io.prestosql.security

Class DenyAllAccessControl

java.lang.Object

io.prestosql.security.DenyAllAccessControl

All Implemented Interfaces:

AccessControl

Direct Known Subclasses:

ViewAccessControl

public class DenyAllAccessControl
extends Object
implements AccessControl

Constructor Summary

Constructors

Constructor and Description
DenyAllAccessControl()

Method Summary

Modifier and Type	Method and Description
void	checkCanAccessCatalog(Identity identity, String catalogName) Check whether identity is allowed to access catalog
void	checkCanAddColumns(TransactionId transactionId, Identity identity, QualifiedObjectName tableName) Check if identity is allowed to add columns to the specified table.
void	checkCanCreateRole(TransactionId transactionId, Identity identity, String role, Optional<PrestoPrincipal> grantor, String catalogName) Check if identity is allowed to create the specified role.
void	checkCanCreateSchema(TransactionId transactionId, Identity identity, CatalogSchemaName schemaName) Check if identity is allowed to create the specified schema.
void	checkCanCreateTable(TransactionId transactionId, Identity identity, QualifiedObjectName tableName) Check if identity is allowed to create the specified table.
void	checkCanCreateView(TransactionId transactionId, Identity identity, QualifiedObjectName viewName) Check if identity is allowed to create the specified view.
void	checkCanCreateViewWithSelectFromColumns(TransactionId transactionId, Identity identity, QualifiedObjectName tableName, Set<String> columnNames) Check if identity is allowed to create a view that selects from the specified columns.
void	checkCanDeleteFromTable(TransactionId transactionId, Identity identity, QualifiedObjectName tableName) Check if identity is allowed to delete from the specified table.
void	checkCanDropColumn(TransactionId transactionId, Identity identity, QualifiedObjectName tableName) Check if identity is allowed to drop columns from the specified table.
void	checkCanDropRole(TransactionId transactionId, Identity identity, String role, String catalogName) Check if identity is allowed to drop the specified role.
void	checkCanDropSchema(TransactionId transactionId, Identity identity, CatalogSchemaName schemaName) Check if identity is allowed to drop the specified schema.
void	checkCanDropTable(TransactionId transactionId, Identity identity, QualifiedObjectName tableName) Check if identity is allowed to drop the specified table.
void	checkCanDropView(TransactionId transactionId, Identity identity, QualifiedObjectName viewName) Check if identity is allowed to drop the specified view.
void	checkCanGrantRoles(TransactionId transactionId, Identity identity, Set<String> roles, Set<PrestoPrincipal> grantees, boolean withAdminOption, Optional<PrestoPrincipal> grantor, String catalogName) Check if identity is allowed to grant the specified roles to the specified principals.
void	checkCanGrantTablePrivilege(TransactionId transactionId, Identity identity, Privilege privilege, QualifiedObjectName tableName, PrestoPrincipal grantee, boolean withGrantOption) Check if identity is allowed to grant a privilege to the grantee on the specified table.
void	checkCanInsertIntoTable(TransactionId transactionId, Identity identity, QualifiedObjectName tableName) Check if identity is allowed to insert into the specified table.
void	checkCanRenameColumn(TransactionId transactionId, Identity identity, QualifiedObjectName tableName) Check if identity is allowed to rename a column in the specified table.
void	checkCanRenameSchema(TransactionId transactionId, Identity identity, CatalogSchemaName schemaName, String newSchemaName) Check if identity is allowed to rename the specified schema.
