You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "HonahX (via GitHub)" <gi...@apache.org> on 2025/04/22 02:09:31 UTC
[PR] Implement PolicyCatalogHandler Stage 3: GetApplicablePolicies [polaris]
HonahX opened a new pull request, #1421:
URL: https://github.com/apache/polaris/pull/1421
<!--
Possible security vulnerabilities: STOP here and contact security@apache.org instead!
Please update the title of the PR with a meaningful message - do not leave it "empty" or "generated"
Please update this summary field:
The summary should cover these topics, if applicable:
* the motivation for the change
* a description of the status quo, for example the current behavior
* the desired behavior
* etc
PR checklist:
- Do a self-review of your code before opening a pull request
- Make sure that there's good test coverage for the changes included in this PR
- Run tests locally before pushing a PR (./gradlew check)
- Code should have comments where applicable. Particularly hard-to-understand
areas deserve good in-line documentation.
- Include changes and enhancements to the documentation (in site/content/in-dev/unreleased)
- For Work In Progress Pull Requests, please use the Draft PR feature.
Make sure to add the information BELOW this comment.
Everything in this comment will NOT be added to the PR description.
-->
This is a follow-up of https://github.com/apache/polaris/pull/1357, and in parallel to https://github.com/apache/polaris/pull/1416. It adds privilege and auth methods for `getApplicablePolicies`
The tests are in PolicyCatalogHandlerAuthzTest.java
cc: @flyrain
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Implement PolicyCatalogHandler Stage 3: GetApplicablePolicies [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain merged PR #1421:
URL: https://github.com/apache/polaris/pull/1421
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Implement PolicyCatalogHandler Stage 3: GetApplicablePolicies [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on code in PR #1421:
URL: https://github.com/apache/polaris/pull/1421#discussion_r2054993355
##########
service/common/src/main/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandler.java:
##########
@@ -161,6 +175,49 @@ private void authorizeBasicPolicyOperationOrThrow(
initializeCatalog();
}
+ private void authorizeGetApplicablePoliciesOperationOrThrow(
+ @Nullable Namespace namespace, @Nullable String targetName) {
+ if (namespace == null || namespace.isEmpty()) {
+ // catalog
+ PolarisAuthorizableOperation op =
+ PolarisAuthorizableOperation.GET_APPLICABLE_POLICIES_ON_CATALOG;
+ authorizeBasicCatalogOperationOrThrow(op);
+ } else if (Strings.isNullOrEmpty(targetName)) {
+ // namespace
+ PolarisAuthorizableOperation op =
+ PolarisAuthorizableOperation.GET_APPLICABLE_POLICIES_ON_NAMESPACE;
+ authorizeBasicNamespaceOperationOrThrow(op, namespace);
+ } else {
+ // table
+ TableIdentifier tableIdentifier = TableIdentifier.of(namespace, targetName);
+ PolarisAuthorizableOperation op =
+ PolarisAuthorizableOperation.GET_APPLICABLE_POLICIES_ON_TABLE;
+ // only Iceberg tables are supported
+ authorizeBasicTableLikeOperationOrThrow(
+ op, PolarisEntitySubType.ICEBERG_TABLE, tableIdentifier);
+ }
+ }
+
+ private void authorizeBasicCatalogOperationOrThrow(PolarisAuthorizableOperation op) {
+ resolutionManifest =
+ entityManager.prepareResolutionManifest(callContext, securityContext, catalogName);
+ resolutionManifest.resolveAll();
+
+ PolarisResolvedPathWrapper targetCatalog =
+ resolutionManifest.getResolvedReferenceCatalogEntity();
+ if (targetCatalog == null) {
+ throw new NotFoundException("Catalog not found");
+ }
+ authorizer.authorizeOrThrow(
+ authenticatedPrincipal,
+ resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
+ op,
+ targetCatalog,
+ null /* secondary */);
+
+ initializeCatalog();
Review Comment:
Just for my information: Is this mainly for refreshing the object `resolutionManifest` in the `polarisCatalog`? I guess we could give a better name to something like `reinitiatCatalog()`. Not a blocker though.
