Skip to content

Commit 4f5e850

Browse files
AngersZhuuuuAngersZhuuuu
committed
update
1 parent 64349ed commit 4f5e850

File tree

3 files changed

+27
-25
lines changed

3 files changed

+27
-25
lines changed

‎extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilder.scala‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -107,16 +107,16 @@ object PrivilegesBuilder {
107107
// For case 1, we should pass it's input as projection list
108108
// since it's children's columns was pruned.
109109
// For case too, we just skip.
110-
if (columnPrune(p.references.toSeq, p.inputSet).isEmpty) {
110+
if (columnPrune(p.references.toSeq ++ p.output, p.inputSet).isEmpty) {
111111
// If plan is project and output don't have relation to input, can ignore.
112-
if (!p.isInstanceOf[Project]) {
112+
// if (!p.isInstanceOf[Project]) {
113113
buildQuery(
114114
child,
115115
privilegeObjects,
116116
p.inputSet.map(_.toAttribute).toSeq,
117117
Nil,
118118
spark)
119-
}
119+
// }
120120
} else {
121121
buildQuery(
122122
child,
@@ -314,6 +314,7 @@ object PrivilegesBuilder {
314314
case cmd: Command => buildCommand(cmd, inputObjs, outputObjs, spark)
315315
// Queries
316316
case _ =>
317+
println(Project(plan.output, plan))
317318
buildQuery(Project(plan.output, plan), inputObjs, spark = spark)
318319
OperationType.QUERY
319320
}

‎extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilderSuite.scala‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -367,7 +367,7 @@ abstract class PrivilegesBuilderSuite extends AnyFunSuite
367367
assertEqualsIgnoreCase(reusedPartTableShort)(po0.objectName)
368368
if (isSparkV32OrGreater) {
369369
// Query in AlterViewAsCommand can not be resolved before SPARK-34698
370-
assert(po0.columns === Seq("key", "value", "pid"))
370+
assert(po0.columns === Seq("key", "pid", "value"))
371371
checkTableOwner(po0)
372372
}
373373
val accessType0 = ranger.AccessType(po0, operationType, isInput = true)
@@ -995,15 +995,15 @@ abstract class PrivilegesBuilderSuite extends AnyFunSuite
995995
test("Query: Function") {
996996
checkColumns(
997997
s"select coalesce(max(key), pid, 1) from $reusedPartTable group by pid",
998-
Seq("pid", "key"))
998+
Seq("key", "pid"))
999999
}
10001000

10011001
test("Query: CTE") {
10021002
checkColumns(
10031003
s"""
10041004
|with t(c) as (select coalesce(max(key), pid, 1) from $reusedPartTable group by pid)
10051005
|select c from t where c = 1""".stripMargin,
1006-
Seq( "pid", "key"))
1006+
Seq("key", "pid"))
10071007
}
10081008

