vyommani commented on code in PR #1316:
URL: https://github.com/apache/ranger/pull/1316#discussion_r4438820225
##########
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefHelper.java:
##########
@@ -600,6 +636,89 @@ public RangerResourceDef getResourceDef(String
resourceName, Integer policyType)
return ret;
}
+ public Set<List<RangerResourceDef>> getConstraintHierarchies(String
constraint) {
+ Set<List<RangerResourceDef>> ret = constraint == null ? null :
constraintHierarchies.get(constraint);
+
+ return ret == null ? EMPTY_RESOURCE_HIERARCHY : ret;
+ }
+
+ private Map<String, RangerConstraintDef>
buildConstraintDefs(RangerServiceDef serviceDef) {
+ Map<String, RangerConstraintDef> ret = new HashMap<>();
+
+ if (CollectionUtils.isNotEmpty(serviceDef.getConstraintDefs())) {
+ for (RangerConstraintDef constraintDef :
serviceDef.getConstraintDefs()) {
+ if (constraintDef != null &&
StringUtils.isNotEmpty(constraintDef.getName())) {
+ ret.putIfAbsent(constraintDef.getName(),
constraintDef);
+ }
+ }
+ }
+
+ return Collections.unmodifiableMap(ret);
+ }
+
+ /*
+ * Hierarchies of each constraint, built from the resources listed in
the constraint def - same as for data-mask and row-filter defs.
+ * Building a graph keeps sibling resources (like database->table and
database->udf) in separate hierarchies.
+ * A constraint def that lists no resources uses the access
hierarchies.
+ * A constraint def that lists a resource without its parent has no
hierarchies; service-def validation rejects such defs.
+ */
+ private Map<String, Set<List<RangerResourceDef>>>
buildConstraintHierarchies(RangerServiceDef serviceDef) {
+ Map<String, Set<List<RangerResourceDef>>> ret = new HashMap<>();
+
+ for (RangerConstraintDef constraintDef : constraintDefs.values()) {
+ final Set<List<RangerResourceDef>> hierarchies;
+
+ if (CollectionUtils.isEmpty(constraintDef.getResources())) {
+ hierarchies =
getResourceHierarchies(RangerPolicy.POLICY_TYPE_ACCESS);
Review Comment:
addressed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
