Examples with TransactionManager io.trino.transaction.TransactionManager used on opensource projects

Example 41 with TransactionManager

use of io.trino.transaction.TransactionManager in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testCanImpersonateUserOperations.

@Test
public void testCanImpersonateUserOperations() {
    TransactionManager transactionManager = createTestTransactionManager();
    AccessControlManager accessControlManager = newAccessControlManager(transactionManager, "catalog_impersonation.json");
    accessControlManager.checkCanImpersonateUser(Identity.ofUser("alice"), "bob");
    accessControlManager.checkCanImpersonateUser(Identity.ofUser("alice"), "charlie");
    try {
        accessControlManager.checkCanImpersonateUser(Identity.ofUser("alice"), "admin");
        throw new AssertionError("expected AccessDeniedException");
    } catch (AccessDeniedException expected) {
    }
    accessControlManager.checkCanImpersonateUser(Identity.ofUser("admin"), "alice");
    accessControlManager.checkCanImpersonateUser(Identity.ofUser("admin"), "bob");
    accessControlManager.checkCanImpersonateUser(Identity.ofUser("admin"), "anything");
    accessControlManager.checkCanImpersonateUser(Identity.ofUser("admin-other"), "anything");
    try {
        accessControlManager.checkCanImpersonateUser(Identity.ofUser("admin-test"), "alice");
        throw new AssertionError("expected AccessDeniedException");
    } catch (AccessDeniedException expected) {
    }
    try {
        accessControlManager.checkCanImpersonateUser(Identity.ofUser("invalid"), "alice");
        throw new AssertionError("expected AccessDeniedException");
    } catch (AccessDeniedException expected) {
    }
    accessControlManager.checkCanImpersonateUser(Identity.ofUser("anything"), "test");
    try {
        accessControlManager.checkCanImpersonateUser(Identity.ofUser("invalid-other"), "test");
        throw new AssertionError("expected AccessDeniedException");
    } catch (AccessDeniedException expected) {
    }
    accessControlManager = newAccessControlManager(transactionManager, "catalog_principal.json");
    accessControlManager.checkCanImpersonateUser(Identity.ofUser("anything"), "anythingElse");
}

Example 42 with TransactionManager

use of io.trino.transaction.TransactionManager in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testTableOperations.

