This is an automated email from the ASF dual-hosted git repository.
adutra pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/polaris.git
The following commit(s) were added to refs/heads/main by this push:
new c01a2fc45 Revert automatic subsuming privilege positive test case
generation (#3970)
c01a2fc45 is described below
commit c01a2fc458cdc367f6ad0ea05d749e68a73d1ea7
Author: Alexandre Dutra <[email protected]>
AuthorDate: Wed Mar 11 13:29:18 2026 +0100
Revert automatic subsuming privilege positive test case generation (#3970)
---
.../admin/PolarisAdminServiceAuthzTest.java | 75 ++++++++++++++
.../service/admin/PolarisAuthzTestsFactory.java | 22 +---
...PolarisGenericTableCatalogHandlerAuthzTest.java | 20 ++++
.../AbstractIcebergCatalogHandlerAuthzTest.java | 114 +++++++++++++++++++++
...ebergCatalogHandlerFineGrainedDisabledTest.java | 3 +
.../policy/PolicyCatalogHandlerAuthzTest.java | 14 +++
6 files changed, 228 insertions(+), 20 deletions(-)
diff --git
a/runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAdminServiceAuthzTest.java
b/runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAdminServiceAuthzTest.java
index 33545e185..805876f96 100644
---
a/runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAdminServiceAuthzTest.java
+++
b/runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAdminServiceAuthzTest.java
@@ -71,6 +71,13 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.CATALOG_LIST)
+ .shouldPassWith(PolarisPrivilege.CATALOG_CREATE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.CATALOG_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -97,6 +104,8 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.CATALOG_CREATE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -113,6 +122,11 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.CATALOG_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.CATALOG_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -141,6 +155,10 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.CATALOG_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.CATALOG_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -169,6 +187,8 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.CATALOG_DROP)
+ .shouldPassWith(PolarisPrivilege.CATALOG_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -185,6 +205,11 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_LIST)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_CREATE)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -212,6 +237,8 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_CREATE)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -228,6 +255,9 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -256,6 +286,8 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -285,6 +317,8 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_DROP)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -301,6 +335,11 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_LIST)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_CREATE)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -330,6 +369,8 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_CREATE)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -346,6 +387,9 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -376,6 +420,8 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -406,6 +452,8 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_DROP)
+ .shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -414,6 +462,11 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
return authzTestsBuilder("listCatalogRoles")
.action(() -> newTestAdminService().listCatalogRoles(CATALOG_NAME))
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_LIST)
+ .shouldPassWith(PolarisPrivilege.CATALOG_ROLE_CREATE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_ROLE_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.CATALOG_ROLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.CATALOG_ROLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
@@ -436,6 +489,8 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
newTestAdminService(Set.of(PRINCIPAL_ROLE2))
.deleteCatalogRole(CATALOG_NAME, newCatalogRole.getName()))
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_CREATE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_ROLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
@@ -444,6 +499,9 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
return authzTestsBuilder("getCatalogRole")
.action(() -> newTestAdminService().getCatalogRole(CATALOG_NAME,
CATALOG_ROLE2))
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.CATALOG_ROLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.CATALOG_ROLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
@@ -467,6 +525,7 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
})
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.CATALOG_ROLE_FULL_METADATA)
.createTests();
}
@@ -490,6 +549,8 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
newTestAdminService(Set.of(PRINCIPAL_ROLE2))
.createCatalogRole(CATALOG_NAME, newCatalogRole))
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_DROP)
+ .shouldPassWith(PolarisPrivilege.CATALOG_ROLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