void	checkCanRenameTable(TransactionId transactionId, Identity identity, QualifiedObjectName tableName, QualifiedObjectName newTableName) Check if identity is allowed to rename the specified table.
void	checkCanRevokeRoles(TransactionId transactionId, Identity identity, Set<String> roles, Set<PrestoPrincipal> grantees, boolean adminOptionFor, Optional<PrestoPrincipal> grantor, String catalogName) Check if identity is allowed to revoke the specified roles from the specified principals.
void	checkCanRevokeTablePrivilege(TransactionId transactionId, Identity identity, Privilege privilege, QualifiedObjectName tableName, PrestoPrincipal revokee, boolean grantOptionFor) Check if identity is allowed to revoke a privilege from the revokee on the specified table.
void	checkCanSelectFromColumns(TransactionId transactionId, Identity identity, QualifiedObjectName tableName, Set<String> columnNames) Check if identity is allowed to select from the specified columns.
void	checkCanSetCatalogSessionProperty(TransactionId transactionId, Identity identity, String catalogName, String propertyName) Check if identity is allowed to set the specified catalog property.
void	checkCanSetRole(TransactionId requiredTransactionId, Identity identity, String role, String catalog) Check if identity is allowed to set role for specified catalog.
void	checkCanSetSystemSessionProperty(Identity identity, String propertyName) Check if identity is allowed to set the specified system property.
void	checkCanSetTableComment(TransactionId transactionId, Identity identity, QualifiedObjectName tableName) Check if identity is allowed to comment the specified table.
void	checkCanSetUser(Optional<Principal> principal, String userName) Check if the principal is allowed to be the specified user.
void	checkCanShowColumnsMetadata(TransactionId transactionId, Identity identity, CatalogSchemaTableName table) Check if identity is allowed to show columns of tables by executing SHOW COLUMNS, DESCRIBE etc.
void	checkCanShowCurrentRoles(TransactionId transactionId, Identity identity, String catalogName) Check if identity is allowed to show current roles on the specified catalog.
void	checkCanShowRoleGrants(TransactionId transactionId, Identity identity, String catalogName) Check if identity is allowed to show its own role grants on the specified catalog.
void	checkCanShowRoles(TransactionId transactionId, Identity identity, String catalogName) Check if identity is allowed to show roles on the specified catalog.
void	checkCanShowSchemas(TransactionId transactionId, Identity identity, String catalogName) Check if identity is allowed to execute SHOW SCHEMAS in a catalog.
void	checkCanShowTablesMetadata(TransactionId transactionId, Identity identity, CatalogSchemaName schema) Check if identity is allowed to show metadata of tables by executing SHOW TABLES, SHOW GRANTS etc.
Set<String>	filterCatalogs(Identity identity, Set<String> catalogs) Filter the list of catalogs to those visible to the identity.
List<ColumnMetadata>	filterColumns(TransactionId transactionId, Identity identity, CatalogSchemaTableName tableName, List<ColumnMetadata> columns) Filter the list of columns to those visible to the identity.
Set<String>	filterSchemas(TransactionId transactionId, Identity identity, String catalogName, Set<String> schemaNames) Filter the list of schemas in a catalog to those visible to the identity.
Set<SchemaTableName>	filterTables(TransactionId transactionId, Identity identity, String catalogName, Set<SchemaTableName> tableNames) Filter the list of tables and views to those visible to the identity.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DenyAllAccessControl