##########
service/common/src/main/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandler.java:
##########
@@ -161,6 +175,49 @@ private void authorizeBasicPolicyOperationOrThrow(
initializeCatalog();
}
+ private void authorizeGetApplicablePoliciesOperationOrThrow(
+ @Nullable Namespace namespace, @Nullable String targetName) {
+ if (namespace == null || namespace.isEmpty()) {
+ // catalog
+ PolarisAuthorizableOperation op =
+ PolarisAuthorizableOperation.GET_APPLICABLE_POLICIES_ON_CATALOG;
+ authorizeBasicCatalogOperationOrThrow(op);
+ } else if (Strings.isNullOrEmpty(targetName)) {
+ // namespace
+ PolarisAuthorizableOperation op =
+ PolarisAuthorizableOperation.GET_APPLICABLE_POLICIES_ON_NAMESPACE;
+ authorizeBasicNamespaceOperationOrThrow(op, namespace);
+ } else {
+ // table
+ TableIdentifier tableIdentifier = TableIdentifier.of(namespace, targetName);
+ PolarisAuthorizableOperation op =
+ PolarisAuthorizableOperation.GET_APPLICABLE_POLICIES_ON_TABLE;
+ // only Iceberg tables are supported
+ authorizeBasicTableLikeOperationOrThrow(
+ op, PolarisEntitySubType.ICEBERG_TABLE, tableIdentifier);
+ }
+ }
+
+ private void authorizeBasicCatalogOperationOrThrow(PolarisAuthorizableOperation op) {
+ resolutionManifest =
+ entityManager.prepareResolutionManifest(callContext, securityContext, catalogName);
+ resolutionManifest.resolveAll();
+
+ PolarisResolvedPathWrapper targetCatalog =
+ resolutionManifest.getResolvedReferenceCatalogEntity();
+ if (targetCatalog == null) {
+ throw new NotFoundException("Catalog not found");
+ }
+ authorizer.authorizeOrThrow(
+ authenticatedPrincipal,
+ resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
+ op,
+ targetCatalog,
+ null /* secondary */);
Review Comment:
Nit: the comment seems unnecessary
##########
quarkus/service/src/test/java/org/apache/polaris/service/quarkus/catalog/PolicyCatalogHandlerAuthzTest.java:
##########
@@ -722,4 +722,68 @@ public void testDetachFromPolicyInsufficientPrivileges() {
newWrapper(Set.of(PRINCIPAL_ROLE2)).detachPolicy(POLICY_NS1_1, detachPolicyRequest);
}
+
+ @Test
+ public void testGetApplicablePoliciesOnCatalogSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.CATALOG_READ_PROPERTIES,
+ PolarisPrivilege.CATALOG_WRITE_PROPERTIES,
+ PolarisPrivilege.CATALOG_MANAGE_METADATA),
+ () -> newWrapper().getApplicablePolicies(null, null, null),
+ null /* cleanupAction */);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnCatalogInsufficientPrivileges() {
+ doTestInsufficientPrivileges(
+ List.of(
+ PolarisPrivilege.NAMESPACE_READ_PROPERTIES,
+ PolarisPrivilege.POLICY_READ,
+ PolarisPrivilege.TABLE_READ_PROPERTIES),
+ () -> newWrapper().getApplicablePolicies(null, null, null));
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnNamespaceSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.NAMESPACE_READ_PROPERTIES,
+ PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES,
+ PolarisPrivilege.CATALOG_MANAGE_METADATA),
+ () -> newWrapper().getApplicablePolicies(NS1, null, null),
+ null /* cleanupAction */);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnNamespaceInSufficientPrivileges() {
+ doTestInsufficientPrivileges(
+ List.of(
+ PolarisPrivilege.CATALOG_READ_PROPERTIES,
+ PolarisPrivilege.POLICY_READ,
+ PolarisPrivilege.TABLE_READ_PROPERTIES),
+ () -> newWrapper().getApplicablePolicies(NS1, null, null));
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnTableSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.TABLE_READ_PROPERTIES,
Review Comment:
Q: is there a namespace level read privilege can cascade to privilege TABLE_READ_PROPERTIES?
