Skip to content

Commit 2b295d3

Browse files
travis-bowentravis-bowen
committed
Add table manage structure
1 parent b489b73 commit 2b295d3

File tree

4 files changed

+87
-0
lines changed

4 files changed

+87
-0
lines changed

‎polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@
9696
import static org.apache.polaris.core.entity.PolarisPrivilege.TABLE_LIST;
9797
import static org.apache.polaris.core.entity.PolarisPrivilege.TABLE_LIST_GRANTS;
9898
import static org.apache.polaris.core.entity.PolarisPrivilege.TABLE_MANAGE_GRANTS_ON_SECURABLE;
99+
import static org.apache.polaris.core.entity.PolarisPrivilege.TABLE_MANAGE_STRUCTURE;
99100
import static org.apache.polaris.core.entity.PolarisPrivilege.TABLE_READ_DATA;
100101
import static org.apache.polaris.core.entity.PolarisPrivilege.TABLE_READ_PROPERTIES;
101102
import static org.apache.polaris.core.entity.PolarisPrivilege.TABLE_REMOVE_PARTITION_SPECS;
@@ -273,6 +274,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
273274
TABLE_FULL_METADATA,
274275
TABLE_WRITE_DATA,
275276
TABLE_WRITE_PROPERTIES,
277+
TABLE_MANAGE_STRUCTURE,
276278
TABLE_ASSIGN_UUID));
277279
SUPER_PRIVILEGES.putAll(
278280
TABLE_UPGRADE_FORMAT_VERSION,
@@ -282,6 +284,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
282284
TABLE_FULL_METADATA,
283285
TABLE_WRITE_DATA,
284286
TABLE_WRITE_PROPERTIES,
287+
TABLE_MANAGE_STRUCTURE,
285288
TABLE_UPGRADE_FORMAT_VERSION));
286289
SUPER_PRIVILEGES.putAll(
287290
TABLE_ADD_SCHEMA,
@@ -291,6 +294,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
291294
TABLE_FULL_METADATA,
292295
TABLE_WRITE_DATA,
293296
TABLE_WRITE_PROPERTIES,
297+
TABLE_MANAGE_STRUCTURE,
294298
TABLE_ADD_SCHEMA));
295299
SUPER_PRIVILEGES.putAll(
296300
TABLE_SET_CURRENT_SCHEMA,
@@ -300,6 +304,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
300304
TABLE_FULL_METADATA,
301305
TABLE_WRITE_DATA,
302306
TABLE_WRITE_PROPERTIES,
307+
TABLE_MANAGE_STRUCTURE,
303308
TABLE_SET_CURRENT_SCHEMA));
304309
SUPER_PRIVILEGES.putAll(
305310
TABLE_ADD_PARTITION_SPEC,
@@ -309,6 +314,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
309314
TABLE_FULL_METADATA,
310315
TABLE_WRITE_DATA,
311316
TABLE_WRITE_PROPERTIES,
317+
TABLE_MANAGE_STRUCTURE,
312318
TABLE_ADD_PARTITION_SPEC));
313319
SUPER_PRIVILEGES.putAll(
314320
TABLE_ADD_SORT_ORDER,
@@ -318,6 +324,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
318324
TABLE_FULL_METADATA,
319325
TABLE_WRITE_DATA,
320326
TABLE_WRITE_PROPERTIES,
327+
TABLE_MANAGE_STRUCTURE,
321328
TABLE_ADD_SORT_ORDER));
322329
SUPER_PRIVILEGES.putAll(
323330
TABLE_SET_DEFAULT_SORT_ORDER,
@@ -327,6 +334,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
327334
TABLE_FULL_METADATA,