@@ -512,6 +573,7 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.PRINCIPAL_ROLE_MANAGE_GRANTS_ON_SECURABLE)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.createTests();
}
@@ -558,6 +620,7 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnRootContainerFromPrincipalRole(
PRINCIPAL_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
@@ -597,6 +660,9 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnCatalogFromRole(
CATALOG_NAME, CATALOG_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_LIST_GRANTS)
+
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE)
+
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_MANAGE_GRANTS_FOR_GRANTEE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
@@ -615,6 +681,9 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnCatalogFromRole(
CATALOG_NAME, CATALOG_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_LIST_GRANTS)
+
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE)
+
.shouldPassWith(PolarisPrivilege.CATALOG_ROLE_MANAGE_GRANTS_FOR_GRANTEE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
@@ -667,6 +736,7 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
.grantPrivilegeOnCatalogToRole(
CATALOG_NAME, CATALOG_ROLE2,
PolarisPrivilege.CATALOG_MANAGE_ACCESS))
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_GRANTS_ON_SECURABLE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
@@ -708,6 +778,7 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnCatalogFromRole(
catalogName, CATALOG_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.NAMESPACE_MANAGE_GRANTS_ON_SECURABLE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests());
}
@@ -732,6 +803,7 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnCatalogFromRole(
FEDERATED_CATALOG_NAME, CATALOG_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.NAMESPACE_MANAGE_GRANTS_ON_SECURABLE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
@@ -773,6 +845,7 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
adminService.revokePrivilegeOnCatalogFromRole(
catalogName, CATALOG_ROLE1, privilege))
.shouldPassWith(PolarisPrivilege.TABLE_MANAGE_GRANTS_ON_SECURABLE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests());
}
@@ -806,6 +879,7 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
VIEW_NS1_1,
PolarisPrivilege.CATALOG_MANAGE_ACCESS))
.shouldPassWith(PolarisPrivilege.VIEW_MANAGE_GRANTS_ON_SECURABLE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
@@ -839,6 +913,7 @@ public class PolarisAdminServiceAuthzTest extends
PolarisAuthzTestBase {
POLICY_NS1_1,
PolarisPrivilege.CATALOG_MANAGE_ACCESS))
.shouldPassWith(PolarisPrivilege.POLICY_MANAGE_GRANTS_ON_SECURABLE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_ACCESS)
.createTests();
}
}
diff --git
a/runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAuthzTestsFactory.java
b/runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAuthzTestsFactory.java
index 04ccd72a9..db0fda293 100644
---
a/runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAuthzTestsFactory.java
+++
b/runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAuthzTestsFactory.java
@@ -34,7 +34,6 @@ import java.util.function.Function;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import org.apache.iceberg.exceptions.ForbiddenException;
-import org.apache.polaris.core.auth.PolarisAuthorizerImpl;
import org.apache.polaris.core.entity.PolarisPrivilege;
import org.apache.polaris.core.persistence.dao.entity.PrivilegeResult;
import org.apache.polaris.immutables.PolarisImmutable;
@@ -115,22 +114,6 @@ public abstract class PolarisAuthzTestsFactory {
.flatMap(Set::stream)
.collect(Collectors.toCollection(() ->
EnumSet.noneOf(PolarisPrivilege.class)));
- // Automatically create positive tests for all subsuming privileges of each
- // individually-sufficient privilege, since they all must pass as well.
- List<EnumSet<PolarisPrivilege>> missingSufficientPrivilegeSets =
- sufficientIndividualPrivileges.stream()
- .flatMap(p ->
PolarisAuthorizerImpl.subsumingPrivilegesOf(p).stream())
- .distinct()
- .sorted(Comparator.comparing(Enum::name))
- .map(EnumSet::of)
- .filter(set -> !sufficientPrivilegeSets().contains(set))
- .toList();
- if (!missingSufficientPrivilegeSets.isEmpty()) {
- Builder builder = builder().from(this);
-
missingSufficientPrivilegeSets.forEach(builder::addSufficientPrivilegeSet);
- return builder.build();
- }
-
// Automatically create negative tests for each privilege not present
*individually*
// in the positive tests, as single privileges are assumed to be
insufficient by default.
List<EnumSet<PolarisPrivilege>> missingInsufficientPrivilegeSets =
@@ -195,9 +178,8 @@ public abstract class PolarisAuthzTestsFactory {
* privileges in a single call are treated as a set of privileges that
must all be granted
* together.
*
- * <p>When calling this method with a single privilege, it's not necessary
to explicitly call it
- * again with subsuming privileges, as the test factory will automatically
create positive tests
- * for all subsuming privileges.
+ * <p>Make sure to explicitly call this method for each subsuming
privilege that should also
+ * pass the test.
