Skip to content

Commit 5f0c7fc

Browse files
HonahXHonahX
authored
Implement PolicyCatalogHandler and Add Policy Privileges Stage 1: CRUD + ListPolicies (#1357)
* Add PolicyCatalogHandler and tests * Fix style * Address review comments * Address review comments 2 * fix nit
1 parent eec2913 commit 5f0c7fc

File tree

9 files changed

+539
-7
lines changed

9 files changed

+539
-7
lines changed

‎polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizableOperation.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,11 @@
4040
import static org.apache.polaris.core.entity.PolarisPrivilege.NAMESPACE_MANAGE_GRANTS_ON_SECURABLE;
4141
import static org.apache.polaris.core.entity.PolarisPrivilege.NAMESPACE_READ_PROPERTIES;
4242
import static org.apache.polaris.core.entity.PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES;
43+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_CREATE;
44+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_DROP;
45+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_LIST;
46+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_READ;
47+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_WRITE;
4348
import static org.apache.polaris.core.entity.PolarisPrivilege.PRINCIPAL_CREATE;
4449
import static org.apache.polaris.core.entity.PolarisPrivilege.PRINCIPAL_DROP;
4550
import static org.apache.polaris.core.entity.PolarisPrivilege.PRINCIPAL_LIST;
@@ -182,6 +187,11 @@ public enum PolarisAuthorizableOperation {
182187
REVOKE_VIEW_GRANT_FROM_CATALOG_ROLE(
183188
VIEW_MANAGE_GRANTS_ON_SECURABLE, CATALOG_ROLE_MANAGE_GRANTS_FOR_GRANTEE),
184189
LIST_GRANTS_ON_VIEW(VIEW_LIST_GRANTS),
190+
CREATE_POLICY(POLICY_CREATE),
191+
LOAD_POLICY(POLICY_READ),
192+
DROP_POLICY(POLICY_DROP),
193+
UPDATE_POLICY(POLICY_WRITE),
194+
LIST_POLICY(POLICY_LIST),
185195
;
186196

187197
private final EnumSet<PolarisPrivilege> privilegesOnTarget;

‎polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,12 @@
4747
import static org.apache.polaris.core.entity.PolarisPrivilege.NAMESPACE_MANAGE_GRANTS_ON_SECURABLE;
4848
import static org.apache.polaris.core.entity.PolarisPrivilege.NAMESPACE_READ_PROPERTIES;
4949
import static org.apache.polaris.core.entity.PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES;
50+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_CREATE;
51+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_DROP;
52+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_FULL_METADATA;
53+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_LIST;
54+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_READ;
55+
import static org.apache.polaris.core.entity.PolarisPrivilege.POLICY_WRITE;
5056
import static org.apache.polaris.core.entity.PolarisPrivilege.PRINCIPAL_CREATE;
5157
import static org.apache.polaris.core.entity.PolarisPrivilege.PRINCIPAL_DROP;
5258
import static org.apache.polaris.core.entity.PolarisPrivilege.PRINCIPAL_FULL_METADATA;
@@ -457,6 +463,38 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
457463
SUPER_PRIVILEGES.putAll(
458464
CATALOG_ROLE_MANAGE_GRANTS_FOR_GRANTEE,
459465
List.of(CATALOG_ROLE_MANAGE_GRANTS_FOR_GRANTEE, CATALOG_MANAGE_ACCESS));
466+
467+
// Policy privileges
468+
SUPER_PRIVILEGES.putAll(
469+
POLICY_CREATE,
470+
List.of(
471+
POLICY_CREATE, POLICY_FULL_METADATA, CATALOG_MANAGE_METADATA, CATALOG_MANAGE_CONTENT));
472+
SUPER_PRIVILEGES.putAll(
473+
POLICY_WRITE,
474+
List.of(
475+
POLICY_WRITE, POLICY_FULL_METADATA, CATALOG_MANAGE_METADATA, CATALOG_MANAGE_CONTENT));
476+
SUPER_PRIVILEGES.putAll(
477+
POLICY_DROP,
478+
List.of(
479+
POLICY_DROP, POLICY_FULL_METADATA, CATALOG_MANAGE_METADATA, CATALOG_MANAGE_CONTENT));
480+
SUPER_PRIVILEGES.putAll(
481+
POLICY_READ,
482+
List.of(
483+
POLICY_READ,
484+
POLICY_WRITE,
485+
POLICY_FULL_METADATA,
486+
CATALOG_MANAGE_METADATA,
487+
CATALOG_MANAGE_CONTENT));
488+
SUPER_PRIVILEGES.putAll(
489+
POLICY_LIST,
490+
List.of(
491+
POLICY_LIST,
492+
POLICY_CREATE,
493+
POLICY_READ,
494+
POLICY_WRITE,
495+
POLICY_FULL_METADATA,
496+
CATALOG_MANAGE_METADATA,
497+
CATALOG_MANAGE_CONTENT));
460498
}
461499

462500
private final PolarisConfigurationStore featureConfig;

