[GitHub] [incubator-kyuubi] ulysses-you commented on a diff in pull request #3520: [KYUUBI #3515] [Authz] support checking rewritten Iceberg commands and skip apply Row-filter to output tables

[GitBox <gi...@apache.org>]

ulysses-you commented on code in PR #3520:
URL: https://github.com/apache/incubator-kyuubi/pull/3520#discussion_r990872871


##########
extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RuleApplyRowFilterAndDataMasking.scala:
##########
@@ -30,30 +30,51 @@ import org.apache.kyuubi.plugin.spark.authz.util.RowFilterAndDataMaskingMarker
 
 class RuleApplyRowFilterAndDataMasking(spark: SparkSession) extends Rule[LogicalPlan] {
 
+  private def mapPlanChildren(plan: LogicalPlan, f: LogicalPlan => LogicalPlan): LogicalPlan = {
+    val planChildren = plan.children
+    if (planChildren.isEmpty) {
+      plan
+    } else {
+      // skip effected table within plan's children
+      val skippedMapChildren: Seq[LogicalPlan] = Seq(
+        getFieldValOption[LogicalPlan](plan, "table"),
+        getFieldValOption[LogicalPlan](plan, "targetTable"),
+        getFieldValOption[LogicalPlan](plan, "sourceTable"))
+        .collect {
+          case t if t.isDefined => t.get
+        } intersect planChildren
+
+      val mappedChildren = (planChildren diff skippedMapChildren).map(f)
+      plan.withNewChildren(skippedMapChildren ++ mappedChildren)

Review Comment:
   I think it is still a general way. The difference is minor :
   ```scala
   val icebergCommands = Set("MergeIntoIcebergTable", "UpdateTable", ...)
   case if icebergCommands.contains(plan.nodeName) => // do your code
   case _ => original code
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org