*/
@CanIgnoreReturnValue
public Builder shouldPassWith(PolarisPrivilege... privileges) {
diff --git
a/runtime/service/src/test/java/org/apache/polaris/service/catalog/generic/PolarisGenericTableCatalogHandlerAuthzTest.java
b/runtime/service/src/test/java/org/apache/polaris/service/catalog/generic/PolarisGenericTableCatalogHandlerAuthzTest.java
index da34d4195..0dceebe8c 100644
---
a/runtime/service/src/test/java/org/apache/polaris/service/catalog/generic/PolarisGenericTableCatalogHandlerAuthzTest.java
+++
b/runtime/service/src/test/java/org/apache/polaris/service/catalog/generic/PolarisGenericTableCatalogHandlerAuthzTest.java
@@ -57,6 +57,14 @@ public class PolarisGenericTableCatalogHandlerAuthzTest
extends PolarisAuthzTest
return authzTestsBuilder("listGenericTables")
.action(() -> newWrapper().listGenericTables(NS1A))
.shouldPassWith(PolarisPrivilege.TABLE_LIST)
+ .shouldPassWith(PolarisPrivilege.TABLE_CREATE)
+ .shouldPassWith(PolarisPrivilege.TABLE_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -79,6 +87,9 @@ public class PolarisGenericTableCatalogHandlerAuthzTest
extends PolarisAuthzTest
.createGenericTable(newtable, "format", "file:///temp/",
"doc", Map.of()))
.cleanupAction(() ->
newWrapper(Set.of(PRINCIPAL_ROLE2)).dropGenericTable(newtable))
.shouldPassWith(PolarisPrivilege.TABLE_CREATE)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -87,6 +98,12 @@ public class PolarisGenericTableCatalogHandlerAuthzTest
extends PolarisAuthzTest
return authzTestsBuilder("loadGenericTable")
.action(() -> newWrapper().loadGenericTable(TABLE_NS1_1_GENERIC))
.shouldPassWith(PolarisPrivilege.TABLE_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -104,6 +121,9 @@ public class PolarisGenericTableCatalogHandlerAuthzTest
extends PolarisAuthzTest
.createGenericTable(
TABLE_NS1_1_GENERIC, "format", "file:///temp/", "doc",
Map.of()))
.shouldPassWith(PolarisPrivilege.TABLE_DROP)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
}
diff --git
a/runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/AbstractIcebergCatalogHandlerAuthzTest.java
b/runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/AbstractIcebergCatalogHandlerAuthzTest.java
index 9a21cc0c8..ee008865a 100644
---
a/runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/AbstractIcebergCatalogHandlerAuthzTest.java
+++
b/runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/AbstractIcebergCatalogHandlerAuthzTest.java
@@ -135,6 +135,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.NAMESPACE_CREATE)
.shouldPassWith(PolarisPrivilege.NAMESPACE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -212,6 +214,12 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.action(() ->
refreshedWrapper.listNamespaces(Namespace.of()))
.principalName(principalName)
.shouldPassWith(PolarisPrivilege.NAMESPACE_LIST)
+ .shouldPassWith(PolarisPrivilege.NAMESPACE_CREATE)
+ .shouldPassWith(PolarisPrivilege.NAMESPACE_READ_PROPERTIES)
+
.shouldPassWith(PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.NAMESPACE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests(),
authzTestsBuilder("createNamespace (after rotation)")
.action(
@@ -221,11 +229,22 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.cleanupAction(() ->
newHandler(Set.of(PRINCIPAL_ROLE2)).dropNamespace(ns3))
.principalName(principalName)
.shouldPassWith(PolarisPrivilege.NAMESPACE_CREATE)
+ .shouldPassWith(PolarisPrivilege.NAMESPACE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests(),
authzTestsBuilder("listTables (after rotation)")
.action(() -> refreshedWrapper.listTables(NS1))
.principalName(principalName)
.shouldPassWith(PolarisPrivilege.TABLE_LIST)
+ .shouldPassWith(PolarisPrivilege.TABLE_CREATE)
+ .shouldPassWith(PolarisPrivilege.TABLE_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests())
.flatMap(s -> s);
@@ -312,6 +331,9 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.dropNamespace(Namespace.of("ns1", "ns1a", "newns"));
})
.shouldPassWith(PolarisPrivilege.NAMESPACE_CREATE)
+ .shouldPassWith(PolarisPrivilege.NAMESPACE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -322,6 +344,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.NAMESPACE_READ_PROPERTIES)
.shouldPassWith(PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.NAMESPACE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -338,6 +362,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.NAMESPACE_CREATE)
.shouldPassWith(PolarisPrivilege.NAMESPACE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -355,6 +381,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.createNamespace(CreateNamespaceRequest.builder().withNamespace(NS1AA).build()))
