Skip to content

Commit

Permalink
Add grantor to HivePrivilegeInfo
Browse files Browse the repository at this point in the history 
Extracted-From: prestodb/presto#10904
  • Loading branch information
@sopel39
Andrii Rosa authored and sopel39 committed Jan 29, 2019
1 parent 0f2e2e3 commit 0ba3120
Show file tree
Hide file tree
Showing 10 changed files with 63 additions and 39 deletions.
13 changes: 7 additions & 6 deletions presto-hive/src/main/java/io/prestosql/plugin/hive/HiveMetadata.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -837,12 +837,13 @@ private static Table buildTableObject(

private static PrincipalPrivileges buildInitialPrivilegeSet(String tableOwner)
{
PrestoPrincipal grantor = new PrestoPrincipal(USER, tableOwner);
return new PrincipalPrivileges(
ImmutableMultimap.<String, HivePrivilegeInfo>builder()
.put(tableOwner, new HivePrivilegeInfo(HivePrivilege.SELECT, true))
.put(tableOwner, new HivePrivilegeInfo(HivePrivilege.INSERT, true))
.put(tableOwner, new HivePrivilegeInfo(HivePrivilege.UPDATE, true))
.put(tableOwner, new HivePrivilegeInfo(HivePrivilege.DELETE, true))
.put(tableOwner, new HivePrivilegeInfo(HivePrivilege.SELECT, true, grantor))
.put(tableOwner, new HivePrivilegeInfo(HivePrivilege.INSERT, true, grantor))
.put(tableOwner, new HivePrivilegeInfo(HivePrivilege.UPDATE, true, grantor))
.put(tableOwner, new HivePrivilegeInfo(HivePrivilege.DELETE, true, grantor))
.build(),
ImmutableMultimap.of());
}
Expand Down Expand Up @@ -1820,7 +1821,7 @@ public void grantTablePrivileges(ConnectorSession session, SchemaTableName schem
String tableName = schemaTableName.getTableName();

Set<HivePrivilegeInfo> hivePrivilegeInfos = privileges.stream()
.map(privilege -> new HivePrivilegeInfo(toHivePrivilege(privilege), grantOption))
.map(privilege -> new HivePrivilegeInfo(toHivePrivilege(privilege), grantOption, new PrestoPrincipal(USER, session.getUser())))
.collect(toSet());

metastore.grantTablePrivileges(schemaName, tableName, grantee, hivePrivilegeInfos);
Expand All @@ -1833,7 +1834,7 @@ public void revokeTablePrivileges(ConnectorSession session, SchemaTableName sche
String tableName = schemaTableName.getTableName();

Set<HivePrivilegeInfo> hivePrivilegeInfos = privileges.stream()
.map(privilege -> new HivePrivilegeInfo(toHivePrivilege(privilege), grantOption))
.map(privilege -> new HivePrivilegeInfo(toHivePrivilege(privilege), grantOption, new PrestoPrincipal(USER, session.getUser())))
.collect(toSet());

metastore.revokeTablePrivileges(schemaName, tableName, grantee, hivePrivilegeInfos);
Expand Down
12 changes: 11 additions & 1 deletion presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/HivePrivilegeInfo.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
import com.fasterxml.jackson.annotation.JsonCreator;
import com.fasterxml.jackson.annotation.JsonProperty;
import com.google.common.collect.ImmutableSet;
import io.prestosql.spi.security.PrestoPrincipal;
import io.prestosql.spi.security.Privilege;
import io.prestosql.spi.security.PrivilegeInfo;

Expand Down Expand Up @@ -43,14 +44,17 @@ public enum HivePrivilege

private final HivePrivilege hivePrivilege;
private final boolean grantOption;
private final PrestoPrincipal grantor;

@JsonCreator
public HivePrivilegeInfo(
@JsonProperty("hivePrivilege") HivePrivilege hivePrivilege,
@JsonProperty("grantOption") boolean grantOption)
@JsonProperty("grantOption") boolean grantOption,
@JsonProperty("grantor") PrestoPrincipal grantor)
{
this.hivePrivilege = requireNonNull(hivePrivilege, "hivePrivilege is null");
this.grantOption = grantOption;
this.grantor = requireNonNull(grantor, "grantor is null");
}

@JsonProperty
Expand All @@ -65,6 +69,12 @@ public boolean isGrantOption()
return grantOption;
}

