGrantSchemaPrivilege(ADMIN, privilege, "staff", grantee, grantOption);
    accessControl.checkCanGrantSchemaPrivilege(ADMIN, privilege, "authenticated", grantee, grantOption);
    accessControl.checkCanGrantSchemaPrivilege(ADMIN, privilege, "test", grantee, grantOption);
    accessControl.checkCanGrantSchemaPrivilege(BOB, privilege, "bob", grantee, grantOption);
    accessControl.checkCanGrantSchemaPrivilege(BOB, privilege, "staff", grantee, grantOption);
    accessControl.checkCanGrantSchemaPrivilege(BOB, privilege, "authenticated", grantee, grantOption);
    assertDenied(() -> accessControl.checkCanGrantSchemaPrivilege(BOB, privilege, "test", grantee, grantOption));
    assertDenied(() -> accessControl.checkCanGrantSchemaPrivilege(CHARLIE, privilege, "bob", grantee, grantOption));
    assertDenied(() -> accessControl.checkCanGrantSchemaPrivilege(CHARLIE, privilege, "staff", grantee, grantOption));
    accessControl.checkCanGrantSchemaPrivilege(CHARLIE, privilege, "authenticated", grantee, grantOption);
    assertDenied(() -> accessControl.checkCanGrantSchemaPrivilege(CHARLIE, privilege, "test", grantee, grantOption));
}