.shouldPassWith(PolarisPrivilege.NAMESPACE_DROP)
.shouldPassWith(PolarisPrivilege.NAMESPACE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -373,6 +401,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
})
.shouldPassWith(PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.NAMESPACE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -387,6 +417,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_CREATE)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -409,6 +441,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.cleanupAction(() ->
newHandler(Set.of(PRINCIPAL_ROLE2)).dropTableWithPurge(newtable))
.shouldPassWith(PolarisPrivilege.TABLE_CREATE)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -458,6 +492,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
() -> newHandler(Set.of(PRINCIPAL_ROLE1)).createTableStaged(NS2,
createStagedRequest))
.shouldPassWith(PolarisPrivilege.TABLE_CREATE)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -518,6 +554,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.cleanupAction(() ->
newHandler(Set.of(PRINCIPAL_ROLE2)).dropTableWithoutPurge(TABLE_NS1_1))
.shouldPassWith(PolarisPrivilege.TABLE_CREATE)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -530,6 +568,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -545,6 +585,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -555,6 +597,7 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
() -> newHandler().loadTableWithAccessDelegation(TABLE_NS1A_2,
"all", Optional.empty()))
.shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
.createTests();
}
@@ -568,6 +611,7 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
() -> newHandler().loadTableWithAccessDelegation(TABLE_NS1A_2,
"all", Optional.empty()))
.shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
.createTests();
}
@@ -581,6 +625,7 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
TABLE_NS1A_2, IfNoneMatch.fromHeader("W/\"0:0\""),
"all", Optional.empty()))
.shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
.createTests();
}
@@ -597,6 +642,7 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
TABLE_NS1A_2, IfNoneMatch.fromHeader("W/\"0:0\""),
"all", Optional.empty()))
.shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
.createTests();
}
@@ -607,6 +653,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -621,6 +669,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
() -> newHandler().updateTableForStagedCreate(TABLE_NS1A_2, new
UpdateTableRequest()))
.shouldPassWith(PolarisPrivilege.TABLE_CREATE)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -642,6 +692,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -731,6 +783,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.createTableDirect(TABLE_NS1_1.namespace(), createRequest))
.shouldPassWith(PolarisPrivilege.TABLE_DROP)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -767,6 +821,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_CREATE)
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -784,6 +840,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.cleanupAction(() ->
newHandler(Set.of(PRINCIPAL_ROLE1)).renameTable(rename2))
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.TABLE_CREATE,
PolarisPrivilege.TABLE_DROP)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -851,6 +909,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.TABLE_CREATE,
PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_CREATE,
PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -918,6 +978,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.VIEW_WRITE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.VIEW_CREATE)
.shouldPassWith(PolarisPrivilege.VIEW_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -951,6 +1013,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.cleanupAction(() ->
newHandler(Set.of(PRINCIPAL_ROLE2)).dropView(newview))
.shouldPassWith(PolarisPrivilege.VIEW_CREATE)
.shouldPassWith(PolarisPrivilege.VIEW_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -961,6 +1025,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.VIEW_READ_PROPERTIES)
.shouldPassWith(PolarisPrivilege.VIEW_WRITE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.VIEW_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -970,6 +1036,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.action(() -> newHandler().replaceView(VIEW_NS1A_2, new
UpdateTableRequest()))
.shouldPassWith(PolarisPrivilege.VIEW_WRITE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.VIEW_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -1006,6 +1074,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.createView(VIEW_NS1_1.namespace(), createRequest))