##########
quarkus/service/src/test/java/org/apache/polaris/service/quarkus/catalog/PolicyCatalogHandlerAuthzTest.java:
##########
@@ -722,4 +722,68 @@ public void testDetachFromPolicyInsufficientPrivileges() {
newWrapper(Set.of(PRINCIPAL_ROLE2)).detachPolicy(POLICY_NS1_1, detachPolicyRequest);
}
+
+ @Test
+ public void testGetApplicablePoliciesOnCatalogSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.CATALOG_READ_PROPERTIES,
+ PolarisPrivilege.CATALOG_WRITE_PROPERTIES,
+ PolarisPrivilege.CATALOG_MANAGE_METADATA),
+ () -> newWrapper().getApplicablePolicies(null, null, null),
+ null /* cleanupAction */);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnCatalogInsufficientPrivileges() {
+ doTestInsufficientPrivileges(
+ List.of(
+ PolarisPrivilege.NAMESPACE_READ_PROPERTIES,
+ PolarisPrivilege.POLICY_READ,
+ PolarisPrivilege.TABLE_READ_PROPERTIES),
+ () -> newWrapper().getApplicablePolicies(null, null, null));
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnNamespaceSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.NAMESPACE_READ_PROPERTIES,
+ PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES,
+ PolarisPrivilege.CATALOG_MANAGE_METADATA),
+ () -> newWrapper().getApplicablePolicies(NS1, null, null),
+ null /* cleanupAction */);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnNamespaceInSufficientPrivileges() {
+ doTestInsufficientPrivileges(
+ List.of(
+ PolarisPrivilege.CATALOG_READ_PROPERTIES,
Review Comment:
Q: Does CATALOG_READ_PROPERTIES imply NAMESPACE_READ_PROPERTIES?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Implement PolicyCatalogHandler Stage 3: GetApplicablePolicies [polaris]
Posted by "HonahX (via GitHub)" <gi...@apache.org>.
HonahX commented on code in PR #1421:
URL: https://github.com/apache/polaris/pull/1421#discussion_r2055010776
##########
quarkus/service/src/test/java/org/apache/polaris/service/quarkus/catalog/PolicyCatalogHandlerAuthzTest.java:
##########
@@ -722,4 +722,68 @@ public void testDetachFromPolicyInsufficientPrivileges() {
newWrapper(Set.of(PRINCIPAL_ROLE2)).detachPolicy(POLICY_NS1_1, detachPolicyRequest);
}
+
+ @Test
+ public void testGetApplicablePoliciesOnCatalogSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.CATALOG_READ_PROPERTIES,
+ PolarisPrivilege.CATALOG_WRITE_PROPERTIES,
+ PolarisPrivilege.CATALOG_MANAGE_METADATA),
+ () -> newWrapper().getApplicablePolicies(null, null, null),
+ null /* cleanupAction */);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnCatalogInsufficientPrivileges() {
+ doTestInsufficientPrivileges(
+ List.of(
+ PolarisPrivilege.NAMESPACE_READ_PROPERTIES,
+ PolarisPrivilege.POLICY_READ,
+ PolarisPrivilege.TABLE_READ_PROPERTIES),
+ () -> newWrapper().getApplicablePolicies(null, null, null));
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnNamespaceSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.NAMESPACE_READ_PROPERTIES,
+ PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES,
+ PolarisPrivilege.CATALOG_MANAGE_METADATA),
+ () -> newWrapper().getApplicablePolicies(NS1, null, null),
+ null /* cleanupAction */);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnNamespaceInSufficientPrivileges() {
+ doTestInsufficientPrivileges(
+ List.of(
+ PolarisPrivilege.CATALOG_READ_PROPERTIES,
Review Comment:
No, `CATALOG_READ_PROPERTIES` is not a super privilege of `NAMESPACE_READ_PROPERTIES`. https://github.com/apache/polaris/blob/5f2a37570c7ed3cf79842422a7f4f1f9ed56c6bc/polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java#L209-L216
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Implement PolicyCatalogHandler Stage 3: GetApplicablePolicies [polaris]
Posted by "HonahX (via GitHub)" <gi...@apache.org>.