@JsonProperty
public PrestoPrincipal getGrantor()
{
return grantor;
}

public static HivePrivilege toHivePrivilege(Privilege privilege)
{
switch (privilege) {
Expand Down
3 changes: 2 additions & 1 deletion ...hive/src/main/java/io/prestosql/plugin/hive/metastore/SemiTransactionalHiveMetastore.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@
import static io.prestosql.spi.StandardErrorCode.ALREADY_EXISTS;
import static io.prestosql.spi.StandardErrorCode.NOT_SUPPORTED;
import static io.prestosql.spi.StandardErrorCode.TRANSACTION_CONFLICT;
import static io.prestosql.spi.security.PrincipalType.USER;
import static java.lang.String.format;
import static java.util.Objects.requireNonNull;
import static org.apache.hadoop.hive.common.FileUtils.makePartName;
Expand Down Expand Up @@ -788,7 +789,7 @@ public synchronized Set<HivePrivilegeInfo> listTablePrivileges(String databaseNa
Collection<HivePrivilegeInfo> privileges = tableAction.getData().getPrincipalPrivileges().getUserPrivileges().get(principal.getName());
return ImmutableSet.<HivePrivilegeInfo>builder()
.addAll(privileges)
.add(new HivePrivilegeInfo(OWNERSHIP, true))
.add(new HivePrivilegeInfo(OWNERSHIP, true, new PrestoPrincipal(USER, principal.getName())))
.build();
}
case INSERT_EXISTING:
Expand Down
2 changes: 1 addition & 1 deletion presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/file/FileHiveMetastore.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -944,7 +944,7 @@ public synchronized Set<HivePrivilegeInfo> listTablePrivileges(String databaseNa
ImmutableSet.Builder<HivePrivilegeInfo> result = ImmutableSet.builder();
Table table = getRequiredTable(databaseName, tableName);
if (principal.getType() == USER && table.getOwner().equals(principal.getName())) {
result.add(new HivePrivilegeInfo(OWNERSHIP, true));
result.add(new HivePrivilegeInfo(OWNERSHIP, true, principal));
}
Path permissionFilePath = getPermissionsPath(getPermissionsDirectory(table), principal);
result.addAll(readFile("permissions", permissionFilePath, permissionsCodec).orElse(ImmutableList.of()).stream()
Expand Down
4 changes: 3 additions & 1 deletion presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/file/PermissionMetadata.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,9 @@
import com.fasterxml.jackson.annotation.JsonProperty;
import io.prestosql.plugin.hive.metastore.HivePrivilegeInfo;
import io.prestosql.plugin.hive.metastore.HivePrivilegeInfo.HivePrivilege;
import io.prestosql.spi.security.PrestoPrincipal;

import static io.prestosql.spi.security.PrincipalType.USER;
import static java.util.Objects.requireNonNull;

public class PermissionMetadata
Expand Down Expand Up @@ -54,6 +56,6 @@ public boolean isGrantOption()

public HivePrivilegeInfo toHivePrivilegeInfo()
{
return new HivePrivilegeInfo(permission, grantOption);
return new HivePrivilegeInfo(permission, grantOption, new PrestoPrincipal(USER, "admin"));
}
}
7 changes: 3 additions & 4 deletions presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftHiveMetastore.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,6 @@
import static io.prestosql.plugin.hive.metastore.thrift.ThriftMetastoreUtil.getHiveBasicStatistics;
import static io.prestosql.plugin.hive.metastore.thrift.ThriftMetastoreUtil.parsePrivilege;
import static io.prestosql.plugin.hive.metastore.thrift.ThriftMetastoreUtil.toMetastoreApiPartition;
import static io.prestosql.plugin.hive.metastore.thrift.ThriftMetastoreUtil.toMetastoreApiPrivilegeGrantInfo;
import static io.prestosql.plugin.hive.metastore.thrift.ThriftMetastoreUtil.updateStatisticsParameters;
import static io.prestosql.spi.StandardErrorCode.ALREADY_EXISTS;
import static io.prestosql.spi.StandardErrorCode.NOT_SUPPORTED;
Expand Down Expand Up @@ -1155,7 +1154,7 @@ public List<Partition> getPartitionsByNames(String databaseName, String tableNam
public void grantTablePrivileges(String databaseName, String tableName, PrestoPrincipal grantee, Set<HivePrivilegeInfo> privileges)
{
Set<PrivilegeGrantInfo> requestedPrivileges = privileges.stream()
.map(privilege -> toMetastoreApiPrivilegeGrantInfo(grantee, privilege))
.map(ThriftMetastoreUtil::toMetastoreApiPrivilegeGrantInfo)
.collect(Collectors.toSet());
checkArgument(!containsAllPrivilege(requestedPrivileges), "\"ALL\" not supported in PrivilegeGrantInfo.privilege");