.shouldPassWith(PolarisPrivilege.VIEW_DROP)
.shouldPassWith(PolarisPrivilege.VIEW_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -1018,6 +1088,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(PolarisPrivilege.VIEW_WRITE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.VIEW_CREATE)
.shouldPassWith(PolarisPrivilege.VIEW_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -1035,6 +1107,8 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.cleanupAction(() ->
newHandler(Set.of(PRINCIPAL_ROLE1)).renameView(rename2))
.shouldPassWith(PolarisPrivilege.VIEW_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.VIEW_DROP,
PolarisPrivilege.VIEW_CREATE)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -1484,6 +1558,11 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.action(() -> newHandler().updateTable(TABLE_NS1A_2, request))
.shouldPassWith(PolarisPrivilege.TABLE_ASSIGN_UUID)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_MANAGE_STRUCTURE)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -1501,6 +1580,11 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.action(() -> newHandler().updateTable(TABLE_NS1A_2, request))
.shouldPassWith(PolarisPrivilege.TABLE_UPGRADE_FORMAT_VERSION)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_MANAGE_STRUCTURE)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -1517,6 +1601,11 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.action(() -> newHandler().updateTable(TABLE_NS1A_2, request))
.shouldPassWith(PolarisPrivilege.TABLE_SET_PROPERTIES)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_MANAGE_STRUCTURE)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -1533,6 +1622,11 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.action(() -> newHandler().updateTable(TABLE_NS1A_2, request))
.shouldPassWith(PolarisPrivilege.TABLE_REMOVE_PROPERTIES)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_MANAGE_STRUCTURE)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -1552,7 +1646,11 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.shouldPassWith(
PolarisPrivilege.TABLE_UPGRADE_FORMAT_VERSION,
PolarisPrivilege.TABLE_SET_PROPERTIES)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_MANAGE_STRUCTURE)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
// Test that having only one specific privilege fails (need both)
.shouldFailWith(PolarisPrivilege.TABLE_UPGRADE_FORMAT_VERSION) // Only
one of the two needed
.shouldFailWith(PolarisPrivilege.TABLE_SET_PROPERTIES) // Only one of
the two needed
@@ -1578,7 +1676,11 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
return authzTestsBuilder("updateTable (TABLE_MANAGE_STRUCTURE super
privilege)")
.action(() -> newHandler().updateTable(TABLE_NS1A_2,
structuralRequest))
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_MANAGE_STRUCTURE)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -1600,7 +1702,11 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
return authzTestsBuilder("updateTable (TABLE_MANAGE_STRUCTURE sufficient
for non-snapshot ops)")
.action(() -> newHandler().updateTable(TABLE_NS1A_2,
nonSnapshotRequest))
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_MANAGE_STRUCTURE)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
@@ -1611,6 +1717,12 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
return authzTestsBuilder("loadTable (TABLE_MANAGE_STRUCTURE insufficient)")
.action(() -> newHandler().loadTable(TABLE_NS1A_2, "all"))
.shouldPassWith(PolarisPrivilege.TABLE_READ_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.shouldFailWith(PolarisPrivilege.TABLE_MANAGE_STRUCTURE)
.createTests();
}
@@ -1632,6 +1744,7 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
.action(() -> newHandler().reportMetrics(TABLE_NS1A_1, request))
.shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA) // super-privilege
of TABLE_READ_DATA
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
.createTests();
}
@@ -1649,6 +1762,7 @@ public abstract class
AbstractIcebergCatalogHandlerAuthzTest extends PolarisAuth
return authzTestsBuilder("reportMetrics (write)")
.action(() -> newHandler().reportMetrics(TABLE_NS1A_1, request))
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
.createTests();
}
}
diff --git
a/runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerFineGrainedDisabledTest.java
b/runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerFineGrainedDisabledTest.java
index 2530d490c..6560184fe 100644
---