public DenyAllAccessControl()

Method Detail

checkCanSetUser

public void checkCanSetUser(Optional<Principal> principal,
                            String userName)

Description copied from interface: AccessControl

Check if the principal is allowed to be the specified user.

Specified by:

checkCanSetUser in interface AccessControl

filterCatalogs

public Set<String> filterCatalogs(Identity identity,
                                  Set<String> catalogs)

Description copied from interface: AccessControl

Filter the list of catalogs to those visible to the identity.

Specified by:

filterCatalogs in interface AccessControl

checkCanAccessCatalog

public void checkCanAccessCatalog(Identity identity,
                                  String catalogName)

Description copied from interface: AccessControl

Check whether identity is allowed to access catalog

Specified by:

checkCanAccessCatalog in interface AccessControl

checkCanCreateSchema

public void checkCanCreateSchema(TransactionId transactionId,
                                 Identity identity,
                                 CatalogSchemaName schemaName)

Description copied from interface: AccessControl

Check if identity is allowed to create the specified schema.

Specified by:

checkCanCreateSchema in interface AccessControl

checkCanDropSchema

public void checkCanDropSchema(TransactionId transactionId,
                               Identity identity,
                               CatalogSchemaName schemaName)

Description copied from interface: AccessControl

Check if identity is allowed to drop the specified schema.

Specified by:

checkCanDropSchema in interface AccessControl

checkCanRenameSchema

public void checkCanRenameSchema(TransactionId transactionId,
                                 Identity identity,
                                 CatalogSchemaName schemaName,
                                 String newSchemaName)

Description copied from interface: AccessControl

Check if identity is allowed to rename the specified schema.

Specified by:

checkCanRenameSchema in interface AccessControl

checkCanCreateTable

public void checkCanCreateTable(TransactionId transactionId,
                                Identity identity,
                                QualifiedObjectName tableName)

Description copied from interface: AccessControl

Check if identity is allowed to create the specified table.

Specified by:

checkCanCreateTable in interface AccessControl

checkCanDropTable

public void checkCanDropTable(TransactionId transactionId,
                              Identity identity,
                              QualifiedObjectName tableName)

Description copied from interface: AccessControl

Check if identity is allowed to drop the specified table.

Specified by:

checkCanDropTable in interface AccessControl

checkCanRenameTable

public void checkCanRenameTable(TransactionId transactionId,
                                Identity identity,
                                QualifiedObjectName tableName,
                                QualifiedObjectName newTableName)

Description copied from interface: AccessControl

Check if identity is allowed to rename the specified table.

Specified by:

checkCanRenameTable in interface AccessControl

checkCanSetTableComment

public void checkCanSetTableComment(TransactionId transactionId,
                                    Identity identity,
                                    QualifiedObjectName tableName)

Description copied from interface: AccessControl

Check if identity is allowed to comment the specified table.

Specified by:

checkCanSetTableComment in interface AccessControl

checkCanShowTablesMetadata

public void checkCanShowTablesMetadata(TransactionId transactionId,
                                       Identity identity,
                                       CatalogSchemaName schema)

Description copied from interface: AccessControl

Check if identity is allowed to show metadata of tables by executing SHOW TABLES, SHOW GRANTS etc. in a catalog.

NOTE: This method is only present to give users an error message when listing is not allowed. The AccessControl.filterTables(io.prestosql.transaction.TransactionId, io.prestosql.spi.security.Identity, java.lang.String, java.util.Set<io.prestosql.spi.connector.SchemaTableName>) method must filter all results for unauthorized users, since there are multiple ways to list tables.

Specified by:

checkCanShowTablesMetadata in interface AccessControl

filterTables

public Set<SchemaTableName> filterTables(TransactionId transactionId,
                                         Identity identity,
                                         String catalogName,
                                         Set<SchemaTableName> tableNames)

Description copied from interface: AccessControl

Filter the list of tables and views to those visible to the identity.

Specified by:

filterTables in interface AccessControl

checkCanShowColumnsMetadata

public void checkCanShowColumnsMetadata(TransactionId transactionId,
                                        Identity identity,
                                        CatalogSchemaTableName table)

Description copied from interface: AccessControl

Check if identity is allowed to show columns of tables by executing SHOW COLUMNS, DESCRIBE etc.

NOTE: This method is only present to give users an error message when listing is not allowed. The AccessControl.filterColumns(io.prestosql.transaction.TransactionId, io.prestosql.spi.security.Identity, io.prestosql.spi.connector.CatalogSchemaTableName, java.util.List<io.prestosql.spi.connector.ColumnMetadata>) method must filter all results for unauthorized users, since there are multiple ways to list columns.

Specified by:

checkCanShowColumnsMetadata in interface AccessControl

filterColumns

public List<ColumnMetadata> filterColumns(TransactionId transactionId,
                                          Identity identity,
                                          CatalogSchemaTableName tableName,
                                          List<ColumnMetadata> columns)

Description copied from interface: AccessControl

Filter the list of columns to those visible to the identity.

Specified by:

filterColumns in interface AccessControl

checkCanShowSchemas

public void checkCanShowSchemas(TransactionId transactionId,
                                Identity identity,
                                String catalogName)

Description copied from interface: AccessControl

Check if identity is allowed to execute SHOW SCHEMAS in a catalog.

