AngersZhuuuu commented on code in PR #5563:
URL: https://github.com/apache/kyuubi/pull/5563#discussion_r1376017692
##########
extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala:
##########
@@ -992,7 +997,38 @@ class HiveCatalogRangerSparkExtensionSuite extends
RangerSparkExtensionSuite {
|)
|""".stripMargin).show()))(
s"does not have [select] privilege on " +
- s"[$db1/$table1/id,$db1/$table1/scope]")
+ s"[$db1/$table1/id]")
+
+ interceptContains[AccessControlException](
+ doAs(
+ someone,
+ sql(
+ s"""
+ |SELECT t1.id
+ |FROM $db1.$table1 t1,
+ |LATERAL (
+ | SELECT *
+ | FROM $db1.$table2 t2
+ | WHERE t1.id = t2.id
+ |)
+ |""".stripMargin).show()))(
+ s"does not have [select] privilege on " +
+ s"[$db1/$table2/id,$db1/$table2/scope]")
+ interceptContains[AccessControlException](
+ doAs(
+ table2OnlyUser,
+ sql(
+ s"""
+ |SELECT t1.id
+ |FROM $db1.$table1 t1,
+ |LATERAL (
+ | SELECT *
+ | FROM $db1.$table2 t2
+ | WHERE t1.id = t2.id
+ |)
+ |""".stripMargin).show()))(
+ s"does not have [select] privilege on " +
+ s"[$db1/$table1/id]")
Review Comment:
Debug that when check the whole plan, only check table1, won't check table2
again.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
