SentryStore implements SentryStoreInterface { public synchronized void updateOwnerPrivilege(final TSentryAuthorizable tAuthorizable, String ownerName, SentryPrincipalType principalType, final List<Update> updates) throws Exception { execute(updates, pm -> { if(principalType == null) { LOGGER.info("Invalid principal Type"); } pm.setDetachAllOnCommit(false); TSentryPrivilege tOwnerPrivilege = toSentryPrivilege(tAuthorizable); tOwnerPrivilege.setAction(AccessConstants.OWNER); revokeOwnerPrivilegesCore(pm, tAuthorizable); try { if(ownerPrivilegeWithGrant) { tOwnerPrivilege.setGrantOption(TSentryGrantOption.TRUE); } alterSentryGrantPrivilegeCore(pm, principalType, ownerName, tOwnerPrivilege); return null; } catch (JDODataStoreException e) { throw new SentryInvalidInputException("Failed to grant owner privilege on Authorizable : " + tAuthorizable.toString() + " to " + principalType.toString() + ": " + ownerName + " " + e.getMessage()); } }); } SentryStore(Configuration conf); static Properties getDataNucleusProperties(Configuration conf); void setPersistUpdateDeltas(boolean persistUpdateDeltas); TransactionManager getTransactionManager(); CounterWait getCounterWait(); synchronized void stop(); MSentryRole getRole(PersistenceManager pm, String roleName); @SuppressWarnings("unchecked") List<MSentryRole> getAllRoles(PersistenceManager pm); MSentryUser getUser(PersistenceManager pm, String userName); void createSentryUser(final String userName); void createSentryRole(final String roleName); Gauge<Long> getRoleCountGauge(); Gauge<Long> getPrivilegeCountGauge(); Gauge<Long> getGenericModelPrivilegeCountGauge(); Gauge<Long> getGroupCountGauge(); Gauge<Long> getAuthzObjectsCountGauge(); Gauge<Long> getAuthzPathsCountGauge(); Gauge<Integer> getHMSWaitersCountGauge(); Gauge<Long> getLastNotificationIdGauge(); Gauge<Long> getLastPathsSnapshotIdGauge(); Gauge<Long> getPermChangeIdGauge(); Gauge<Long> getPathChangeIdGauge(); void clearHmsPathInformation(); void purgeDeltaChangeTables(); void purgeNotificationIdTable(); @Override void alterSentryRoleGrantPrivileges(final String roleName,
    final Set<TSentryPrivilege> privileges); @Override void alterSentryRoleGrantPrivileges(final String roleName,
    final Set<TSentryPrivilege> privileges,
    final Map<TSentryPrivilege, Update> privilegesUpdateMap); void alterSentryUserGrantPrivileges(final String userName,
    final Set<TSentryPrivilege> privileges); void alterSentryGrantOwnerPrivilege(final String principalName, SentryPrincipalType entityType,
                                              final TSentryPrivilege privilege,
                                              final Update update); @VisibleForTesting MSentryUser getMSentryUserByName(final String userName); void alterSentryUserRevokePrivileges(final String userName,
    final Set<TSentryPrivilege> tPrivileges); @Override void alterSentryRoleRevokePrivileges(final String roleName,
    final Set<TSentryPrivilege> tPrivileges); @Override void alterSentryRoleRevokePrivileges(final String roleName, final Set<TSentryPrivilege> tPrivileges,
    final Map<TSentryPrivilege, Update> privilegesUpdateMap); void dropSentryUser(final String userName); synchronized void dropSentryUser(final String userName,
      final Update update); void dropSentryRole(final String roleName); synchronized void dropSentryRole(final String roleName,
      final Update update); void alterSentryRoleAddGroups(final String grantorPrincipal,
      final String roleName, final Set<TSentryGroup> groupNames); synchronized void alterSentryRoleAddGroups(final String grantorPrincipal,
      final String roleName, final Set<TSentryGroup> groupNames,
      final Update update); void alterSentryRoleAddUsers(final String roleName,
      final Set<String> userNames); void alterSentryRoleDeleteUsers(final String roleName,
      final Set<String> userNames); void alterSentryRoleDeleteGroups(final String roleName,
      final Set<TSentryGroup> groupNames); synchronized void alterSentryRoleDeleteGroups(final String roleName,
      final Set<TSentryGroup> groupNames, final Update update); @VisibleForTesting MSentryRole getMSentryRoleByName(final String roleName); Set<TSentryPrivilege> getAllTSentryPrivilegesByUserName(String userName); TSentryPrivilegeMap listSentryPrivilegesByAuthorizable(Set<String> groups,
      TSentryActiveRoleSet activeRoles,
