From 15a2af788ec414e118f8ce634c7154e2ddc43775 Mon Sep 17 00:00:00 2001 From: Konrad Dziedzic Date: Fri, 21 Jul 2023 17:40:11 +0200 Subject: [PATCH 1/3] Create views correctly in TestAccessControl Not having a named column resulted in SemanticException claiming that View is in invalid state: "a column of type INTEGER projected from query view at position 1 has no name" --- .../src/test/java/io/trino/security/TestAccessControl.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java b/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java index bfaeacac2991..d0512656224f 100644 --- a/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java +++ b/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java @@ -158,7 +158,7 @@ protected SystemAccessControl delegate() }) .withGetViews((connectorSession, prefix) -> { ConnectorViewDefinition definitionRunAsDefiner = new ConnectorViewDefinition( - "select 1", + "SELECT 1 AS test", Optional.of("mock"), Optional.of("default"), ImmutableList.of(new ConnectorViewDefinition.ViewColumn("test", BIGINT.getTypeId(), Optional.empty())), @@ -166,7 +166,7 @@ protected SystemAccessControl delegate() Optional.of("admin"), false); ConnectorViewDefinition definitionRunAsInvoker = new ConnectorViewDefinition( - "select 1", + "SELECT 1 AS test", Optional.of("mock"), Optional.of("default"), ImmutableList.of(new ConnectorViewDefinition.ViewColumn("test", BIGINT.getTypeId(), Optional.empty())), @@ -182,7 +182,7 @@ protected SystemAccessControl delegate() public Map apply(ConnectorSession session, SchemaTablePrefix schemaTablePrefix) { ConnectorMaterializedViewDefinition materializedViewDefinition = new ConnectorMaterializedViewDefinition( - "select 1", + "SELECT 1 AS test", Optional.empty(), Optional.empty(), Optional.empty(), From 775cb0564595dea4c403a684e2710f58a235fefd Mon Sep 17 00:00:00 2001 From: Konrad Dziedzic Date: Fri, 21 Jul 2023 13:09:05 +0200 Subject: [PATCH 2/3] Check materialized view access when no columns selected --- .../java/io/trino/sql/analyzer/StatementAnalyzer.java | 1 + .../test/java/io/trino/security/TestAccessControl.java | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/core/trino-main/src/main/java/io/trino/sql/analyzer/StatementAnalyzer.java b/core/trino-main/src/main/java/io/trino/sql/analyzer/StatementAnalyzer.java index 8ffbf38cfcaa..7c3744e23fc0 100644 --- a/core/trino-main/src/main/java/io/trino/sql/analyzer/StatementAnalyzer.java +++ b/core/trino-main/src/main/java/io/trino/sql/analyzer/StatementAnalyzer.java @@ -2193,6 +2193,7 @@ protected Scope visitTable(Table table, Optional scope) Optional optionalMaterializedView = metadata.getMaterializedView(session, name); if (optionalMaterializedView.isPresent()) { MaterializedViewDefinition materializedViewDefinition = optionalMaterializedView.get(); + analysis.addEmptyColumnReferencesForTable(accessControl, session.getIdentity(), name); if (isMaterializedViewSufficientlyFresh(session, name, materializedViewDefinition)) { // If materialized view is sufficiently fresh with respect to its grace period, answer the query using the storage table QualifiedName storageName = getMaterializedViewStorageTableName(materializedViewDefinition) diff --git a/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java b/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java index d0512656224f..73a5a80b1a5b 100644 --- a/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java +++ b/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java @@ -253,6 +253,14 @@ public void testAccessControl() assertAccessAllowed("SELECT name AS my_alias FROM nation", privilege("my_alias", SELECT_COLUMN)); assertAccessAllowed("SELECT my_alias from (SELECT name AS my_alias FROM nation)", privilege("my_alias", SELECT_COLUMN)); assertAccessDenied("SELECT name AS my_alias FROM nation", "Cannot select from columns \\[name] in table .*.nation.