Examples with ViewExpression io.trino.spi.security.ViewExpression used on opensource projects

Example 26 with ViewExpression

use of io.trino.spi.security.ViewExpression in project trino by trinodb.

the class TestAccessControlManager method testColumnMaskOrdering.

@Test
public void testColumnMaskOrdering() {
    try (LocalQueryRunner queryRunner = LocalQueryRunner.create(TEST_SESSION)) {
        TransactionManager transactionManager = queryRunner.getTransactionManager();
        AccessControlManager accessControlManager = createAccessControlManager(transactionManager);
        accessControlManager.addSystemAccessControlFactory(new SystemAccessControlFactory() {

            @Override
            public String getName() {
                return "test";
            }

            @Override
            public SystemAccessControl create(Map<String, String> config) {
                return new SystemAccessControl() {

                    @Override
                    public Optional<ViewExpression> getColumnMask(SystemSecurityContext context, CatalogSchemaTableName tableName, String column, Type type) {
                        return Optional.of(new ViewExpression("user", Optional.empty(), Optional.empty(), "system mask"));
                    }

                    @Override
                    public void checkCanSetSystemSessionProperty(SystemSecurityContext context, String propertyName) {
                    }
                };
            }
        });
        accessControlManager.setSystemAccessControl("test", ImmutableMap.of());
        queryRunner.createCatalog("catalog", MockConnectorFactory.create(), ImmutableMap.of());
        accessControlManager.addCatalogAccessControl(new CatalogName("catalog"), new ConnectorAccessControl() {

            @Override
            public Optional<ViewExpression> getColumnMask(ConnectorSecurityContext context, SchemaTableName tableName, String column, Type type) {
                return Optional.of(new ViewExpression("user", Optional.empty(), Optional.empty(), "connector mask"));
            }

            @Override
            public void checkCanShowCreateTable(ConnectorSecurityContext context, SchemaTableName tableName) {
            }
        });
        transaction(transactionManager, accessControlManager).execute(transactionId -> {
            List<ViewExpression> masks = accessControlManager.getColumnMasks(context(transactionId), new QualifiedObjectName("catalog", "schema", "table"), "column", BIGINT);
            assertEquals(masks.get(0).getExpression(), "connector mask");
            assertEquals(masks.get(1).getExpression(), "system mask");
        });
    }
}

Example 27 with ViewExpression

use of io.trino.spi.security.ViewExpression in project trino by trinodb.

the class AccessControlManager method getColumnMasks.

@Override
public List<ViewExpression> getColumnMasks(SecurityContext context, QualifiedObjectName tableName, String columnName, Type type) {
    requireNonNull(context, "context is null");
    requireNonNull(tableName, "tableName is null");
    ImmutableList.Builder<ViewExpression> masks = ImmutableList.builder();
    // connector-provided masks take precedence over global masks
    CatalogAccessControlEntry entry = getConnectorAccessControl(context.getTransactionId(), tableName.getCatalogName());
    if (entry != null) {
        entry.getAccessControl().getColumnMask(entry.toConnectorSecurityContext(context), tableName.asSchemaTableName(), columnName, type).ifPresent(masks::add);
    }
    for (SystemAccessControl systemAccessControl : getSystemAccessControls()) {
        systemAccessControl.getColumnMask(context.toSystemSecurityContext(), tableName.asCatalogSchemaTableName(), columnName, type).ifPresent(masks::add);
    }
    return masks.build();
}

Example 28 with ViewExpression

use of io.trino.spi.security.ViewExpression in project trino by trinodb.

the class AccessControlManager method getRowFilters.

@Override
public List<ViewExpression> getRowFilters(SecurityContext context, QualifiedObjectName tableName) {
    requireNonNull(context, "context is null");
    requireNonNull(tableName, "tableName is null");
    ImmutableList.Builder<ViewExpression> filters = ImmutableList.builder();
    CatalogAccessControlEntry entry = getConnectorAccessControl(context.getTransactionId(), tableName.getCatalogName());
    if (entry != null) {
        entry.getAccessControl().getRowFilter(entry.toConnectorSecurityContext(context), tableName.asSchemaTableName()).ifPresent(filters::add);
    }
    for (SystemAccessControl systemAccessControl : getSystemAccessControls()) {
        systemAccessControl.getRowFilter(context.toSystemSecurityContext(), tableName.asCatalogSchemaTableName()).ifPresent(filters::add);
    }
    return filters.build();
}

Example 29 with ViewExpression

use of io.trino.spi.security.ViewExpression in project trino by trinodb.

the class TestRowFilter method testDifferentIdentity.

@Test
public void testDifferentIdentity() {
    accessControl.reset();
    accessControl.rowFilter(new QualifiedObjectName(CATALOG, "tiny", "orders"), RUN_AS_USER, new ViewExpression(RUN_AS_USER, Optional.of(CATALOG), Optional.of("tiny"), "orderkey = 1"));
    accessControl.rowFilter(new QualifiedObjectName(CATALOG, "tiny", "orders"), USER, new ViewExpression(RUN_AS_USER, Optional.of(CATALOG), Optional.of("tiny"), "orderkey IN (SELECT orderkey FROM orders)"));
    assertThat(assertions.query("SELECT count(*) FROM orders")).matches("VALUES BIGINT '1'");
}

Example 30 with ViewExpression

use of io.trino.spi.security.ViewExpression in project trino by trinodb.

the class TestRowFilter method testOtherSchema.

@Test
public void testOtherSchema() {
    accessControl.reset();
    accessControl.rowFilter(new QualifiedObjectName(CATALOG, "tiny", "orders"), USER, // Filter is TRUE only if evaluating against sf1.customer
    new ViewExpression(USER, Optional.of(CATALOG), Optional.of("sf1"), "(SELECT count(*) FROM customer) = 150000"));
    assertThat(assertions.query("SELECT count(*) FROM orders")).matches("VALUES BIGINT '15000'");
}