HonahX commented on code in PR #1421:
URL: https://github.com/apache/polaris/pull/1421#discussion_r2055010776
##########
quarkus/service/src/test/java/org/apache/polaris/service/quarkus/catalog/PolicyCatalogHandlerAuthzTest.java:
##########
@@ -722,4 +722,68 @@ public void testDetachFromPolicyInsufficientPrivileges() {
newWrapper(Set.of(PRINCIPAL_ROLE2)).detachPolicy(POLICY_NS1_1, detachPolicyRequest);
}
+
+ @Test
+ public void testGetApplicablePoliciesOnCatalogSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.CATALOG_READ_PROPERTIES,
+ PolarisPrivilege.CATALOG_WRITE_PROPERTIES,
+ PolarisPrivilege.CATALOG_MANAGE_METADATA),
+ () -> newWrapper().getApplicablePolicies(null, null, null),
+ null /* cleanupAction */);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnCatalogInsufficientPrivileges() {
+ doTestInsufficientPrivileges(
+ List.of(
+ PolarisPrivilege.NAMESPACE_READ_PROPERTIES,
+ PolarisPrivilege.POLICY_READ,
+ PolarisPrivilege.TABLE_READ_PROPERTIES),
+ () -> newWrapper().getApplicablePolicies(null, null, null));
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnNamespaceSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.NAMESPACE_READ_PROPERTIES,
+ PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES,
+ PolarisPrivilege.CATALOG_MANAGE_METADATA),
+ () -> newWrapper().getApplicablePolicies(NS1, null, null),
+ null /* cleanupAction */);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnNamespaceInSufficientPrivileges() {
+ doTestInsufficientPrivileges(
+ List.of(
+ PolarisPrivilege.CATALOG_READ_PROPERTIES,
Review Comment:
No, `CATALOG_READ_PROPERTIES` is not a super privilege of `NAMESPACE_READ_PROPERTIES`. https://github.com/apache/polaris/blob/5f2a37570c7ed3cf79842422a7f4f1f9ed56c6bc/polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java#L209-L216
Just to confirm: This should be the expected that user have right to getApplicablePolicies on catalog does not necessarily have the right to getApplicablePolicies on namespace?
##########
quarkus/service/src/test/java/org/apache/polaris/service/quarkus/catalog/PolicyCatalogHandlerAuthzTest.java:
##########
@@ -722,4 +722,68 @@ public void testDetachFromPolicyInsufficientPrivileges() {
newWrapper(Set.of(PRINCIPAL_ROLE2)).detachPolicy(POLICY_NS1_1, detachPolicyRequest);
}
+
+ @Test
+ public void testGetApplicablePoliciesOnCatalogSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.CATALOG_READ_PROPERTIES,
+ PolarisPrivilege.CATALOG_WRITE_PROPERTIES,
+ PolarisPrivilege.CATALOG_MANAGE_METADATA),
+ () -> newWrapper().getApplicablePolicies(null, null, null),
+ null /* cleanupAction */);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnCatalogInsufficientPrivileges() {
+ doTestInsufficientPrivileges(
+ List.of(
+ PolarisPrivilege.NAMESPACE_READ_PROPERTIES,
+ PolarisPrivilege.POLICY_READ,
+ PolarisPrivilege.TABLE_READ_PROPERTIES),
+ () -> newWrapper().getApplicablePolicies(null, null, null));
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnNamespaceSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.NAMESPACE_READ_PROPERTIES,
+ PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES,
+ PolarisPrivilege.CATALOG_MANAGE_METADATA),
+ () -> newWrapper().getApplicablePolicies(NS1, null, null),
+ null /* cleanupAction */);