*", privilege("nation.name", SELECT_COLUMN)); + assertAccessAllowed("SELECT 1 FROM mock.default.test_materialized_view"); + assertAccessDenied("SELECT 1 FROM mock.default.test_materialized_view", "Cannot select from columns.*", privilege("test_materialized_view", SELECT_COLUMN)); + assertAccessAllowed("SELECT * FROM mock.default.test_materialized_view"); + assertAccessDenied("SELECT * FROM mock.default.test_materialized_view", "Cannot select from columns.*", privilege("test_materialized_view", SELECT_COLUMN)); + // with current implementation this next block of checks is redundant, but it is not obvious unless details of how + // semantics analyzer works are known + assertAccessAllowed("SELECT count(*) FROM mock.default.test_materialized_view"); + assertAccessDenied("SELECT count(*) FROM mock.default.test_materialized_view", "Cannot select from columns.*", privilege("test_materialized_view", SELECT_COLUMN)); assertAccessDenied( "SELECT orders.custkey, lineitem.quantity FROM orders JOIN lineitem USING (orderkey)", From c10321009c15fe29c4085cbba0a1755372a19635 Mon Sep 17 00:00:00 2001 From: Konrad Dziedzic Date: Tue, 1 Aug 2023 11:00:04 +0200 Subject: [PATCH 3/3] Add more checks to TestAccessControl --- .../io/trino/security/TestAccessControl.java | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java b/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java index 73a5a80b1a5b..7b2b850bc6d3 100644 --- a/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java +++ b/testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java @@ -257,11 +257,23 @@ public void testAccessControl() assertAccessDenied("SELECT 1 FROM mock.default.test_materialized_view", "Cannot select from columns.*", privilege("test_materialized_view", SELECT_COLUMN)); assertAccessAllowed("SELECT * FROM mock.default.test_materialized_view"); assertAccessDenied("SELECT * FROM mock.default.test_materialized_view", "Cannot select from columns.*", privilege("test_materialized_view", SELECT_COLUMN)); - // with current implementation this next block of checks is redundant, but it is not obvious unless details of how + assertAccessAllowed("SELECT 1 FROM mock.default.test_view_definer"); + assertAccessDenied("SELECT 1 FROM mock.default.test_view_definer", "Cannot select from columns.*", privilege("test_view_definer", SELECT_COLUMN)); + assertAccessAllowed("SELECT * FROM mock.default.test_view_definer"); + assertAccessDenied("SELECT * FROM mock.default.test_view_definer", "Cannot select from columns.*", privilege("test_view_definer", SELECT_COLUMN)); + assertAccessAllowed("SELECT 1 FROM mock.default.test_view_invoker"); + assertAccessDenied("SELECT 1 FROM mock.default.test_view_invoker", "Cannot select from columns.*", privilege("test_view_invoker", SELECT_COLUMN)); + assertAccessAllowed("SELECT * FROM mock.default.test_view_invoker"); + assertAccessDenied("SELECT * FROM mock.default.test_view_invoker", "Cannot select from columns.*", privilege("test_view_invoker", SELECT_COLUMN)); + // with current implementation this next block of checks is redundant to `SELECT 1 FROM ..`, but it is not obvious unless details of how // semantics analyzer works are known assertAccessAllowed("SELECT count(*) FROM mock.default.test_materialized_view"); assertAccessDenied("SELECT count(*) FROM mock.default.test_materialized_view", "Cannot select from columns.*", privilege("test_materialized_view", SELECT_COLUMN)); - + assertAccessAllowed("SELECT count(*) FROM mock.default.test_view_invoker"); + assertAccessDenied("SELECT count(*) FROM mock.default.test_view_invoker", "Cannot select from columns.*", privilege("test_view_invoker", SELECT_COLUMN)); + assertAccessAllowed("SELECT count(*) FROM mock.default.test_view_definer"); + assertAccessDenied("SELECT count(*) FROM mock.default.test_view_definer", "Cannot select from columns.*", privilege("test_view_definer", SELECT_COLUMN)); + assertAccessDenied( "SELECT orders.custkey, lineitem.quantity FROM orders JOIN lineitem USING (orderkey)", "Cannot select from columns \\[orderkey, custkey] in table .*",