Abyss-lord commented on code in PR #11026:
URL: https://github.com/apache/gravitino/pull/11026#discussion_r3223379994
##########
clients/client-python/gravitino/api/authorization/privileges.py:
##########
@@ -218,6 +235,1454 @@ class Condition(Enum):
DENY = "DENY"
-class Privileges:
- # TODO Implement the Privileges class.
- pass
+class GenericPrivilege(Privilege):
+ """Abstract class representing a generic privilege."""
+
+ def __init__(
+ self,
+ condition: Privilege.Condition,
+ name: Privilege.Name,
+ ) -> None:
+ self._condition = condition
+ self._name = name
+
+ def name(self) -> Privilege.Name:
+ return self._name
+
+ def condition(self) -> Privilege.Condition:
+ return self._condition
+
+ def simple_string(self) -> str:
+ return f"{self._condition.name} {self._name.name.lower().replace('_',
' ')}"
+
+ def __hash__(self) -> int:
+ return hash((self._condition, self._name))
+
+ def __eq__(self, value: object) -> bool:
+ if not isinstance(value, GenericPrivilege):
+ return False
+ return self._condition == value._condition and self._name ==
value._name
+
+
+class CreateCatalog(GenericPrivilege):
+ """The privilege to create a catalog."""
+
+ _ALLOW_INSTANCE: Optional[CreateCatalog] = None
+ _DENY_INSTANCE: Optional[CreateCatalog] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The privilege with allow condition.
+ """
+ if CreateCatalog._ALLOW_INSTANCE is None:
+ CreateCatalog._ALLOW_INSTANCE = CreateCatalog(
+ Privilege.Condition.ALLOW, Privilege.Name.CREATE_CATALOG
+ )
+ return CreateCatalog._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+ """
+ if CreateCatalog._DENY_INSTANCE is None:
+ CreateCatalog._DENY_INSTANCE = CreateCatalog(
+ Privilege.Condition.DENY, Privilege.Name.CREATE_CATALOG
+ )
+ return CreateCatalog._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type == MetadataObject.Type.METALAKE
+
+
+class UseCatalog(GenericPrivilege):
+ """The privilege to use a catalog."""
+
+ _ALLOW_INSTANCE: Optional[UseCatalog] = None
+ _DENY_INSTANCE: Optional[UseCatalog] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+ """
+ if UseCatalog._ALLOW_INSTANCE is None:
+ UseCatalog._ALLOW_INSTANCE = UseCatalog(
+ Privilege.Condition.ALLOW, Privilege.Name.USE_CATALOG
+ )
+
+ return UseCatalog._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+ """
+ if UseCatalog._DENY_INSTANCE is None:
+ UseCatalog._DENY_INSTANCE = UseCatalog(
+ Privilege.Condition.DENY, Privilege.Name.USE_CATALOG
+ )
+
+ return UseCatalog._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in [MetadataObject.Type.METALAKE,
MetadataObject.Type.CATALOG]
+
+
+class UseSchema(GenericPrivilege):
+ """The privilege to use a schema."""
+
+ _ALLOW_INSTANCE: Optional[UseSchema] = None
+ _DENY_INSTANCE: Optional[UseSchema] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+ """
+ if UseSchema._ALLOW_INSTANCE is None:
+ UseSchema._ALLOW_INSTANCE = UseSchema(
+ Privilege.Condition.ALLOW, Privilege.Name.USE_SCHEMA
+ )
+
+ return UseSchema._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+ """
+ if UseSchema._DENY_INSTANCE is None:
+ UseSchema._DENY_INSTANCE = UseSchema(
+ Privilege.Condition.DENY, Privilege.Name.USE_SCHEMA
+ )
+
+ return UseSchema._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in Privileges.SCHEMA_SUPPORTED_TYPES
+
+
+class CreateSchema(GenericPrivilege):
+ """Privilege to create a schema."""
