[incubator-kyuubi] branch master updated: [KYUUBI #3343] [Improvement] [AUTHZ] Skip privilege checks for CreateViewCommand of LocalTempView and GlobalTempView

[ya...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

yao pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-kyuubi.git


The following commit(s) were added to refs/heads/master by this push:
     new 46b549fe9 [KYUUBI #3343] [Improvement] [AUTHZ] Skip privilege checks for CreateViewCommand of LocalTempView and GlobalTempView
46b549fe9 is described below

commit 46b549fe90fff1dd0090e6e5992ef4c2d5c09881
Author: Bowen Liang <li...@gf.com.cn>
AuthorDate: Mon Aug 29 11:17:43 2022 +0800

    [KYUUBI #3343] [Improvement] [AUTHZ] Skip privilege checks for CreateViewCommand of LocalTempView and GlobalTempView
    
    ### _Why are the changes needed?_
    
    fix #3343
    
    Privilege checks of CreateViewCommand retained for PersistedViews only, and skipped for LocalTempView or GlobalTempView.
    
    ### _How was this patch tested?_
    - [x] Add some test cases that check the changes thoroughly including negative and positive cases if possible
    
    - [ ] Add screenshots for manual tests if appropriate
    
    - [x] [Run test](https://kyuubi.apache.org/docs/latest/develop_tools/testing.html#running-tests) locally before make a pull request
    
    Closes #3344 from bowenliang123/improve-skipauth-tempviews.
    
    Closes #3343
    
    eff4f732 [Bowen Liang] CreateViewCommand tablePrivileges checks for only persisted views, and adding ut
    
    Authored-by: Bowen Liang <li...@gf.com.cn>
    Signed-off-by: Kent Yao <ya...@apache.org>
---
 .../plugin/spark/authz/PrivilegesBuilder.scala     |  7 +++-
 .../authz/ranger/RangerSparkExtensionSuite.scala   | 47 ++++++++++++++++++++++
 2 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilder.scala b/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilder.scala
index 459698e59..689522b8d 100644
--- a/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilder.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilder.scala
@@ -21,6 +21,7 @@ import scala.collection.mutable.ArrayBuffer
 
 import org.apache.spark.sql.SparkSession
 import org.apache.spark.sql.catalyst.{FunctionIdentifier, TableIdentifier}
+import org.apache.spark.sql.catalyst.analysis.{PersistedView, ViewType}
 import org.apache.spark.sql.catalyst.catalog.CatalogTable
 import org.apache.spark.sql.catalyst.catalog.CatalogTypes.TablePartitionSpec
 import org.apache.spark.sql.catalyst.expressions.{Expression, NamedExpression}
@@ -295,8 +296,10 @@ object PrivilegesBuilder {
         outputObjs += databasePrivileges(quote(databases))
 
       case "CreateViewCommand" =>
-        val view = getPlanField[TableIdentifier]("name")
-        outputObjs += tablePrivileges(view)
+        if (getPlanField[ViewType]("viewType") == PersistedView) {
+          val view = getPlanField[TableIdentifier]("name")
+          outputObjs += tablePrivileges(view)
+        }
         val query =
           if (isSparkVersionAtMost("3.1")) {
             getPlanField[LogicalPlan]("child")
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala
index 96567885b..0a8ddc9ff 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala
@@ -499,4 +499,51 @@ class HiveCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite {
         })
     }
   }
+
+  test("[KYUUBI #3343] pass temporary view creation") {
+    val table = "hive_src"
+    val tempView = "temp_view"
+    val globalTempView = "global_temp_view"
+
+    withCleanTmpResources(Seq((table, "table"))) {
+      doAs("admin", sql(s"CREATE TABLE IF NOT EXISTS $table (id int)"))
+
+      doAs("admin", sql(s"CREATE TEMPORARY VIEW $tempView AS select * from $table"))
+
+      doAs(
+        "admin",
+        sql(s"CREATE OR REPLACE TEMPORARY VIEW $tempView" +
+          s" AS select * from $table"))
+
+      doAs("admin", sql(s"CREATE GLOBAL TEMPORARY VIEW $globalTempView AS SELECT * FROM $table"))
+
+      doAs(
+        "admin",
+        sql(s"CREATE OR REPLACE GLOBAL TEMPORARY VIEW $globalTempView" +
+          s" AS select * from $table"))
+    }
+  }
+
+  test("[KYUUBI #3343] check persisted view creation") {
+    val table = "hive_src"
+    val permView = "perm_view"
+
+    withCleanTmpResources(Seq((table, "table"))) {
+      doAs("admin", sql(s"CREATE TABLE IF NOT EXISTS $table (id int)"))
+
+      doAs("admin", sql(s"CREATE VIEW admin_perm_view AS SELECT * FROM $table"))
+
+      val e1 = intercept[AccessControlException](
+        doAs("someone", sql(s"CREATE VIEW $permView AS SELECT 1 as a")))
+      assert(e1.getMessage.contains(s"does not have [create] privilege on [default/$permView]"))
+
+      val e2 = intercept[AccessControlException](
+        doAs("someone", sql(s"CREATE VIEW $permView AS SELECT * FROM $table")))
+      if (isSparkV32OrGreater) {
+        assert(e2.getMessage.contains(s"does not have [select] privilege on [default/$table/id]"))
+      } else {
+        assert(e2.getMessage.contains(s"does not have [select] privilege on [$table]"))
+      }
+    }
+  }
 }