AngersZhuuuu commented on code in PR #5482:
URL: https://github.com/apache/kyuubi/pull/5482#discussion_r1366428194
##########
extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/HudiCatalogRangerSparkExtensionSuite.scala:
##########
@@ -407,4 +407,66 @@ class HudiCatalogRangerSparkExtensionSuite extends
RangerSparkExtensionSuite {
}
}
}
+
+
test("DeleteHoodieTableCommand/UpdateHoodieTableCommand/MergeIntoHoodieTableCommand")
{
+ withSingleCallEnabled {
+ withCleanTmpResources(Seq(
+ (s"$namespace1.$table1", "table"),
+ (s"$namespace1.$table2", "table"),
+ (namespace1, "database"))) {
+ doAs(admin, sql(s"CREATE DATABASE IF NOT EXISTS $namespace1"))
+ doAs(
+ admin,
+ sql(
+ s"""
+ |CREATE TABLE IF NOT EXISTS $namespace1.$table1(id int, name
string, city string)
+ |USING HUDI
+ |OPTIONS (
+ | type = 'cow',
+ | primaryKey = 'id',
+ | 'hoodie.datasource.hive_sync.enable' = 'false'
+ |)
+ |PARTITIONED BY(city)
+ |""".stripMargin))
+
+ doAs(
+ admin,
+ sql(
+ s"""
+ |CREATE TABLE IF NOT EXISTS $namespace1.$table2(id int, name
string, city string)
+ |USING HUDI
+ |OPTIONS (
+ | type = 'cow',
+ | primaryKey = 'id',
+ | 'hoodie.datasource.hive_sync.enable' = 'false'
+ |)
+ |PARTITIONED BY(city)
+ |""".stripMargin))
+
+ val deleteFrom = s"DELETE FROM $namespace1.$table1 WHERE id = 10"
+ interceptContains[AccessControlException] {
+ doAs(someone, sql(deleteFrom))
+ }(s"does not have [update] privilege on [$namespace1/$table1]")
+
+ val updateSql = s"UPDATE $namespace1.$table1 SET name = 'test' WHERE
id > 10"
+ interceptContains[AccessControlException] {
+ doAs(someone, sql(updateSql))
+ }(s"does not have [update] privilege on [$namespace1/$table1]")
+
+ val mergeIntoSQL =
+ s"""
+ |MERGE INTO $namespace1.$table1 target
+ |USING $namespace1.$table2 source
+ |ON target.id = source.id
+ |WHEN MATCHED
+ |AND target.name == 'test'
+ | THEN UPDATE SET id = source.id, name = source.name, city =
source.city
+ |""".stripMargin
+ interceptContains[AccessControlException] {
+ doAs(someone, sql(mergeIntoSQL))
+ }(s"does not have [select] privilege on " +
+
s"[$namespace1/$table2/id,$namespace1/$table2/name,$namespace1/$table2/city]")
+ }
Review Comment:
> Another case for a user has select privilege but not the update privilege
of the table is required.
How can I set this? is there any example?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