10091009
test("Query: Nested query") {
@@ -1052,7 +1052,7 @@ abstract class PrivilegesBuilderSuite extends AnyFunSuite
10521052
assertEqualsIgnoreCase(reusedDb)(po.dbname)
10531053
assertStartsWithIgnoreCase(reusedTableShort)(po.objectName)
10541054
assert(
1055-
po.columns === Seq("value", "pid", "key"),
1055+
po.columns === Seq("value", "key", "pid"),
10561056
s"$reusedPartTable both 'key', 'value' and 'pid' should be authenticated")
10571057
checkTableOwner(po)
10581058
val accessType = ranger.AccessType(po, operationType, isInput = true)
@@ -1220,7 +1220,7 @@ abstract class PrivilegesBuilderSuite extends AnyFunSuite
12201220
assertEqualsIgnoreCase(reusedDb)(po.dbname)
12211221
assertStartsWithIgnoreCase(reusedTableShort)(po.objectName)
12221222
assert(
1223-
po.columns === Seq("key", "value", "pid"),
1223+
po.columns === Seq("key", "pid", "value"),
12241224
s"$reusedPartTable both 'key', 'value' and 'pid' should be authenticated")
12251225
checkTableOwner(po)
12261226
val accessType = ranger.AccessType(po, operationType, isInput = true)
@@ -1491,7 +1491,7 @@ class HiveCatalogPrivilegeBuilderSuite extends PrivilegesBuilderSuite {
14911491
assert(po0.privilegeObjectType === PrivilegeObjectType.TABLE_OR_VIEW)
14921492
assertEqualsIgnoreCase(reusedDb)(po0.dbname)
14931493
assert(po0.objectName equalsIgnoreCase reusedPartTable.split("\\.").last)
1494-
assert(po0.columns === Seq("key", "value", "pid"))
1494+
assert(po0.columns === Seq("key", "pid", "value"))
14951495
checkTableOwner(po0)
14961496
val accessType0 = ranger.AccessType(po0, operationType, isInput = true)
14971497
assert(accessType0 === AccessType.SELECT)
@@ -1622,7 +1622,7 @@ class HiveCatalogPrivilegeBuilderSuite extends PrivilegesBuilderSuite {
16221622
assert(po0.privilegeObjectType === PrivilegeObjectType.TABLE_OR_VIEW)
16231623
assertEqualsIgnoreCase(reusedDb)(po0.dbname)
16241624
assert(po0.objectName equalsIgnoreCase reusedPartTable.split("\\.").last)
1625-
assert(po0.columns === Seq("key", "value", "pid"))
1625+
assert(po0.columns === Seq("key", "pid", "value"))
16261626
checkTableOwner(po0)
16271627
val accessType0 = ranger.AccessType(po0, operationType, isInput = true)
16281628
assert(accessType0 === AccessType.SELECT)
@@ -1655,7 +1655,7 @@ class HiveCatalogPrivilegeBuilderSuite extends PrivilegesBuilderSuite {
16551655
assert(po0.privilegeObjectType === PrivilegeObjectType.TABLE_OR_VIEW)
16561656
assertEqualsIgnoreCase(reusedDb)(po0.dbname)
16571657
assert(po0.objectName equalsIgnoreCase reusedPartTable.split("\\.").last)
1658-
assert(po0.columns === Seq("key", "value", "pid"))
1658+
assert(po0.columns === Seq("key", "pid", "value"))
16591659
checkTableOwner(po0)
16601660
val accessType0 = ranger.AccessType(po0, operationType, isInput = true)
16611661
assert(accessType0 === AccessType.SELECT)
@@ -1751,7 +1751,7 @@ class HiveCatalogPrivilegeBuilderSuite extends PrivilegesBuilderSuite {
17511751
assert(out1.isEmpty)
17521752
val pi1 = in1.head
17531753
assert(pi1.columns.size === 3)
1754-
assert(pi1.columns === Seq("pid", "key", "value"))
1754+
assert(pi1.columns === Seq("key", "pid", "value"))
17551755

17561756
// case2: Some columns are involved, and the group column is not selected.
17571757
val plan2 = sql(s"SELECT COUNT(key) FROM $reusedPartTable GROUP BY pid")
@@ -1761,7 +1761,7 @@ class HiveCatalogPrivilegeBuilderSuite extends PrivilegesBuilderSuite {
17611761
assert(out2.isEmpty)
17621762
val pi2 = in2.head
17631763
assert(pi2.columns.size === 2)
1764-
assert(pi2.columns === Seq("pid", "key"))
1764+
assert(pi2.columns === Seq("key", "pid"))
17651765

17661766
// case3: Some columns are involved, and the group column is selected.
17671767
val plan3 = sql(s"SELECT COUNT(key), pid FROM $reusedPartTable GROUP BY pid")
@@ -1781,7 +1781,7 @@ class HiveCatalogPrivilegeBuilderSuite extends PrivilegesBuilderSuite {
17811781
assert(out4.isEmpty)
17821782
val pi4 = in4.head
17831783
assert(pi4.columns.size === 2)
1784-
assert(pi4.columns === Seq("pid", "key"))
1784+
assert(pi4.columns === Seq("key", "pid"))
17851785
}
17861786
}
17871787