+
+ _ALLOW_INSTANCE: Optional[CreateSchema] = None
+ _DENY_INSTANCE: Optional[CreateSchema] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+ """
+ if CreateSchema._ALLOW_INSTANCE is None:
+ CreateSchema._ALLOW_INSTANCE = CreateSchema(
+ Privilege.Condition.ALLOW, Privilege.Name.CREATE_SCHEMA
+ )
+
+ return CreateSchema._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+ """
+ if CreateSchema._DENY_INSTANCE is None:
+ CreateSchema._DENY_INSTANCE = CreateSchema(
+ Privilege.Condition.DENY, Privilege.Name.CREATE_SCHEMA
+ )
+
+ return CreateSchema._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in [MetadataObject.Type.METALAKE,
MetadataObject.Type.CATALOG]
+
+
+class CreateTable(GenericPrivilege):
+ """The privilege to create a table."""
+
+ _ALLOW_INSTANCE: Optional[CreateTable] = None
+ _DENY_INSTANCE: Optional[CreateTable] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+ """
+ if CreateTable._ALLOW_INSTANCE is None:
+ CreateTable._ALLOW_INSTANCE = CreateTable(
+ Privilege.Condition.ALLOW, Privilege.Name.CREATE_TABLE
+ )
+
+ return CreateTable._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+ """
+ if CreateTable._DENY_INSTANCE is None:
+ CreateTable._DENY_INSTANCE = CreateTable(
+ Privilege.Condition.DENY, Privilege.Name.CREATE_TABLE
+ )
+
+ return CreateTable._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in Privileges.SCHEMA_SUPPORTED_TYPES
+
+
+class SelectTable(GenericPrivilege):
+ """
+ Privilege to select table.
+ """
+
+ _ALLOW_INSTANCE: Optional[SelectTable] = None
+ _DENY_INSTANCE: Optional[SelectTable] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+ """
+ if SelectTable._ALLOW_INSTANCE is None:
+ SelectTable._ALLOW_INSTANCE = SelectTable(
+ Privilege.Condition.ALLOW, Privilege.Name.SELECT_TABLE
+ )
+
+ return SelectTable._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+ """
+ if SelectTable._DENY_INSTANCE is None:
+ SelectTable._DENY_INSTANCE = SelectTable(
+ Privilege.Condition.DENY, Privilege.Name.SELECT_TABLE
+ )
+
+ return SelectTable._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in Privileges.TABLE_SUPPORTED_TYPES
+
+
+class ModifyTable(GenericPrivilege):
+ """The privilege to write data to a table or modify the table schema."""
+
+ _ALLOW_INSTANCE: Optional[ModifyTable] = None
+ _DENY_INSTANCE: Optional[ModifyTable] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+ """
+ if ModifyTable._ALLOW_INSTANCE is None:
+ ModifyTable._ALLOW_INSTANCE = ModifyTable(
+ Privilege.Condition.ALLOW, Privilege.Name.MODIFY_TABLE
+ )
+
+ return ModifyTable._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+ """
+ if ModifyTable._DENY_INSTANCE is None:
+ ModifyTable._DENY_INSTANCE = ModifyTable(
+ Privilege.Condition.DENY, Privilege.Name.MODIFY_TABLE
+ )
+
+ return ModifyTable._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in Privileges.TABLE_SUPPORTED_TYPES
+
+
+class CreateFileset(GenericPrivilege):
+ """The privilege to create a fileset."""
+
+ _ALLOW_INSTANCE: Optional[CreateFileset] = None
+ _DENY_INSTANCE: Optional[CreateFileset] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+ """
+ if CreateFileset._ALLOW_INSTANCE is None:
+ CreateFileset._ALLOW_INSTANCE = CreateFileset(
+ Privilege.Condition.ALLOW, Privilege.Name.CREATE_FILESET
+ )
+
+ return CreateFileset._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+ """
+ if CreateFileset._DENY_INSTANCE is None:
+ CreateFileset._DENY_INSTANCE = CreateFileset(
+ Privilege.Condition.DENY, Privilege.Name.CREATE_FILESET
+ )
+
+ return CreateFileset._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in Privileges.SCHEMA_SUPPORTED_TYPES
+
+
+class ReadFileset(GenericPrivilege):
+ """
+ Privilege to read fileset.