328335
TABLE_WRITE_DATA,
329336
TABLE_WRITE_PROPERTIES,
337+
TABLE_MANAGE_STRUCTURE,
330338
TABLE_SET_DEFAULT_SORT_ORDER));
331339
SUPER_PRIVILEGES.putAll(
332340
TABLE_ADD_SNAPSHOT,
@@ -354,6 +362,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
354362
TABLE_FULL_METADATA,
355363
TABLE_WRITE_DATA,
356364
TABLE_WRITE_PROPERTIES,
365+
TABLE_MANAGE_STRUCTURE,
357366
TABLE_REMOVE_SNAPSHOTS));
358367
SUPER_PRIVILEGES.putAll(
359368
TABLE_REMOVE_SNAPSHOT_REF,
@@ -363,6 +372,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
363372
TABLE_FULL_METADATA,
364373
TABLE_WRITE_DATA,
365374
TABLE_WRITE_PROPERTIES,
375+
TABLE_MANAGE_STRUCTURE,
366376
TABLE_REMOVE_SNAPSHOT_REF));
367377
SUPER_PRIVILEGES.putAll(
368378
TABLE_SET_LOCATION,
@@ -372,6 +382,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
372382
TABLE_FULL_METADATA,
373383
TABLE_WRITE_DATA,
374384
TABLE_WRITE_PROPERTIES,
385+
TABLE_MANAGE_STRUCTURE,
375386
TABLE_SET_LOCATION));
376387
SUPER_PRIVILEGES.putAll(
377388
TABLE_SET_PROPERTIES,
@@ -381,6 +392,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
381392
TABLE_FULL_METADATA,
382393
TABLE_WRITE_DATA,
383394
TABLE_WRITE_PROPERTIES,
395+
TABLE_MANAGE_STRUCTURE,
384396
TABLE_SET_PROPERTIES));
385397
SUPER_PRIVILEGES.putAll(
386398
TABLE_REMOVE_PROPERTIES,
@@ -390,6 +402,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
390402
TABLE_FULL_METADATA,
391403
TABLE_WRITE_DATA,
392404
TABLE_WRITE_PROPERTIES,
405+
TABLE_MANAGE_STRUCTURE,
393406
TABLE_REMOVE_PROPERTIES));
394407
SUPER_PRIVILEGES.putAll(
395408
TABLE_SET_STATISTICS,
@@ -399,6 +412,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
399412
TABLE_FULL_METADATA,
400413
TABLE_WRITE_DATA,
401414
TABLE_WRITE_PROPERTIES,
415+
TABLE_MANAGE_STRUCTURE,
402416
TABLE_SET_STATISTICS));
403417
SUPER_PRIVILEGES.putAll(
404418
TABLE_REMOVE_STATISTICS,
@@ -408,6 +422,7 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
408422
TABLE_FULL_METADATA,
409423
TABLE_WRITE_DATA,
410424
TABLE_WRITE_PROPERTIES,
425+
TABLE_MANAGE_STRUCTURE,
411426
TABLE_REMOVE_STATISTICS));
412427
SUPER_PRIVILEGES.putAll(
413428
TABLE_REMOVE_PARTITION_SPECS,
@@ -417,7 +432,17 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
417432
TABLE_FULL_METADATA,
418433
TABLE_WRITE_DATA,
419434
TABLE_WRITE_PROPERTIES,
435+
TABLE_MANAGE_STRUCTURE,
420436
TABLE_REMOVE_PARTITION_SPECS));
437+
SUPER_PRIVILEGES.putAll(
438+
TABLE_MANAGE_STRUCTURE,
439+
List.of(
440+
CATALOG_MANAGE_CONTENT,
441+
CATALOG_MANAGE_METADATA,
442+
TABLE_FULL_METADATA,
443+
TABLE_WRITE_DATA,
444+
TABLE_WRITE_PROPERTIES,
445+
TABLE_MANAGE_STRUCTURE));
421446
SUPER_PRIVILEGES.putAll(
422447
VIEW_WRITE_PROPERTIES,
423448
List.of(