‎extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -641,14 +641,12 @@ class HiveCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite {
641641
s" FROM $db1.$srcTable1 as tb1" +
642642
s" JOIN $db1.$srcTable2 as tb2" +
643643
s" on tb1.id = tb2.id"
644-
val e1 = intercept[AccessControlException](doAs(someone, sql(insertSql1)))
645-
assert(e1.getMessage.contains(s"does not have [select] privilege on [$db1/$srcTable1/id]"))
646644

647645
withSingleCallEnabled {
648-
val e2 = intercept[AccessControlException](doAs(someone, sql(insertSql1)))
649-
assert(e2.getMessage.contains(s"does not have" +
646+
val e = intercept[AccessControlException](doAs(someone, sql(insertSql1)))
647+
assert(e.getMessage.contains(s"does not have" +
650648
s" [select] privilege on" +
651-
s" [$db1/$srcTable1/id,$db1/$srcTable1/name,$db1/$srcTable1/city," +
649+
s" [$db1/$srcTable1/city,$db1/$srcTable1/id,$db1/$srcTable1/name," +
652650
s"$db1/$srcTable2/age,$db1/$srcTable2/id]," +
653651
s" [update] privilege on [$db1/$sinkTable1/id,$db1/$sinkTable1/age," +
654652
s"$db1/$sinkTable1/name,$db1/$sinkTable1/city]"))
@@ -678,11 +676,14 @@ class HiveCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite {
678676
sql(s"CREATE TABLE IF NOT EXISTS $db1.$srcTable1" +
679677
s" (id int, name string, city string)"))
680678

681-
val e1 = intercept[AccessControlException](
682-
doAs(someone, sql(s"CACHE TABLE $cacheTable2 select * from $db1.$srcTable1")))
683-
assert(
684-
e1.getMessage.contains(s"does not have [select] privilege on [$db1/$srcTable1/id]"))
679+
withSingleCallEnabled {
680+
val e1 = intercept[AccessControlException](
681+
doAs(someone, sql(s"CACHE TABLE $cacheTable2 select * from $db1.$srcTable1")))
682+
assert(
683+
e1.getMessage.contains(s"does not have [select] privilege on " +
684+
s"[$db1/$srcTable1/city,$db1/$srcTable1/id,$db1/$srcTable1/name]"))
685685

686+
}
686687
doAs(admin, sql(s"CACHE TABLE $cacheTable3 SELECT 1 AS a, 2 AS b "))
687688
doAs(someone, sql(s"CACHE TABLE $cacheTable4 select 1 as a, 2 as b "))
688689
}
@@ -1325,7 +1326,7 @@ class HiveCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite {
13251326
doAs(
13261327
someone,
13271328
sql(s"SELECT typeof(id), typeof(typeof(day)) FROM $db1.$table1").collect()))(
1328-
s"does not have [select] privilege on [$db1/$table1/id,$db1/$table1/day]")
1329+
s"does not have [select] privilege on [$db1/$table1/day,$db1/$table1/id]")
13291330
interceptEndsWith[AccessControlException](
13301331
doAs(
13311332
someone,
@@ -1335,7 +1336,7 @@ class HiveCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite {
13351336
|typeof(cast(id as string)),
13361337
|typeof(substring(day, 1, 3))
13371338
|FROM $db1.$table1""".stripMargin).collect()))(
1338-
s"does not have [select] privilege on [$db1/$table1/id,$db1/$table1/day]")
1339+
s"does not have [select] privilege on [$db1/$table1/day,$db1/$table1/id]")
13391340
checkAnswer(
13401341
admin,
13411342
s"""

0 commit comments

Comments
 (0)