+ """
+
+ _ALLOW_INSTANCE: Optional[ReadFileset] = None
+ _DENY_INSTANCE: Optional[ReadFileset] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+ """
+ if ReadFileset._ALLOW_INSTANCE is None:
+ ReadFileset._ALLOW_INSTANCE = ReadFileset(
+ Privilege.Condition.ALLOW, Privilege.Name.READ_FILESET
+ )
+
+ return ReadFileset._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+ """
+ if ReadFileset._DENY_INSTANCE is None:
+ ReadFileset._DENY_INSTANCE = ReadFileset(
+ Privilege.Condition.DENY, Privilege.Name.READ_FILESET
+ )
+
+ return ReadFileset._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in Privileges.FILESET_SUPPORTED_TYPES
+
+
+class WriteFileset(GenericPrivilege):
+ """
+ Privilege to write fileset.
+ """
+
+ _ALLOW_INSTANCE: Optional[WriteFileset] = None
+ _DENY_INSTANCE: Optional[WriteFileset] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+ """
+ if WriteFileset._ALLOW_INSTANCE is None:
+ WriteFileset._ALLOW_INSTANCE = WriteFileset(
+ Privilege.Condition.ALLOW, Privilege.Name.WRITE_FILESET
+ )
+
+ return WriteFileset._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+
+ """
+ if WriteFileset._DENY_INSTANCE is None:
+ WriteFileset._DENY_INSTANCE = WriteFileset(
+ Privilege.Condition.DENY, Privilege.Name.WRITE_FILESET
+ )
+
+ return WriteFileset._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in Privileges.FILESET_SUPPORTED_TYPES
+
+
+class CreateTopic(GenericPrivilege):
+ """The privilege to create a topic."""
+
+ _ALLOW_INSTANCE: Optional[CreateTopic] = None
+ _DENY_INSTANCE: Optional[CreateTopic] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+
+ """
+ if CreateTopic._ALLOW_INSTANCE is None:
+ CreateTopic._ALLOW_INSTANCE = CreateTopic(
+ Privilege.Condition.ALLOW, Privilege.Name.CREATE_TOPIC
+ )
+
+ return CreateTopic._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+
+ """
+ if CreateTopic._DENY_INSTANCE is None:
+ CreateTopic._DENY_INSTANCE = CreateTopic(
+ Privilege.Condition.DENY, Privilege.Name.CREATE_TOPIC
+ )
+
+ return CreateTopic._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in Privileges.SCHEMA_SUPPORTED_TYPES
+
+
+class ConsumeTopic(GenericPrivilege):
+ """
+ Privilege for consuming a topic.
+ """
+
+ _ALLOW_INSTANCE: Optional[ConsumeTopic] = None
+ _DENY_INSTANCE: Optional[ConsumeTopic] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+
+ """
+ if ConsumeTopic._ALLOW_INSTANCE is None:
+ ConsumeTopic._ALLOW_INSTANCE = ConsumeTopic(
+ Privilege.Condition.ALLOW, Privilege.Name.CONSUME_TOPIC
+ )
+
+ return ConsumeTopic._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+
+ """
+ if ConsumeTopic._DENY_INSTANCE is None:
+ ConsumeTopic._DENY_INSTANCE = ConsumeTopic(
+ Privilege.Condition.DENY, Privilege.Name.CONSUME_TOPIC
+ )
+
+ return ConsumeTopic._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in Privileges.TOPIC_SUPPORTED_TYPES
+
+
+class ProduceTopic(GenericPrivilege):
+ """The privilege to produce to a topic."""