‎polaris-core/src/main/java/org/apache/polaris/core/entity/PolarisPrivilege.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,11 @@ public enum PolarisPrivilege {
240240
PolarisEntityType.TABLE_LIKE,
241241
List.of(PolarisEntitySubType.ICEBERG_TABLE, PolarisEntitySubType.GENERIC_TABLE),
242242
PolarisEntityType.CATALOG_ROLE),
243+
TABLE_MANAGE_STRUCTURE(
244+
102,
245+
PolarisEntityType.TABLE_LIKE,
246+
List.of(PolarisEntitySubType.ICEBERG_TABLE, PolarisEntitySubType.GENERIC_TABLE),
247+
PolarisEntityType.CATALOG_ROLE),
243248
;
244249

245250
/**

‎runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerFineGrainedAuthzTest.java‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,62 @@ public void testUpdateTableWithFineGrainedPrivileges_MultipleUpdatesInsufficient
208208
() -> newWrapper().updateTable(TABLE_NS1A_2, request));
209209
}
210210

211+
@Test
212+
public void testUpdateTableWithFineGrainedPrivileges_TableManageStructureSuperPrivilege() {
213+
// Test that TABLE_MANAGE_STRUCTURE works as a super privilege for structural operations
214+
// (but NOT for snapshot operations like TABLE_ADD_SNAPSHOT)
215+
216+
// Test structural operations that should work with TABLE_MANAGE_STRUCTURE
217+
UpdateTableRequest structuralRequest =
218+
UpdateTableRequest.create(
219+
TABLE_NS1A_2,
220+
List.of(), // no requirements
221+
List.of(
222+
new MetadataUpdate.AssignUUID(UUID.randomUUID().toString()),
223+
new MetadataUpdate.UpgradeFormatVersion(2),
224+
new MetadataUpdate.SetProperties(Map.of("test.property", "test.value")),
225+
new MetadataUpdate.RemoveProperties(Set.of("property.to.remove"))));
226+
227+
doTestSufficientPrivileges(
228+
List.of(
229+
PolarisPrivilege.TABLE_MANAGE_STRUCTURE, // Should work for all structural operations
230+
PolarisPrivilege.TABLE_WRITE_PROPERTIES, // Should also work with broader privilege
231+
PolarisPrivilege.TABLE_FULL_METADATA,
232+
PolarisPrivilege.CATALOG_MANAGE_CONTENT),
233+
() -> newWrapper().updateTable(TABLE_NS1A_2, structuralRequest),
234+
null /* cleanupAction */);
235+
}
236+
237+
@Test
238+
public void
239+
testUpdateTableWithFineGrainedPrivileges_TableManageStructureDoesNotIncludeSnapshots() {
240+
// Verify that TABLE_MANAGE_STRUCTURE does NOT grant access to snapshot operations
241+
// This test verifies that TABLE_ADD_SNAPSHOT and TABLE_SET_SNAPSHOT_REF were correctly
242+
// excluded from the TABLE_MANAGE_STRUCTURE super privilege mapping
243+
244+
// Test that TABLE_MANAGE_STRUCTURE works for non-snapshot structural operations
245+
UpdateTableRequest nonSnapshotRequest =
246+
UpdateTableRequest.create(
247+
TABLE_NS1A_2,
248+
List.of(), // no requirements
249+
List.of(
250+
new MetadataUpdate.AssignUUID(UUID.randomUUID().toString()),
251+
new MetadataUpdate.SetProperties(Map.of("structure.test", "value"))));
252+
253+
doTestSufficientPrivileges(
254+
List.of(PolarisPrivilege.TABLE_MANAGE_STRUCTURE),
255+
() -> newWrapper().updateTable(TABLE_NS1A_2, nonSnapshotRequest),
256+
null /* cleanupAction */);
257+
258+
// Test that TABLE_MANAGE_STRUCTURE is insufficient for operations that require
259+
// different privilege categories (like read operations)
260+
doTestInsufficientPrivileges(
261+
List.of(PolarisPrivilege.TABLE_MANAGE_STRUCTURE),
262+
() ->
263+
newWrapper()
264+
.loadTable(TABLE_NS1A_2, "all")); // Load table requires different privileges
265+
}
266+
211267
/**
212268
* Override the "feature disabled" test from the parent class since it's not applicable when the
213269
* fine-grained authorization feature is enabled in this test class.

‎spec/polaris-management-service.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1569,6 +1569,7 @@ components:
15691569
- TABLE_SET_STATISTICS
15701570
- TABLE_REMOVE_STATISTICS
15711571
- TABLE_REMOVE_PARTITION_SPECS
1572+
- TABLE_MANAGE_STRUCTURE
15721573

15731574
AddGrantRequest:
15741575
type: object

0 commit comments

Comments
 (0)