@Test
public void testTableOperations() {
    TransactionManager transactionManager = createTestTransactionManager();
    AccessControlManager accessControlManager = newAccessControlManager(transactionManager, "catalog.json");
    transaction(transactionManager, accessControlManager).execute(transactionId -> {
        Set<SchemaTableName> aliceTables = ImmutableSet.of(new SchemaTableName("schema", "table"));
        SecurityContext aliceContext = new SecurityContext(transactionId, alice, queryId);
        SecurityContext bobContext = new SecurityContext(transactionId, bob, queryId);
        SecurityContext nonAsciiContext = new SecurityContext(transactionId, nonAsciiUser, queryId);
        assertEquals(accessControlManager.filterTables(aliceContext, "alice-catalog", aliceTables), aliceTables);
        assertEquals(accessControlManager.filterTables(aliceContext, "staff-catalog", aliceTables), aliceTables);
        assertEquals(accessControlManager.filterTables(bobContext, "alice-catalog", aliceTables), ImmutableSet.of());
        assertEquals(accessControlManager.filterTables(bobContext, "staff-catalog", aliceTables), aliceTables);
        assertEquals(accessControlManager.filterTables(nonAsciiContext, "alice-catalog", aliceTables), ImmutableSet.of());
        assertEquals(accessControlManager.filterTables(nonAsciiContext, "staff-catalog", aliceTables), ImmutableSet.of());
        accessControlManager.checkCanCreateTable(aliceContext, aliceTable, Map.of());
        accessControlManager.checkCanDropTable(aliceContext, aliceTable);
        accessControlManager.checkCanTruncateTable(aliceContext, aliceTable);
        accessControlManager.checkCanSelectFromColumns(aliceContext, aliceTable, ImmutableSet.of());
        accessControlManager.checkCanCreateViewWithSelectFromColumns(aliceContext, aliceTable, ImmutableSet.of());
        accessControlManager.checkCanInsertIntoTable(aliceContext, aliceTable);
        accessControlManager.checkCanDeleteFromTable(aliceContext, aliceTable);
        accessControlManager.checkCanSetTableProperties(aliceContext, aliceTable, ImmutableMap.of());
        accessControlManager.checkCanAddColumns(aliceContext, aliceTable);
        accessControlManager.checkCanRenameColumn(aliceContext, aliceTable);
        accessControlManager.checkCanCreateTable(aliceContext, staffTable, Map.of());
        accessControlManager.checkCanDropTable(aliceContext, staffTable);
        accessControlManager.checkCanTruncateTable(aliceContext, staffTable);
        accessControlManager.checkCanSelectFromColumns(aliceContext, staffTable, ImmutableSet.of());
        accessControlManager.checkCanCreateViewWithSelectFromColumns(aliceContext, staffTable, ImmutableSet.of());
        accessControlManager.checkCanInsertIntoTable(aliceContext, staffTable);
        accessControlManager.checkCanDeleteFromTable(aliceContext, staffTable);
        accessControlManager.checkCanSetTableProperties(aliceContext, staffTable, ImmutableMap.of());
        accessControlManager.checkCanAddColumns(aliceContext, staffTable);
        accessControlManager.checkCanRenameColumn(aliceContext, staffTable);
        assertThatThrownBy(() -> accessControlManager.checkCanCreateTable(bobContext, aliceTable, Map.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanDropTable(bobContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanTruncateTable(bobContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanSelectFromColumns(bobContext, aliceTable, ImmutableSet.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanCreateViewWithSelectFromColumns(bobContext, aliceTable, ImmutableSet.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanInsertIntoTable(bobContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanDeleteFromTable(bobContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanSetTableProperties(bobContext, aliceTable, ImmutableMap.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanAddColumns(bobContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanRenameColumn(bobContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        accessControlManager.checkCanCreateTable(bobContext, staffTable, Map.of());
        accessControlManager.checkCanDropTable(bobContext, staffTable);
        accessControlManager.checkCanTruncateTable(bobContext, staffTable);
        accessControlManager.checkCanSelectFromColumns(bobContext, staffTable, ImmutableSet.of());
        accessControlManager.checkCanCreateViewWithSelectFromColumns(bobContext, staffTable, ImmutableSet.of());
        accessControlManager.checkCanInsertIntoTable(bobContext, staffTable);
        accessControlManager.checkCanDeleteFromTable(bobContext, staffTable);
        accessControlManager.checkCanSetTableProperties(bobContext, staffTable, ImmutableMap.of());
        accessControlManager.checkCanAddColumns(bobContext, staffTable);
        accessControlManager.checkCanRenameColumn(bobContext, staffTable);
        assertThatThrownBy(() -> accessControlManager.checkCanCreateTable(nonAsciiContext, aliceTable, Map.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanDropTable(nonAsciiContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanTruncateTable(nonAsciiContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanSelectFromColumns(nonAsciiContext, aliceTable, ImmutableSet.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanCreateViewWithSelectFromColumns(nonAsciiContext, aliceTable, ImmutableSet.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanInsertIntoTable(nonAsciiContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanDeleteFromTable(nonAsciiContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanSetTableProperties(nonAsciiContext, aliceTable, ImmutableMap.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanAddColumns(nonAsciiContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanRenameColumn(nonAsciiContext, aliceTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanCreateTable(nonAsciiContext, staffTable, Map.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog staff-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanDropTable(nonAsciiContext, staffTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog staff-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanTruncateTable(nonAsciiContext, staffTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog staff-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanSelectFromColumns(nonAsciiContext, staffTable, ImmutableSet.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog staff-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanCreateViewWithSelectFromColumns(nonAsciiContext, staffTable, ImmutableSet.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog staff-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanInsertIntoTable(nonAsciiContext, staffTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog staff-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanDeleteFromTable(nonAsciiContext, staffTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog staff-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanSetTableProperties(nonAsciiContext, staffTable, ImmutableMap.of())).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog staff-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanAddColumns(nonAsciiContext, staffTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog staff-catalog");
        assertThatThrownBy(() -> accessControlManager.checkCanRenameColumn(nonAsciiContext, staffTable)).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog staff-catalog");
    });
}

Example 43 with TransactionManager

use of io.trino.transaction.TransactionManager in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testTableOperationsReadOnly.