‎polaris-core/src/main/java/org/apache/polaris/core/entity/PolarisPrivilege.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,12 @@ public enum PolarisPrivilege {
136136
CATALOG_ROLE_FULL_METADATA(67, PolarisEntityType.CATALOG_ROLE),
137137
CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE(68, PolarisEntityType.CATALOG_ROLE),
138138
CATALOG_ROLE_MANAGE_GRANTS_FOR_GRANTEE(69, PolarisEntityType.CATALOG_ROLE),
139+
POLICY_CREATE(70, PolarisEntityType.NAMESPACE),
140+
POLICY_READ(71, PolarisEntityType.POLICY),
141+
POLICY_DROP(72, PolarisEntityType.POLICY),
142+
POLICY_WRITE(73, PolarisEntityType.POLICY),
143+
POLICY_LIST(74, PolarisEntityType.NAMESPACE),
144+
POLICY_FULL_METADATA(75, PolarisEntityType.POLICY),
139145
;
140146

141147
/**

‎quarkus/service/src/test/java/org/apache/polaris/service/quarkus/admin/PolarisAuthzTestBase.java‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,19 +75,22 @@
7575
import org.apache.polaris.core.persistence.dao.entity.EntityResult;
7676
import org.apache.polaris.core.persistence.resolver.PolarisResolutionManifest;
7777
import org.apache.polaris.core.persistence.transactional.TransactionalPersistence;
78+
import org.apache.polaris.core.policy.PredefinedPolicyTypes;
7879
import org.apache.polaris.core.secrets.UserSecretsManager;
7980
import org.apache.polaris.core.secrets.UserSecretsManagerFactory;
8081
import org.apache.polaris.service.admin.PolarisAdminService;
8182
import org.apache.polaris.service.catalog.PolarisPassthroughResolutionView;
8283
import org.apache.polaris.service.catalog.generic.GenericTableCatalog;
8384
import org.apache.polaris.service.catalog.iceberg.IcebergCatalog;
8485
import org.apache.polaris.service.catalog.io.FileIOFactory;
86+
import org.apache.polaris.service.catalog.policy.PolicyCatalog;
8587
import org.apache.polaris.service.config.DefaultConfigurationStore;
8688
import org.apache.polaris.service.config.RealmEntityManagerFactory;
8789
import org.apache.polaris.service.context.CallContextCatalogFactory;
8890
import org.apache.polaris.service.context.PolarisCallContextCatalogFactory;
8991
import org.apache.polaris.service.storage.PolarisStorageIntegrationProviderImpl;
9092
import org.apache.polaris.service.task.TaskExecutor;
93+
import org.apache.polaris.service.types.PolicyIdentifier;
9194
import org.assertj.core.api.Assertions;
9295
import org.junit.jupiter.api.AfterEach;
9396
import org.junit.jupiter.api.BeforeAll;
@@ -139,6 +142,9 @@ public Map<String, String> getConfigOverrides() {
139142
protected static final TableIdentifier TABLE_NS1_1_GENERIC =
140143
TableIdentifier.of(NS1, "layer1_table_generic");
141144

145+
// A policy directly under ns1
146+
protected static final PolicyIdentifier POLICY_NS1_1 = new PolicyIdentifier(NS1, "layer1_policy");
147+
142148
// Two tables under ns1a
143149
protected static final TableIdentifier TABLE_NS1A_1 = TableIdentifier.of(NS1A, "table1");
144150
protected static final TableIdentifier TABLE_NS1A_2 = TableIdentifier.of(NS1A, "table2");
@@ -185,6 +191,7 @@ public Map<String, String> getConfigOverrides() {
185191

186192
protected IcebergCatalog baseCatalog;
187193
protected GenericTableCatalog genericTableCatalog;
194+
protected PolicyCatalog policyCatalog;
188195
protected PolarisAdminService adminService;
189196
protected PolarisEntityManager entityManager;
190197
protected PolarisMetaStoreManager metaStoreManager;
@@ -321,6 +328,12 @@ public void before(TestInfo testInfo) {
321328

322329
genericTableCatalog.createGenericTable(TABLE_NS1_1_GENERIC, "format", "doc", Map.of());
323330

331+
policyCatalog.createPolicy(
332+
POLICY_NS1_1,
333+
PredefinedPolicyTypes.DATA_COMPACTION.getName(),
334+
"test_policy",
335+
"{\"enable\": false}");
336+
324337
baseCatalog
325338
.buildView(VIEW_NS1_1)
326339
.withSchema(SCHEMA)
@@ -463,6 +476,7 @@ private void initBaseCatalog() {
463476
CatalogProperties.FILE_IO_IMPL, "org.apache.iceberg.inmemory.InMemoryFileIO"));
464477
this.genericTableCatalog =
465478
new GenericTableCatalog(metaStoreManager, callContext, passthroughView);
479+
this.policyCatalog = new PolicyCatalog(metaStoreManager, callContext, passthroughView);
466480
}
467481

468482
@Alternative

0 commit comments

Comments
 (0)