Expand Down Expand Up @@ -1206,7 +1205,7 @@ else if (existingPrivilege.isContainedIn(requestedPrivilege)) {
public void revokeTablePrivileges(String databaseName, String tableName, PrestoPrincipal grantee, Set<HivePrivilegeInfo> privileges)
{
Set<PrivilegeGrantInfo> requestedPrivileges = privileges.stream()
.map(privilege -> toMetastoreApiPrivilegeGrantInfo(grantee, privilege))
.map(ThriftMetastoreUtil::toMetastoreApiPrivilegeGrantInfo)
.collect(Collectors.toSet());
checkArgument(!containsAllPrivilege(requestedPrivileges), "\"ALL\" not supported in PrivilegeGrantInfo.privilege");

Expand Down Expand Up @@ -1251,7 +1250,7 @@ public Set<HivePrivilegeInfo> listTablePrivileges(String databaseName, String ta
Table table = client.getTable(databaseName, tableName);
ImmutableSet.Builder<HivePrivilegeInfo> privileges = ImmutableSet.builder();
if (principal.getType() == USER && table.getOwner().equals(principal.getName())) {
privileges.add(new HivePrivilegeInfo(OWNERSHIP, true));
privileges.add(new HivePrivilegeInfo(OWNERSHIP, true, principal));
}
List<HiveObjectPrivilege> hiveObjectPrivilegeList = client.listPrivileges(
principal.getName(),
Expand Down
29 changes: 16 additions & 13 deletions presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftMetastoreUtil.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,7 @@
import static java.lang.Math.round;
import static java.lang.String.format;
import static java.util.Locale.ENGLISH;
import static java.util.Objects.requireNonNull;
import static java.util.stream.Collectors.toList;
import static java.util.stream.Collectors.toSet;
import static org.apache.hadoop.hive.metastore.api.ColumnStatisticsData.binaryStats;
Expand Down Expand Up @@ -168,38 +169,38 @@ public static org.apache.hadoop.hive.metastore.api.Table toMetastoreApiTable(Tab
result.setParameters(table.getParameters());
result.setPartitionKeys(table.getPartitionColumns().stream().map(ThriftMetastoreUtil::toMetastoreApiFieldSchema).collect(toList()));
result.setSd(makeStorageDescriptor(table.getTableName(), table.getDataColumns(), table.getStorage()));
result.setPrivileges(toMetastoreApiPrincipalPrivilegeSet(new PrestoPrincipal(USER, table.getOwner()), privileges));
result.setPrivileges(toMetastoreApiPrincipalPrivilegeSet(privileges));
result.setViewOriginalText(table.getViewOriginalText().orElse(null));
result.setViewExpandedText(table.getViewExpandedText().orElse(null));
return result;
}

private static PrincipalPrivilegeSet toMetastoreApiPrincipalPrivilegeSet(PrestoPrincipal grantee, PrincipalPrivileges privileges)
private static PrincipalPrivilegeSet toMetastoreApiPrincipalPrivilegeSet(PrincipalPrivileges privileges)
{
ImmutableMap.Builder<String, List<PrivilegeGrantInfo>> userPrivileges = ImmutableMap.builder();
for (Map.Entry<String, Collection<HivePrivilegeInfo>> entry : privileges.getUserPrivileges().asMap().entrySet()) {
userPrivileges.put(entry.getKey(), entry.getValue().stream()
.map(privilegeInfo -> toMetastoreApiPrivilegeGrantInfo(grantee, privilegeInfo))
.map(ThriftMetastoreUtil::toMetastoreApiPrivilegeGrantInfo)
.collect(toList()));
}

ImmutableMap.Builder<String, List<PrivilegeGrantInfo>> rolePrivileges = ImmutableMap.builder();
for (Map.Entry<String, Collection<HivePrivilegeInfo>> entry : privileges.getRolePrivileges().asMap().entrySet()) {
rolePrivileges.put(entry.getKey(), entry.getValue().stream()
.map(privilegeInfo -> toMetastoreApiPrivilegeGrantInfo(grantee, privilegeInfo))
.map(ThriftMetastoreUtil::toMetastoreApiPrivilegeGrantInfo)
.collect(toList()));
}

return new PrincipalPrivilegeSet(userPrivileges.build(), ImmutableMap.of(), rolePrivileges.build());
}

public static PrivilegeGrantInfo toMetastoreApiPrivilegeGrantInfo(PrestoPrincipal grantee, HivePrivilegeInfo privilegeInfo)
public static PrivilegeGrantInfo toMetastoreApiPrivilegeGrantInfo(HivePrivilegeInfo privilegeInfo)
{
return new PrivilegeGrantInfo(
privilegeInfo.getHivePrivilege().name().toLowerCase(Locale.ENGLISH),
0,
grantee.getName(),
fromPrestoPrincipalType(grantee.getType()),
privilegeInfo.getGrantor().getName(),
fromPrestoPrincipalType(privilegeInfo.getGrantor().getType()),
privilegeInfo.isGrantOption());
}