a/runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerFineGrainedDisabledTest.java
+++
b/runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerFineGrainedDisabledTest.java
@@ -78,6 +78,9 @@ public class IcebergCatalogHandlerFineGrainedDisabledTest
extends PolarisAuthzTe
.action(() -> newHandler().updateTable(TABLE_NS1A_2, request))
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.shouldFailWith(
PolarisPrivilege
.TABLE_ASSIGN_UUID) // This alone should be insufficient when
feature disabled
diff --git
a/runtime/service/src/test/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandlerAuthzTest.java
b/runtime/service/src/test/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandlerAuthzTest.java
index bdcf5c3d4..e8d186900 100644
---
a/runtime/service/src/test/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandlerAuthzTest.java
+++
b/runtime/service/src/test/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandlerAuthzTest.java
@@ -64,6 +64,7 @@ public class PolicyCatalogHandlerAuthzTest extends
PolarisAuthzTestBase {
.shouldPassWith(PolarisPrivilege.POLICY_READ)
.shouldPassWith(PolarisPrivilege.POLICY_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.shouldFailWith(PolarisPrivilege.POLICY_DROP)
.createTests();
}
@@ -87,6 +88,7 @@ public class PolicyCatalogHandlerAuthzTest extends
PolarisAuthzTestBase {
.cleanupAction(() ->
newHandler(Set.of(PRINCIPAL_ROLE2)).dropPolicy(newPolicy, true))
.shouldPassWith(PolarisPrivilege.POLICY_CREATE)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.shouldPassWith(PolarisPrivilege.POLICY_FULL_METADATA)
.shouldFailWith(PolarisPrivilege.POLICY_READ)
.shouldFailWith(PolarisPrivilege.POLICY_LIST)
@@ -103,6 +105,7 @@ public class PolicyCatalogHandlerAuthzTest extends
PolarisAuthzTestBase {
.shouldPassWith(PolarisPrivilege.POLICY_WRITE)
.shouldPassWith(PolarisPrivilege.POLICY_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.shouldFailWith(PolarisPrivilege.POLICY_LIST)
.shouldFailWith(PolarisPrivilege.POLICY_DROP)
.shouldFailWith(PolarisPrivilege.POLICY_CREATE)
@@ -125,6 +128,7 @@ public class PolicyCatalogHandlerAuthzTest extends
PolarisAuthzTestBase {
.shouldPassWith(PolarisPrivilege.POLICY_WRITE)
.shouldPassWith(PolarisPrivilege.POLICY_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.shouldFailWith(PolarisPrivilege.POLICY_LIST)
.shouldFailWith(PolarisPrivilege.POLICY_DROP)
.shouldFailWith(PolarisPrivilege.POLICY_CREATE)
@@ -155,6 +159,7 @@ public class PolicyCatalogHandlerAuthzTest extends
PolarisAuthzTestBase {
.shouldPassWith(PolarisPrivilege.POLICY_DROP)
.shouldPassWith(PolarisPrivilege.POLICY_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.shouldFailWith(PolarisPrivilege.POLICY_READ)
.shouldFailWith(PolarisPrivilege.POLICY_LIST)
.shouldFailWith(PolarisPrivilege.POLICY_CREATE)
@@ -400,7 +405,10 @@ public class PolicyCatalogHandlerAuthzTest extends
PolarisAuthzTestBase {
.action(() -> newHandler().getApplicablePolicies(null, null, null))
.shouldPassWith(PolarisPrivilege.CATALOG_READ_PROPERTIES)
.shouldPassWith(PolarisPrivilege.CATALOG_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.CATALOG_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
+ .shouldPassWith(PolarisPrivilege.SERVICE_MANAGE_ACCESS)
.shouldFailWith(PolarisPrivilege.NAMESPACE_READ_PROPERTIES)
.shouldFailWith(PolarisPrivilege.POLICY_READ)
.shouldFailWith(PolarisPrivilege.TABLE_READ_PROPERTIES)
@@ -413,7 +421,9 @@ public class PolicyCatalogHandlerAuthzTest extends
PolarisAuthzTestBase {
.action(() -> newHandler().getApplicablePolicies(NS1, null, null))
.shouldPassWith(PolarisPrivilege.NAMESPACE_READ_PROPERTIES)
.shouldPassWith(PolarisPrivilege.NAMESPACE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.NAMESPACE_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
.shouldFailWith(PolarisPrivilege.CATALOG_READ_PROPERTIES)
.shouldFailWith(PolarisPrivilege.POLICY_READ)
.shouldFailWith(PolarisPrivilege.TABLE_READ_PROPERTIES)
@@ -429,7 +439,11 @@ public class PolicyCatalogHandlerAuthzTest extends
PolarisAuthzTestBase {
.getApplicablePolicies(TABLE_NS1_1.namespace(),
TABLE_NS1_1.name(), null))
.shouldPassWith(PolarisPrivilege.TABLE_READ_PROPERTIES)
.shouldPassWith(PolarisPrivilege.TABLE_WRITE_PROPERTIES)
+ .shouldPassWith(PolarisPrivilege.TABLE_READ_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_WRITE_DATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
+ .shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
.shouldFailWith(PolarisPrivilege.CATALOG_READ_PROPERTIES)
.shouldFailWith(PolarisPrivilege.POLICY_READ)
.shouldFailWith(PolarisPrivilege.NAMESPACE_READ_PROPERTIES)