      TSentryAuthorizable authHierarchy, boolean isAdmin); List<SentryOwnerInfo> listOwnersByAuthorizable(TSentryAuthorizable authorizable); TSentryPrivilegeMap listSentryPrivilegesByAuthorizableForUser(Set<String> userNames,
      TSentryAuthorizable authHierarchy, boolean isAdmin); Set<TSentryPrivilege> getAllTSentryPrivilegesByRoleName(String roleName); Set<TSentryPrivilege> getTSentryPrivileges(SentryPrincipalType principalType, Set<String> principalNames,
                                                    TSentryAuthorizable authHierarchy); Set<TSentryRole> getTSentryRolesByGroupName(final Set<String> groupNames,
                                                     final boolean checkAllGroups); Set<String> getRoleNamesForGroups(final Set<String> groups); Set<String> getRoleNamesForUsers(final Set<String> users); Set<TSentryRole> getTSentryRolesByUserNames(final Set<String> users); Set<MSentryRole> getRolesForGroups(PersistenceManager pm, Set<String> groups); @Override Set<TSentryPrivilege> listSentryPrivilegesByUsersAndGroups(
      Set<String> groups, Set<String> users, TSentryActiveRoleSet roleSet,
      TSentryAuthorizable authHierarchy); Set<String> listSentryPrivilegesForProvider(
      Set<String> groups, Set<String> users, TSentryActiveRoleSet roleSet,
      TSentryAuthorizable authHierarchy); boolean hasAnyServerPrivileges(Set<String> groups, Set<String> users,
      TSentryActiveRoleSet roleSet, String server); @VisibleForTesting static Set<String> toTrimedLower(Set<String> s); void dropPrivilege(final TSentryAuthorizable tAuthorizable); synchronized void dropPrivilege(final TSentryAuthorizable tAuthorizable,
      final Update update); synchronized void updateOwnerPrivilege(final TSentryAuthorizable tAuthorizable,
      String ownerName,  SentryPrincipalType principalType,
      final List<Update> updates); void revokeOwnerPrivilegesCore(PersistenceManager pm, final TSentryAuthorizable tAuthorizable); void renamePrivilege(final TSentryAuthorizable oldTAuthorizable,
      final TSentryAuthorizable newTAuthorizable); synchronized void renamePrivilege(final TSentryAuthorizable oldTAuthorizable,
      final TSentryAuthorizable newTAuthorizable, final Update update); static String toNULLCol(String s); PermissionsImage retrieveFullPermssionsImage(); PathsUpdate retrieveFullPathsImageUpdate(final String[] prefixes); void persistFullPathsImage(final Map<String, Collection<String>> authzPaths,
      final long notificationID); void logPersistingFullSnapshotState(int totalNumberOfObjectsToPersist,
      int totalNumberOfPathsToPersist, int objectsPersistedCount, int pathsPersistedCount); void addAuthzPathsMapping(final String authzObj, final Collection<String> paths,
      final UniquePathsUpdate update); void deleteAuthzPathsMapping(final String authzObj, final Collection<String> paths,
      final UniquePathsUpdate update); void deleteAllAuthzPathsMapping(final String authzObj, final UniquePathsUpdate update); void renameAuthzPathsMapping(final String oldObj, final String newObj,
      final String oldPath, final String newPath, final UniquePathsUpdate update); void renameAuthzObj(final String oldObj, final String newObj,
      final UniquePathsUpdate update); boolean isAuthzPathsMappingEmpty(); boolean isHmsNotificationEmpty(); boolean isAuthzPathsSnapshotEmpty(); void updateAuthzPathsMapping(final String authzObj, final String oldPath,
        final String newPath, final UniquePathsUpdate update); @SuppressWarnings("unchecked") List<Map<String, Set<String>>> getGroupUserRoleMapList(final Collection<String> roleNames); List<MSentryPrivilege> getPrivilegesForAuthorizables(List<TSentryAuthorizable> authHierarchyList); Map<String, Set<TSentryPrivilege>> getRoleNameTPrivilegesMap(final String dbName,
        final String tableName); Set<String> getAllRoleNames(); void importSentryMetaData(final TSentryMappingData tSentryMappingData,
      final boolean isOverwriteForRole); static Set<String> rolesToRoleNames(final Iterable<MSentryRole> roles); void setLastProcessedNotificationID(final Long notificationId); void persistLastProcessedNotificationID(final Long notificationId); Long getLastProcessedPermChangeID(); Long getLastProcessedPathChangeID(); Long getLastProcessedNotificationID(); long getLastProcessedImageID(); MSentryPermChange getMSentryPermChangeByID(final long changeID); Boolean permChangeExists(final long changeID); Boolean pathChangeExists(final long changeID); MSentryPathChange getMSentryPathChangeByID(final long changeID); List<MSentryPathChange> getMSentryPathChanges(final long changeID); List<MSentryPermChange> getMSentryPermChanges(final long changeID); boolean validateDeltaChanges(final long changeID, List<T> changes); boolean isNotificationProcessed(final String hash); PrivilegePrincipal getEntity(PersistenceManager pm, String name, SentryPrincipalType type); @Override Map<String, Set<TSentryPrivilege>> getAllRolesPrivileges(); @Override Map<String, Set<TSentryPrivilege>> getAllUsersPrivileges();  }
