Skip to content

Commit

Permalink
Prevent view owner from being set when system security is used
Browse files Browse the repository at this point in the history
  • Loading branch information
@homar @findepi
homar authored and findepi committed Feb 16, 2024
1 parent ff1cddb commit 3a882e9
Show file tree
Hide file tree
Showing 2 changed files with 68 additions and 5 deletions.
2 changes: 1 addition & 1 deletion ...in/trino-iceberg/src/main/java/io/trino/plugin/iceberg/catalog/glue/TrinoGlueCatalog.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1151,7 +1151,7 @@ public void createMaterializedView(
TableInput materializedViewTableInput = getMaterializedViewTableInput(
viewName.getTableName(),
encodeMaterializedViewData(fromConnectorMaterializedViewDefinition(definition)),
session.getUser(),
isUsingSystemSecurity ? null : session.getUser(),
createMaterializedViewProperties(session, storageMetadataLocation));
if (existing.isPresent()) {
updateTable(viewName.getSchemaName(), materializedViewTableInput);
Expand Down
71 changes: 67 additions & 4 deletions ...rino-iceberg/src/test/java/io/trino/plugin/iceberg/catalog/glue/TestTrinoGlueCatalog.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
import com.amazonaws.services.glue.model.CreateDatabaseRequest;
import com.amazonaws.services.glue.model.DatabaseInput;
import com.amazonaws.services.glue.model.DeleteDatabaseRequest;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import io.airlift.log.Logger;
import io.trino.filesystem.TrinoFileSystemFactory;
Expand All @@ -31,7 +32,9 @@
import io.trino.plugin.iceberg.catalog.BaseTrinoCatalogTest;
import io.trino.plugin.iceberg.catalog.TrinoCatalog;
import io.trino.spi.connector.CatalogHandle;
import io.trino.spi.connector.ConnectorMaterializedViewDefinition;
import io.trino.spi.connector.ConnectorMetadata;
import io.trino.spi.connector.MaterializedViewNotFoundException;
import io.trino.spi.connector.SchemaTableName;
import io.trino.spi.security.PrincipalType;
import io.trino.spi.security.TrinoPrincipal;
Expand All @@ -42,10 +45,17 @@
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.List;
import java.util.Map;
import java.util.Optional;

import static io.airlift.json.JsonCodec.jsonCodec;
import static io.trino.plugin.hive.HiveTestUtils.HDFS_FILE_SYSTEM_FACTORY;
import static io.trino.plugin.iceberg.IcebergFileFormat.PARQUET;
import static io.trino.plugin.iceberg.IcebergSchemaProperties.LOCATION_PROPERTY;
import static io.trino.plugin.iceberg.IcebergTableProperties.FILE_FORMAT_PROPERTY;
import static io.trino.plugin.iceberg.IcebergTableProperties.FORMAT_VERSION_PROPERTY;
import static io.trino.spi.type.IntegerType.INTEGER;
import static io.trino.sql.planner.TestingPlannerContext.PLANNER_CONTEXT;
import static io.trino.testing.TestingConnectorSession.SESSION;
import static io.trino.testing.TestingNames.randomNameSuffix;
Expand All @@ -61,24 +71,28 @@ public class TestTrinoGlueCatalog
@Override
protected TrinoCatalog createTrinoCatalog(boolean useUniqueTableLocations)
{
TrinoFileSystemFactory fileSystemFactory = HDFS_FILE_SYSTEM_FACTORY;
return createGlueTrinoCatalog(useUniqueTableLocations, false);
}

private TrinoCatalog createGlueTrinoCatalog(boolean useUniqueTableLocations, boolean useSystemSecurity)
{
AWSGlueAsync glueClient = AWSGlueAsyncClientBuilder.defaultClient();
IcebergGlueCatalogConfig catalogConfig = new IcebergGlueCatalogConfig();
return new TrinoGlueCatalog(
new CatalogName("catalog_name"),
fileSystemFactory,
HDFS_FILE_SYSTEM_FACTORY,
new TestingTypeManager(),
catalogConfig.isCacheTableMetadata(),
new GlueIcebergTableOperationsProvider(
TESTING_TYPE_MANAGER,
catalogConfig,
fileSystemFactory,
HDFS_FILE_SYSTEM_FACTORY,
new GlueMetastoreStats(),
glueClient),
"test",
glueClient,
new GlueMetastoreStats(),
false,
useSystemSecurity,
Optional.empty(),
useUniqueTableLocations,
new IcebergConfig().isHideMaterializedViewStorageTable());
Expand Down Expand Up @@ -134,6 +148,55 @@ public void testNonLowercaseGlueDatabase()
}
}

@Test
public void testCreateMaterializedViewWithSystemSecurity()
{
TrinoCatalog glueTrinoCatalog = createGlueTrinoCatalog(false, true);
String namespace = "test_create_mv_" + randomNameSuffix();
String table = "materialized_view_name";
SchemaTableName viewName = new SchemaTableName(namespace, table);
Map<String, Object> properties = ImmutableMap.of(LOCATION_PROPERTY, "file:///tmp/a/path/");
try {
glueTrinoCatalog.createNamespace(SESSION, namespace, properties, new TrinoPrincipal(PrincipalType.USER, SESSION.getUser()));
glueTrinoCatalog.createMaterializedView(
SESSION,
viewName,
new ConnectorMaterializedViewDefinition(
"CREATE * FROM tpch.tiny.nations",
Optional.empty(),
Optional.of("catalog_name"),
Optional.of("schema_name"),
ImmutableList.of(new ConnectorMaterializedViewDefinition.Column("col1", INTEGER.getTypeId(), Optional.empty())),
Optional.empty(),
Optional.empty(),
Optional.of("test_owner"),
ImmutableList.of()),
ImmutableMap.of(FILE_FORMAT_PROPERTY, PARQUET, FORMAT_VERSION_PROPERTY, 1),
false,
false);
List<SchemaTableName> materializedViews = glueTrinoCatalog.listMaterializedViews(SESSION, Optional.of(namespace));
assertThat(materializedViews.size()).isEqualTo(1);
assertThat(materializedViews.get(0).getTableName()).isEqualTo(table);
Optional<ConnectorMaterializedViewDefinition> returned = glueTrinoCatalog.getMaterializedView(SESSION, materializedViews.get(0));
assertThat(returned).isPresent();
assertThat(returned.get().getOwner()).isEmpty();
}
finally {
try {
glueTrinoCatalog.dropMaterializedView(SESSION, viewName);
}
catch (MaterializedViewNotFoundException e) {
LOG.warn("Failed to clean up view: %s", viewName);
}
try {
glueTrinoCatalog.dropNamespace(SESSION, namespace);
}
catch (Exception e) {
LOG.warn("Failed to clean up namespace: %s", namespace);
}
}
}

@Test
public void testDefaultLocation()
throws IOException
Expand Down

0 comments on commit 3a882e9

Please sign in to comment.