NOTE: This method is only present to give users an error message when listing is not allowed. The AccessControl.filterSchemas(io.prestosql.transaction.TransactionId, io.prestosql.spi.security.Identity, java.lang.String, java.util.Set<java.lang.String>) method must filter all results for unauthorized users, since there are multiple ways to list schemas.

Specified by:

checkCanShowSchemas in interface AccessControl

filterSchemas

public Set<String> filterSchemas(TransactionId transactionId,
                                 Identity identity,
                                 String catalogName,
                                 Set<String> schemaNames)

Description copied from interface: AccessControl

Filter the list of schemas in a catalog to those visible to the identity.

Specified by:

filterSchemas in interface AccessControl

checkCanAddColumns

public void checkCanAddColumns(TransactionId transactionId,
                               Identity identity,
                               QualifiedObjectName tableName)

Description copied from interface: AccessControl

Check if identity is allowed to add columns to the specified table.

Specified by:

checkCanAddColumns in interface AccessControl

checkCanRenameColumn

public void checkCanRenameColumn(TransactionId transactionId,
                                 Identity identity,
                                 QualifiedObjectName tableName)

Description copied from interface: AccessControl

Check if identity is allowed to rename a column in the specified table.

Specified by:

checkCanRenameColumn in interface AccessControl

checkCanDropColumn

public void checkCanDropColumn(TransactionId transactionId,
                               Identity identity,
                               QualifiedObjectName tableName)

Description copied from interface: AccessControl

Check if identity is allowed to drop columns from the specified table.

Specified by:

checkCanDropColumn in interface AccessControl

checkCanInsertIntoTable

public void checkCanInsertIntoTable(TransactionId transactionId,
                                    Identity identity,
                                    QualifiedObjectName tableName)

Description copied from interface: AccessControl

Check if identity is allowed to insert into the specified table.

Specified by:

checkCanInsertIntoTable in interface AccessControl

checkCanDeleteFromTable

public void checkCanDeleteFromTable(TransactionId transactionId,
                                    Identity identity,
                                    QualifiedObjectName tableName)

Description copied from interface: AccessControl

Check if identity is allowed to delete from the specified table.

Specified by:

checkCanDeleteFromTable in interface AccessControl

checkCanCreateView

public void checkCanCreateView(TransactionId transactionId,
                               Identity identity,
                               QualifiedObjectName viewName)

Description copied from interface: AccessControl

Check if identity is allowed to create the specified view.

Specified by:

checkCanCreateView in interface AccessControl

checkCanDropView

public void checkCanDropView(TransactionId transactionId,
                             Identity identity,
                             QualifiedObjectName viewName)

Description copied from interface: AccessControl

Check if identity is allowed to drop the specified view.

Specified by:

checkCanDropView in interface AccessControl

checkCanCreateViewWithSelectFromColumns

public void checkCanCreateViewWithSelectFromColumns(TransactionId transactionId,
                                                    Identity identity,
                                                    QualifiedObjectName tableName,
                                                    Set<String> columnNames)

Description copied from interface: AccessControl

Check if identity is allowed to create a view that selects from the specified columns.

Specified by:

checkCanCreateViewWithSelectFromColumns in interface AccessControl

checkCanGrantTablePrivilege

public void checkCanGrantTablePrivilege(TransactionId transactionId,
                                        Identity identity,
                                        Privilege privilege,
                                        QualifiedObjectName tableName,
                                        PrestoPrincipal grantee,
                                        boolean withGrantOption)

Description copied from interface: AccessControl

Check if identity is allowed to grant a privilege to the grantee on the specified table.

Specified by:

checkCanGrantTablePrivilege in interface AccessControl

checkCanRevokeTablePrivilege

public void checkCanRevokeTablePrivilege(TransactionId transactionId,
                                         Identity identity,
                                         Privilege privilege,
                                         QualifiedObjectName tableName,
                                         PrestoPrincipal revokee,
                                         boolean grantOptionFor)

Description copied from interface: AccessControl

Check if identity is allowed to revoke a privilege from the revokee on the specified table.