Expand Down Expand Up @@ -585,6 +586,7 @@ public static org.apache.hadoop.hive.metastore.api.PrincipalType fromPrestoPrinc

public static PrincipalType fromMetastoreApiPrincipalType(org.apache.hadoop.hive.metastore.api.PrincipalType principalType)
{
requireNonNull(principalType, "principalType is null");
switch (principalType) {
case USER:
return USER;
Expand Down Expand Up @@ -657,21 +659,22 @@ public static Set<HivePrivilegeInfo> parsePrivilege(PrivilegeGrantInfo userGrant
{
boolean withGrantOption = userGrant.isGrantOption();
String name = userGrant.getPrivilege().toUpperCase(ENGLISH);
PrestoPrincipal grantor = new PrestoPrincipal(ThriftMetastoreUtil.fromMetastoreApiPrincipalType(userGrant.getGrantorType()), userGrant.getGrantor());
switch (name) {
case "ALL":
return Arrays.stream(HivePrivilegeInfo.HivePrivilege.values())
.map(hivePrivilege -> new HivePrivilegeInfo(hivePrivilege, withGrantOption))
.map(hivePrivilege -> new HivePrivilegeInfo(hivePrivilege, withGrantOption, grantor))
.collect(toImmutableSet());
case "SELECT":
return ImmutableSet.of(new HivePrivilegeInfo(SELECT, withGrantOption));
return ImmutableSet.of(new HivePrivilegeInfo(SELECT, withGrantOption, grantor));
case "INSERT":
return ImmutableSet.of(new HivePrivilegeInfo(INSERT, withGrantOption));
return ImmutableSet.of(new HivePrivilegeInfo(INSERT, withGrantOption, grantor));
case "UPDATE":
return ImmutableSet.of(new HivePrivilegeInfo(UPDATE, withGrantOption));
return ImmutableSet.of(new HivePrivilegeInfo(UPDATE, withGrantOption, grantor));
case "DELETE":
return ImmutableSet.of(new HivePrivilegeInfo(DELETE, withGrantOption));
return ImmutableSet.of(new HivePrivilegeInfo(DELETE, withGrantOption, grantor));
case "OWNERSHIP":
return ImmutableSet.of(new HivePrivilegeInfo(OWNERSHIP, withGrantOption));
return ImmutableSet.of(new HivePrivilegeInfo(OWNERSHIP, withGrantOption, grantor));
default:
throw new IllegalArgumentException("Unsupported privilege name: " + name);
}
Expand Down
4 changes: 2 additions & 2 deletions presto-hive/src/main/java/io/prestosql/plugin/hive/security/SqlStandardAccessControl.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@
import io.prestosql.plugin.hive.HiveConnectorId;
import io.prestosql.plugin.hive.HiveTransactionHandle;
import io.prestosql.plugin.hive.metastore.Database;
import io.prestosql.plugin.hive.metastore.HivePrivilegeInfo;
import io.prestosql.plugin.hive.metastore.SemiTransactionalHiveMetastore;
import io.prestosql.spi.connector.ConnectorAccessControl;
import io.prestosql.spi.connector.ConnectorTransactionHandle;
Expand Down Expand Up @@ -419,7 +418,8 @@ private boolean hasGrantOptionForPrivilege(ConnectorTransactionHandle transactio
tableName.getSchemaName(),
tableName.getTableName(),
identity.getUser())
.contains(new HivePrivilegeInfo(toHivePrivilege(privilege), true));
.stream()
.anyMatch(privilegeInfo -> privilegeInfo.getHivePrivilege().equals(toHivePrivilege(privilege)) && privilegeInfo.isGrantOption());
}

private boolean hasAdminOptionForRoles(ConnectorTransactionHandle transaction, ConnectorIdentity identity, Set<String> roles)
Expand Down
Loading

0 comments on commit 0ba3120

Please sign in to comment.