+
+ _ALLOW_INSTANCE: Optional[ProduceTopic] = None
+ _DENY_INSTANCE: Optional[ProduceTopic] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+
+ """
+ if ProduceTopic._ALLOW_INSTANCE is None:
+ ProduceTopic._ALLOW_INSTANCE = ProduceTopic(
+ Privilege.Condition.ALLOW, Privilege.Name.PRODUCE_TOPIC
+ )
+
+ return ProduceTopic._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+
+ """
+ if ProduceTopic._DENY_INSTANCE is None:
+ ProduceTopic._DENY_INSTANCE = ProduceTopic(
+ Privilege.Condition.DENY, Privilege.Name.PRODUCE_TOPIC
+ )
+
+ return ProduceTopic._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type in Privileges.TOPIC_SUPPORTED_TYPES
+
+
+class ManageUsers(GenericPrivilege):
+ """The privilege to manage users."""
+
+ _ALLOW_INSTANCE: Optional[ManageUsers] = None
+ _DENY_INSTANCE: Optional[ManageUsers] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+
+ """
+ if ManageUsers._ALLOW_INSTANCE is None:
+ ManageUsers._ALLOW_INSTANCE = ManageUsers(
+ Privilege.Condition.ALLOW, Privilege.Name.MANAGE_USERS
+ )
+ return ManageUsers._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+
+ """
+ if ManageUsers._DENY_INSTANCE is None:
+ ManageUsers._DENY_INSTANCE = ManageUsers(
+ Privilege.Condition.DENY, Privilege.Name.MANAGE_USERS
+ )
+ return ManageUsers._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type == MetadataObject.Type.METALAKE
+
+
+class ManageGroups(GenericPrivilege):
+ """The privilege to manage groups."""
+
+ _ALLOW_INSTANCE: Optional[ManageGroups] = None
+ _DENY_INSTANCE: Optional[ManageGroups] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+
+ """
+ if ManageGroups._ALLOW_INSTANCE is None:
+ ManageGroups._ALLOW_INSTANCE = ManageGroups(
+ Privilege.Condition.ALLOW, Privilege.Name.MANAGE_GROUPS
+ )
+
+ return ManageGroups._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+
+ """
+ if ManageGroups._DENY_INSTANCE is None:
+ ManageGroups._DENY_INSTANCE = ManageGroups(
+ Privilege.Condition.DENY, Privilege.Name.MANAGE_GROUPS
+ )
+
+ return ManageGroups._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type == MetadataObject.Type.METALAKE
+
+
+class CreateRole(GenericPrivilege):
+ """The privilege to create a role."""
+
+ _ALLOW_INSTANCE: Optional[CreateRole] = None
+ _DENY_INSTANCE: Optional[CreateRole] = None
+
+ @staticmethod
+ def allow() -> Privilege:
+ """
+ Retrieve the instance with allow condition of the privilege.
+
+ Returns:
+ Privilege: The instance with allow condition of the privilege.
+
+ """
+ if CreateRole._ALLOW_INSTANCE is None:
+ CreateRole._ALLOW_INSTANCE = CreateRole(
+ Privilege.Condition.ALLOW, Privilege.Name.CREATE_ROLE
+ )
+
+ return CreateRole._ALLOW_INSTANCE
+
+ @staticmethod
+ def deny() -> Privilege:
+ """
+ Retrieve the instance with deny condition of the privilege.
+
+ Returns:
+ Privilege: The instance with deny condition of the privilege.
+
+ """
+ if CreateRole._DENY_INSTANCE is None:
+ CreateRole._DENY_INSTANCE = CreateRole(
+ Privilege.Condition.DENY, Privilege.Name.CREATE_ROLE
+ )
+
+ return CreateRole._DENY_INSTANCE
+
+ def can_bind_to(self, obj_type: MetadataObject.Type) -> bool:
+ return obj_type == MetadataObject.Type.METALAKE
+
+
+class ManageGrants(GenericPrivilege):
+ """
+ The privilege to grant or revoke privileges on securable objects. If bound
on the metalake,
+ we can grant or revoke the role for users or groups.Unlike most privileges,
+ this can be bound at any level of the object hierarchy — METALAKE,
+ CATALOG, SCHEMA, TABLE, VIEW, TOPIC, FILESET, or MODEL.
Review Comment:
fix
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