@Test public void testUpdateOwnerPrivilege() throws Exception { String roleName1 = "list-privs-r1", roleName2 = "list-privs-r2", roleName3 = "list-privs-r3"; String userName1 = "user1", userName2 = "user2"; List<SentryOwnerInfo> ownerInfoList = null; sentryStore.createSentryRole(roleName1); sentryStore.createSentryRole(roleName2); sentryStore.createSentryRole(roleName3); sentryStore.createSentryUser(userName1); sentryStore.createSentryUser(userName2); TSentryPrivilege privilege_tbl1 = new TSentryPrivilege(); privilege_tbl1.setPrivilegeScope("TABLE"); privilege_tbl1.setServerName("server1"); privilege_tbl1.setDbName("db1"); privilege_tbl1.setTableName("tbl1"); privilege_tbl1.setCreateTime(System.currentTimeMillis()); privilege_tbl1.setAction("OWNER"); TSentryAuthorizable tSentryAuthorizable = new TSentryAuthorizable(); tSentryAuthorizable.setServer("server1"); tSentryAuthorizable.setDb("db1"); tSentryAuthorizable.setTable("tbl1"); sentryStore.alterSentryGrantPrivileges(SentryPrincipalType.ROLE, roleName1, Sets.newHashSet(privilege_tbl1), null); assertEquals(1, sentryStore.getAllTSentryPrivilegesByRoleName(roleName1) .size()); assertEquals(0, sentryStore.getAllTSentryPrivilegesByRoleName(roleName2) .size()); ownerInfoList = sentryStore.listOwnersByAuthorizable(tSentryAuthorizable); assertEquals(1, ownerInfoList.size()); assertEquals(SentryPrincipalType.ROLE, ownerInfoList.get(0).getOwnerType()); assertEquals(roleName1, ownerInfoList.get(0).getOwnerName()); sentryStore.updateOwnerPrivilege(tSentryAuthorizable, roleName2, SentryPrincipalType.ROLE, null); ownerInfoList = sentryStore.listOwnersByAuthorizable(tSentryAuthorizable); assertEquals(1, ownerInfoList.size()); assertEquals(SentryPrincipalType.ROLE, ownerInfoList.get(0).getOwnerType()); assertEquals(roleName2, ownerInfoList.get(0).getOwnerName()); assertEquals(0, sentryStore.getAllTSentryPrivilegesByRoleName(roleName1) .size()); assertEquals(1, sentryStore.getAllTSentryPrivilegesByRoleName(roleName2) .size()); tSentryAuthorizable.setTable("tbl2"); TSentryPrivilege privilege_tbl2 = new TSentryPrivilege(privilege_tbl1); privilege_tbl2.setTableName("tbl2"); sentryStore.alterSentryGrantPrivileges(SentryPrincipalType.USER,userName1, Sets.newHashSet(privilege_tbl2), null); assertEquals(1, sentryStore.getAllTSentryPrivilegesByUserName(userName1) .size()); sentryStore.updateOwnerPrivilege(tSentryAuthorizable, userName2, SentryPrincipalType.USER, null); assertEquals(1, sentryStore.getAllTSentryPrivilegesByUserName(userName2) .size()); ownerInfoList = sentryStore.listOwnersByAuthorizable(tSentryAuthorizable); assertEquals(1, ownerInfoList.size()); assertEquals(SentryPrincipalType.USER, ownerInfoList.get(0).getOwnerType()); assertEquals(userName2, ownerInfoList.get(0).getOwnerName()); sentryStore.updateOwnerPrivilege(tSentryAuthorizable, roleName1, SentryPrincipalType.ROLE, null); assertEquals(1, sentryStore.getAllTSentryPrivilegesByRoleName(roleName1) .size()); TSentryPrivilege privilege_tbl2_all = new TSentryPrivilege(privilege_tbl2); privilege_tbl2_all.setAction(AccessConstants.ALL); sentryStore.alterSentryGrantPrivileges(SentryPrincipalType.ROLE, roleName1, Sets.newHashSet(privilege_tbl2_all), null); assertEquals(2, sentryStore.getAllTSentryPrivilegesByRoleName(roleName1) .size()); tSentryAuthorizable.setTable("tbl3"); TSentryPrivilege privilege_tbl3_all = new TSentryPrivilege(privilege_tbl2); privilege_tbl3_all.setAction(AccessConstants.ALL); privilege_tbl3_all.setTableName("tbl3"); sentryStore.alterSentryGrantPrivileges(SentryPrincipalType.ROLE, roleName3, Sets.newHashSet(privilege_tbl3_all), null); assertEquals(1, sentryStore.getAllTSentryPrivilegesByRoleName(roleName3) .size()); TSentryPrivilege privilege_tbl3_owner = new TSentryPrivilege(privilege_tbl3_all); privilege_tbl3_owner.setAction(AccessConstants.OWNER); sentryStore.alterSentryGrantPrivileges(SentryPrincipalType.ROLE, roleName3, Sets.newHashSet(privilege_tbl3_owner), null); assertEquals(2, sentryStore.getAllTSentryPrivilegesByRoleName(roleName3) .size()); }