@Test
public void testTableOperationsReadOnly() {
    TransactionManager transactionManager = createTestTransactionManager();
    AccessControlManager accessControlManager = newAccessControlManager(transactionManager, "catalog_read_only.json");
    transaction(transactionManager, accessControlManager).execute(transactionId -> {
        Set<SchemaTableName> aliceTables = ImmutableSet.of(new SchemaTableName("schema", "table"));
        assertEquals(accessControlManager.filterTables(new SecurityContext(transactionId, alice, queryId), "alice-catalog", aliceTables), aliceTables);
        assertEquals(accessControlManager.filterTables(new SecurityContext(transactionId, bob, queryId), "alice-catalog", aliceTables), ImmutableSet.of());
        accessControlManager.checkCanSelectFromColumns(new SecurityContext(transactionId, alice, queryId), aliceTable, ImmutableSet.of());
    });
    assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
        accessControlManager.checkCanCreateTable(new SecurityContext(transactionId, alice, queryId), aliceTable, Map.of());
    })).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot create table alice-catalog.schema.table");
    assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
        accessControlManager.checkCanDropTable(new SecurityContext(transactionId, alice, queryId), aliceTable);
    })).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot drop table alice-catalog.schema.table");
    assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
        accessControlManager.checkCanTruncateTable(new SecurityContext(transactionId, alice, queryId), aliceTable);
    })).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot truncate table alice-catalog.schema.table");
    assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
        accessControlManager.checkCanInsertIntoTable(new SecurityContext(transactionId, alice, queryId), aliceTable);
    })).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot insert into table alice-catalog.schema.table");
    assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
        accessControlManager.checkCanDeleteFromTable(new SecurityContext(transactionId, alice, queryId), aliceTable);
    })).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot delete from table alice-catalog.schema.table");
    assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
        accessControlManager.checkCanSetTableProperties(new SecurityContext(transactionId, alice, queryId), aliceTable, ImmutableMap.of());
    })).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot set table properties to alice-catalog.schema.table");
    assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
        accessControlManager.checkCanAddColumns(new SecurityContext(transactionId, alice, queryId), aliceTable);
    })).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot add a column to table alice-catalog.schema.table");
    assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
        accessControlManager.checkCanRenameColumn(new SecurityContext(transactionId, alice, queryId), aliceTable);
    })).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot rename a column in table alice-catalog.schema.table");
    assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
        accessControlManager.checkCanCreateTable(new SecurityContext(transactionId, bob, queryId), aliceTable, Map.of());
    })).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
}

Example 44 with TransactionManager

use of io.trino.transaction.TransactionManager in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testCatalogOperations.

@Test
public void testCatalogOperations() {
    TransactionManager transactionManager = createTestTransactionManager();
    AccessControlManager accessControlManager = newAccessControlManager(transactionManager, "catalog.json");
    transaction(transactionManager, accessControlManager).execute(transactionId -> {
        assertEquals(accessControlManager.filterCatalogs(new SecurityContext(transactionId, admin, queryId), allCatalogs), allCatalogs);
        Set<String> aliceCatalogs = ImmutableSet.of("open-to-all", "alice-catalog", "all-allowed", "staff-catalog");
        assertEquals(accessControlManager.filterCatalogs(new SecurityContext(transactionId, alice, queryId), allCatalogs), aliceCatalogs);
        Set<String> bobCatalogs = ImmutableSet.of("open-to-all", "all-allowed", "staff-catalog");
        assertEquals(accessControlManager.filterCatalogs(new SecurityContext(transactionId, bob, queryId), allCatalogs), bobCatalogs);
        Set<String> nonAsciiUserCatalogs = ImmutableSet.of("open-to-all", "all-allowed", "\u0200\u0200\u0200");
        assertEquals(accessControlManager.filterCatalogs(new SecurityContext(transactionId, nonAsciiUser, queryId), allCatalogs), nonAsciiUserCatalogs);
    });
}

Example 45 with TransactionManager

use of io.trino.transaction.TransactionManager in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testCatalogOperationsReadOnly.

@Test
public void testCatalogOperationsReadOnly() {
    TransactionManager transactionManager = createTestTransactionManager();
    AccessControlManager accessControlManager = newAccessControlManager(transactionManager, "catalog_read_only.json");
    transaction(transactionManager, accessControlManager).execute(transactionId -> {
        assertEquals(accessControlManager.filterCatalogs(new SecurityContext(transactionId, admin, queryId), allCatalogs), allCatalogs);
        Set<String> aliceCatalogs = ImmutableSet.of("open-to-all", "alice-catalog", "all-allowed");
        assertEquals(accessControlManager.filterCatalogs(new SecurityContext(transactionId, alice, queryId), allCatalogs), aliceCatalogs);
        Set<String> bobCatalogs = ImmutableSet.of("open-to-all", "all-allowed");
        assertEquals(accessControlManager.filterCatalogs(new SecurityContext(transactionId, bob, queryId), allCatalogs), bobCatalogs);
        Set<String> nonAsciiUserCatalogs = ImmutableSet.of("open-to-all", "all-allowed", "\u0200\u0200\u0200");
        assertEquals(accessControlManager.filterCatalogs(new SecurityContext(transactionId, nonAsciiUser, queryId), allCatalogs), nonAsciiUserCatalogs);
    });
}