Specified by:

checkCanRevokeTablePrivilege in interface AccessControl

checkCanSetSystemSessionProperty

public void checkCanSetSystemSessionProperty(Identity identity,
                                             String propertyName)

Description copied from interface: AccessControl

Check if identity is allowed to set the specified system property.

Specified by:

checkCanSetSystemSessionProperty in interface AccessControl

checkCanSetCatalogSessionProperty

public void checkCanSetCatalogSessionProperty(TransactionId transactionId,
                                              Identity identity,
                                              String catalogName,
                                              String propertyName)

Description copied from interface: AccessControl

Check if identity is allowed to set the specified catalog property.

Specified by:

checkCanSetCatalogSessionProperty in interface AccessControl

checkCanSelectFromColumns

public void checkCanSelectFromColumns(TransactionId transactionId,
                                      Identity identity,
                                      QualifiedObjectName tableName,
                                      Set<String> columnNames)

Description copied from interface: AccessControl

Check if identity is allowed to select from the specified columns. The column set can be empty.

Specified by:

checkCanSelectFromColumns in interface AccessControl

checkCanCreateRole

public void checkCanCreateRole(TransactionId transactionId,
                               Identity identity,
                               String role,
                               Optional<PrestoPrincipal> grantor,
                               String catalogName)

Description copied from interface: AccessControl

Check if identity is allowed to create the specified role.

Specified by:

checkCanCreateRole in interface AccessControl

checkCanDropRole

public void checkCanDropRole(TransactionId transactionId,
                             Identity identity,
                             String role,
                             String catalogName)

Description copied from interface: AccessControl

Check if identity is allowed to drop the specified role.

Specified by:

checkCanDropRole in interface AccessControl

checkCanGrantRoles

public void checkCanGrantRoles(TransactionId transactionId,
                               Identity identity,
                               Set<String> roles,
                               Set<PrestoPrincipal> grantees,
                               boolean withAdminOption,
                               Optional<PrestoPrincipal> grantor,
                               String catalogName)

Description copied from interface: AccessControl

Check if identity is allowed to grant the specified roles to the specified principals.

Specified by:

checkCanGrantRoles in interface AccessControl

checkCanRevokeRoles

public void checkCanRevokeRoles(TransactionId transactionId,
                                Identity identity,
                                Set<String> roles,
                                Set<PrestoPrincipal> grantees,
                                boolean adminOptionFor,
                                Optional<PrestoPrincipal> grantor,
                                String catalogName)

Description copied from interface: AccessControl

Check if identity is allowed to revoke the specified roles from the specified principals.

Specified by:

checkCanRevokeRoles in interface AccessControl

checkCanSetRole

public void checkCanSetRole(TransactionId requiredTransactionId,
                            Identity identity,
                            String role,
                            String catalog)

Description copied from interface: AccessControl

Check if identity is allowed to set role for specified catalog.

Specified by:

checkCanSetRole in interface AccessControl

checkCanShowRoles

public void checkCanShowRoles(TransactionId transactionId,
                              Identity identity,
                              String catalogName)

Description copied from interface: AccessControl

Check if identity is allowed to show roles on the specified catalog.

Specified by:

checkCanShowRoles in interface AccessControl

checkCanShowCurrentRoles

public void checkCanShowCurrentRoles(TransactionId transactionId,
                                     Identity identity,
                                     String catalogName)

Description copied from interface: AccessControl

Check if identity is allowed to show current roles on the specified catalog.

Specified by:

checkCanShowCurrentRoles in interface AccessControl

checkCanShowRoleGrants

public void checkCanShowRoleGrants(TransactionId transactionId,
                                   Identity identity,
                                   String catalogName)

Description copied from interface: AccessControl

Check if identity is allowed to show its own role grants on the specified catalog.

Specified by:

checkCanShowRoleGrants in interface AccessControl