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnNamespaceInSufficientPrivileges() {
+ doTestInsufficientPrivileges(
+ List.of(
+ PolarisPrivilege.CATALOG_READ_PROPERTIES,
+ PolarisPrivilege.POLICY_READ,
+ PolarisPrivilege.TABLE_READ_PROPERTIES),
+ () -> newWrapper().getApplicablePolicies(NS1, null, null));
+ }
+
+ @Test
+ public void testGetApplicablePoliciesOnTableSufficientPrivileges() {
+ doTestSufficientPrivileges(
+ List.of(
+ PolarisPrivilege.TABLE_READ_PROPERTIES,
Review Comment:
No, only `CATALOG_MANAGE_METADATA` which is a super privilege implies `TABLE_READ_PROPERTIES`
https://github.com/apache/polaris/blob/5f2a37570c7ed3cf79842422a7f4f1f9ed56c6bc/polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java#L217-L226
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Implement PolicyCatalogHandler Stage 3: GetApplicablePolicies [polaris]
Posted by "sfc-gh-jojiang (via GitHub)" <gi...@apache.org>.
sfc-gh-jojiang commented on code in PR #1421:
URL: https://github.com/apache/polaris/pull/1421#discussion_r2055008266
##########
service/common/src/main/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandler.java:
##########
@@ -161,6 +175,49 @@ private void authorizeBasicPolicyOperationOrThrow(
initializeCatalog();
}
+ private void authorizeGetApplicablePoliciesOperationOrThrow(
+ @Nullable Namespace namespace, @Nullable String targetName) {
+ if (namespace == null || namespace.isEmpty()) {
+ // catalog
+ PolarisAuthorizableOperation op =
+ PolarisAuthorizableOperation.GET_APPLICABLE_POLICIES_ON_CATALOG;
+ authorizeBasicCatalogOperationOrThrow(op);
+ } else if (Strings.isNullOrEmpty(targetName)) {
+ // namespace
+ PolarisAuthorizableOperation op =
+ PolarisAuthorizableOperation.GET_APPLICABLE_POLICIES_ON_NAMESPACE;
+ authorizeBasicNamespaceOperationOrThrow(op, namespace);
+ } else {
+ // table
+ TableIdentifier tableIdentifier = TableIdentifier.of(namespace, targetName);
+ PolarisAuthorizableOperation op =
+ PolarisAuthorizableOperation.GET_APPLICABLE_POLICIES_ON_TABLE;
+ // only Iceberg tables are supported
+ authorizeBasicTableLikeOperationOrThrow(
+ op, PolarisEntitySubType.ICEBERG_TABLE, tableIdentifier);
+ }
+ }
+
+ private void authorizeBasicCatalogOperationOrThrow(PolarisAuthorizableOperation op) {
+ resolutionManifest =
+ entityManager.prepareResolutionManifest(callContext, securityContext, catalogName);
+ resolutionManifest.resolveAll();
+
+ PolarisResolvedPathWrapper targetCatalog =
+ resolutionManifest.getResolvedReferenceCatalogEntity();
+ if (targetCatalog == null) {
+ throw new NotFoundException("Catalog not found");
+ }
+ authorizer.authorizeOrThrow(
+ authenticatedPrincipal,
+ resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
+ op,
+ targetCatalog,
+ null /* secondary */);
+
+ initializeCatalog();
Review Comment:
This is the time when the PolicyCatalog is initialized. The high-level workflow is that for each rest request, we first initialize a `PoicyCatalogHandler` and put entities into `resolutionManifest`, resolve and do authorization, if the authorization passed, a `PolicyCatalog` is initialized to handle the request. So `PolicyCatalog` object is never re-used after it serves one request
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org