LennonChin commented on code in PR #7204:
URL: https://github.com/apache/kyuubi/pull/7204#discussion_r2348164902
##########
extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilder.scala:
##########
@@ -100,13 +101,18 @@ object PrivilegesBuilder {
privilegeObjects += PrivilegeObject(table)
case p =>
+ val existsChildOutputHolder =
p.exists(_.isInstanceOf[ChildOutputHolder])
for (child <- p.children) {
// If current plan's references don't have relation to it's input,
have two cases
// 1. `MapInPandas`, `ScriptTransformation`
// 2. `Project` output only have constant value
if (columnPrune(p.references.toSeq ++ p.output, p.inputSet).isEmpty)
{
- // If plan is project and output don't have relation to input, can
ignore.
- if (!p.isInstanceOf[Project]) {
+ // 1. If plan is project and output don't have relation to input,
can ignore.
+ // 2. If sub logic plan tree exists ChildOutputHolder node, it
means that the output of
+ // some nodes in the tree is fixed by RuleChildOutputMarker in
some special
+ // scenarios, such as the Aggregate(count(*)) child node. To
avoid missing child node
+ // permissions, we need to continue checking down.
+ if (!p.isInstanceOf[Project] || existsChildOutputHolder) {
Review Comment:
> Does this affect children that are not `ChildOutputHolder` ?
This check is to allow `PrivilegeBuilder.buildQuery` method continue drill
down to the child nodes of the `ChildOutputHolder` node. Without this check,
the `PrivilegeBuilder.buildQuery` method will terminate before hitting
`ChildOutputHolder`. Since the outputs held by `ChildOutputHolder` are all
useful, combined with `columnPrune` method, I think other child nodes will not
be affected.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
