SentryStore { public Set<String> listSentryPrivilegesForProvider(Set<String> groups, TSentryActiveRoleSet roleSet, TSentryAuthorizable authHierarchy) throws SentryInvalidInputException { Set<String> result = Sets.newHashSet(); Set<String> rolesToQuery = getRolesToQuery(groups, roleSet); List<MSentryPrivilege> mSentryPrivileges = getMSentryPrivileges(rolesToQuery, authHierarchy); for (MSentryPrivilege priv : mSentryPrivileges) { result.add(toAuthorizable(priv)); } return result; } SentryStore(Configuration conf); synchronized void stop(); synchronized PersistenceManager openTransaction(); synchronized CommitContext commitUpdateTransaction(PersistenceManager pm); void commitTransaction(PersistenceManager pm); void rollbackTransaction(PersistenceManager pm); MSentryRole getMSentryRole(PersistenceManager pm, String roleName); CommitContext createSentryRole(String roleName); Gauge<Long> getRoleCountGauge(); Gauge<Long> getPrivilegeCountGauge(); Gauge<Long> getGroupCountGauge(); CommitContext alterSentryRoleGrantPrivilege(String grantorPrincipal,
      String roleName, TSentryPrivilege privilege); CommitContext alterSentryRoleGrantPrivileges(String grantorPrincipal,
      String roleName, Set<TSentryPrivilege> privileges); CommitContext alterSentryRoleRevokePrivilege(String grantorPrincipal,
      String roleName, TSentryPrivilege tPrivilege); CommitContext alterSentryRoleRevokePrivileges(String grantorPrincipal,
      String roleName, Set<TSentryPrivilege> tPrivileges); CommitContext dropSentryRole(String roleName); CommitContext alterSentryRoleAddGroups( String grantorPrincipal, String roleName,
      Set<TSentryGroup> groupNames); CommitContext alterSentryRoleDeleteGroups(String roleName,
      Set<TSentryGroup> groupNames); TSentryPrivilegeMap listSentryPrivilegesByAuthorizable(
      Set<String> groups, TSentryActiveRoleSet activeRoles,
      TSentryAuthorizable authHierarchy, boolean isAdmin); Set<TSentryPrivilege> getAllTSentryPrivilegesByRoleName(String roleName); Set<TSentryPrivilege> getTSentryPrivileges(Set<String> roleNames, TSentryAuthorizable authHierarchy); Set<TSentryRole> getTSentryRolesByGroupName(Set<String> groupNames,
      boolean checkAllGroups); Set<String> getRoleNamesForGroups(Set<String> groups); Set<MSentryRole> getRolesForGroups(PersistenceManager pm, Set<String> groups); Set<String> listAllSentryPrivilegesForProvider(Set<String> groups, TSentryActiveRoleSet roleSet); Set<String> listSentryPrivilegesForProvider(Set<String> groups,
      TSentryActiveRoleSet roleSet, TSentryAuthorizable authHierarchy); boolean hasAnyServerPrivileges(Set<String> groups, TSentryActiveRoleSet roleSet, String server); String getSentryVersion(); void setSentryVersion(String newVersion, String verComment); void dropPrivilege(TSentryAuthorizable tAuthorizable); void renamePrivilege(TSentryAuthorizable tAuthorizable,
      TSentryAuthorizable newTAuthorizable); static String toNULLCol(String s); static String fromNULLCol(String s); static boolean isNULL(String s); Map<String, HashMap<String, String>> retrieveFullPrivilegeImage(); Map<String, LinkedList<String>> retrieveFullRoleImage(); Map<String, Set<String>> getGroupNameRoleNamesMap(); Map<String, Set<TSentryPrivilege>> getRoleNameTPrivilegesMap(); Set<String> getAllRoleNames(); void importSentryMetaData(TSentryMappingData tSentryMappingData, boolean isOverwriteForRole); static String NULL_COL; }
@Test public void testListSentryPrivilegesForProvider() throws Exception { String roleName1 = "list-privs-r1", roleName2 = "list-privs-r2"; String groupName1 = "list-privs-g1", groupName2 = "list-privs-g2"; String grantor = "g1"; long seqId = sentryStore.createSentryRole(roleName1).getSequenceId(); assertEquals(seqId + 1, sentryStore.createSentryRole(roleName2).getSequenceId()); TSentryPrivilege privilege1 = new TSentryPrivilege(); privilege1.setPrivilegeScope("TABLE"); privilege1.setServerName("server1"); privilege1.setDbName("db1"); privilege1.setTableName("tbl1"); privilege1.setAction("SELECT"); privilege1.setCreateTime(System.currentTimeMillis()); assertEquals(seqId + 2, sentryStore.alterSentryRoleGrantPrivilege(grantor, roleName1, privilege1) .getSequenceId()); assertEquals(seqId + 3, sentryStore.alterSentryRoleGrantPrivilege(grantor, roleName2, privilege1) .getSequenceId()); TSentryPrivilege privilege2 = new TSentryPrivilege(); privilege2.setPrivilegeScope("SERVER"); privilege2.setServerName("server1"); privilege2.setCreateTime(System.currentTimeMillis()); assertEquals(seqId + 4, sentryStore.alterSentryRoleGrantPrivilege(grantor, roleName2, privilege2) .getSequenceId()); Set<TSentryGroup> groups = Sets.newHashSet(); TSentryGroup group = new TSentryGroup(); group.setGroupName(groupName1); groups.add(group); assertEquals(seqId + 5, sentryStore.alterSentryRoleAddGroups(grantor, roleName1, groups).getSequenceId()); groups.clear(); group = new TSentryGroup(); group.setGroupName(groupName2); groups.add(group); assertEquals(seqId + 6, sentryStore.alterSentryRoleAddGroups(grantor, roleName1, groups).getSequenceId()); assertEquals(seqId + 7, sentryStore.alterSentryRoleAddGroups(grantor, roleName2, groups).getSequenceId()); assertEquals(Sets.newHashSet("server=server1->db=db1->table=tbl1->action=select"), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets.newHashSet(groupName1), new TSentryActiveRoleSet(true, new HashSet<String>())))); assertEquals(Sets.newHashSet("server=server1->db=db1->table=tbl1->action=select"), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets.newHashSet(groupName1), new TSentryActiveRoleSet(false, Sets.newHashSet(roleName1))))); assertEquals(Sets.newHashSet(), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets.newHashSet(groupName1), new TSentryActiveRoleSet(false, Sets.newHashSet("not a role"))))); assertEquals(Sets.newHashSet(), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets.newHashSet(groupName1), new TSentryActiveRoleSet(false, new HashSet<String>())))); assertEquals(Sets.newHashSet("server=server1->db=db1->table=tbl1->action=select", "server=server1"), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets.newHashSet(groupName2), new TSentryActiveRoleSet(true, new HashSet<String>())))); assertEquals(Sets.newHashSet("server=server1->db=db1->table=tbl1->action=select"), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets.newHashSet(groupName2), new TSentryActiveRoleSet(false, Sets.newHashSet(roleName1))))); assertEquals(Sets.newHashSet( "server=server1->db=db1->table=tbl1->action=select", "server=server1"), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets.newHashSet(groupName2), new TSentryActiveRoleSet(false, Sets.newHashSet(roleName2))))); assertEquals(Sets.newHashSet(), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets.newHashSet(groupName2), new TSentryActiveRoleSet(false, Sets.newHashSet("not a role"))))); assertEquals(Sets.newHashSet(), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets.newHashSet(groupName2), new TSentryActiveRoleSet(false, new HashSet<String>())))); assertEquals(Sets.newHashSet("server=server1->db=db1->table=tbl1->action=select", "server=server1"), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets. newHashSet(groupName1, groupName2), new TSentryActiveRoleSet(true, new HashSet<String>())))); assertEquals(Sets.newHashSet("server=server1->db=db1->table=tbl1->action=select"), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets. newHashSet(groupName1, groupName2), new TSentryActiveRoleSet(false, Sets.newHashSet(roleName1))))); assertEquals(Sets.newHashSet( "server=server1->db=db1->table=tbl1->action=select", "server=server1"), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets. newHashSet(groupName1, groupName2), new TSentryActiveRoleSet(false, Sets.newHashSet(roleName2))))); assertEquals(Sets.newHashSet(), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets. newHashSet(groupName1, groupName2), new TSentryActiveRoleSet(false, Sets.newHashSet("not a role"))))); assertEquals(Sets.newHashSet(), SentryStore.toTrimedLower(sentryStore.listAllSentryPrivilegesForProvider(Sets. newHashSet(groupName1, groupName2), new TSentryActiveRoleSet(false, new HashSet<String>())))); }