Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[KYUUBI #5407][AUTHZ] Tests for Iceberg system procedures of snapshot management #5394

Closed
wants to merge 3 commits into from
Closed

[KYUUBI #5407][AUTHZ] Tests for Iceberg system procedures of snapshot management #5394

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8ba97c6
Add UT for checking previleges in iceberg call snapshot management
yabola Oct 10, 2023
23fe49a
refactor ut
bowenliang123 Oct 11, 2023
98b7492
split into 3 ut for snapshot management
bowenliang123 Oct 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 43 additions & 1 deletion ...org/apache/kyuubi/plugin/spark/authz/ranger/IcebergCatalogRangerSparkExtensionSuite.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,14 @@
*/
package org.apache.kyuubi.plugin.spark.authz.ranger

// scalastyle:off
import java.sql.Timestamp
import java.text.SimpleDateFormat

import scala.util.Try

import org.scalatest.Outcome

// scalastyle:off
import org.apache.kyuubi.Utils
import org.apache.kyuubi.plugin.spark.authz.AccessControlException
import org.apache.kyuubi.plugin.spark.authz.RangerTestNamespace._
Expand Down Expand Up @@ -286,4 +289,43 @@ class IcebergCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite
})
}
}

test("CALL snapshot management") {
val tableName = "table_select_call_command_table"
val table = s"$catalogV2.$namespace1.$tableName"

withCleanTmpResources(Seq((table, "table"))) {
doAs(admin, sql(s"CREATE TABLE IF NOT EXISTS $table (id int, name string) USING iceberg"))
val initSnapshots = 2
(0 until initSnapshots).foreach(i =>
doAs(admin, sql(s"INSERT INTO $table VALUES ($i, 'user_$i')")))

val existedSnapshots =
sql(s"SELECT * FROM $table.snapshots ORDER BY committed_at ASC LIMIT 1").collect()
val targetSnapshot = existedSnapshots(0)
val targetSnapshotId = targetSnapshot.getAs[Long]("snapshot_id")

val callRollbackToSnapshot =
s"CALL $catalogV2.system.rollback_to_snapshot (table => '$table', snapshot_id => $targetSnapshotId)"
val callRollbackToTimestamp = {
val targetSnapshotCommittedAt = targetSnapshot.getAs[Timestamp]("committed_at")
val targetTimestamp = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS")
.format(targetSnapshotCommittedAt.getTime + 1)
s"CALL $catalogV2.system.rollback_to_timestamp (table => '$table', timestamp => TIMESTAMP '$targetTimestamp')"
}
val callSetCurrentSnapshot =
s"CALL $catalogV2.system.set_current_snapshot (table => '$table', snapshot_id => $targetSnapshotId)"

interceptContains[AccessControlException](doAs(someone, sql(callRollbackToSnapshot)))(
s"does not have [alter] privilege on [$namespace1/$tableName]")
interceptContains[AccessControlException](doAs(someone, sql(callRollbackToTimestamp)))(
s"does not have [alter] privilege on [$namespace1/$tableName]")
interceptContains[AccessControlException](doAs(someone, sql(callSetCurrentSnapshot)))(
s"does not have [alter] privilege on [$namespace1/$tableName]")

doAs(admin, sql(callRollbackToSnapshot))
doAs(admin, sql(callRollbackToTimestamp))
doAs(admin, sql(callSetCurrentSnapshot))
}
}
}
Loading