Interface ConnectorAccessControl

public interface ConnectorAccessControl

Method Summary

Modifier and Type	Method	Description
default boolean	canCreateViewWithExecuteFunction(ConnectorSecurityContext context, SchemaRoutineName function)	Is identity allowed to create a view that executes the specified function?
default boolean	canExecuteFunction(ConnectorSecurityContext context, SchemaRoutineName function)	Is the identity allowed to execute the specified function?
default void	checkCanAddColumn(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to add columns to the specified table.
default void	checkCanAlterColumn(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to alter columns for the specified table.
default void	checkCanCreateFunction(ConnectorSecurityContext context, SchemaRoutineName function)	Check if identity is allowed to create the specified function.
default void	checkCanCreateMaterializedView(ConnectorSecurityContext context, SchemaTableName materializedViewName, Map<String,Object> properties)	Check if identity is allowed to create the specified materialized view.
default void	checkCanCreateRole(ConnectorSecurityContext context, String role, Optional<TrinoPrincipal> grantor)
default void	checkCanCreateSchema(ConnectorSecurityContext context, String schemaName, Map<String,Object> properties)	Check if identity is allowed to create the specified schema with properties.
default void	checkCanCreateTable(ConnectorSecurityContext context, SchemaTableName tableName, Map<String,Object> properties)	Check if identity is allowed to create the specified table with properties.
default void	checkCanCreateView(ConnectorSecurityContext context, SchemaTableName viewName)	Check if identity is allowed to create the specified view.
default void	checkCanCreateViewWithSelectFromColumns(ConnectorSecurityContext context, SchemaTableName tableName, Set<String> columnNames)	Check if identity is allowed to create a view that selects from the specified columns in a relation.
default void	checkCanDeleteFromTable(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to delete from the specified table.
default void	checkCanDenySchemaPrivilege(ConnectorSecurityContext context, Privilege privilege, String schemaName, TrinoPrincipal grantee)	Check if identity is allowed to deny to any other user the specified privilege on the specified schema.
default void	checkCanDenyTablePrivilege(ConnectorSecurityContext context, Privilege privilege, SchemaTableName tableName, TrinoPrincipal grantee)	Check if identity is allowed to deny to any other user the specified privilege on the specified table.
default void	checkCanDropColumn(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to drop columns from the specified table.
default void	checkCanDropFunction(ConnectorSecurityContext context, SchemaRoutineName function)	Check if identity is allowed to drop the specified function.
default void	checkCanDropMaterializedView(ConnectorSecurityContext context, SchemaTableName materializedViewName)	Check if identity is allowed to drop the specified materialized view.
default void	checkCanDropRole(ConnectorSecurityContext context, String role)
default void	checkCanDropSchema(ConnectorSecurityContext context, String schemaName)	Check if identity is allowed to drop the specified schema.
default void	checkCanDropTable(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to drop the specified table.
default void	checkCanDropView(ConnectorSecurityContext context, SchemaTableName viewName)	Check if identity is allowed to drop the specified view.
default void	checkCanExecuteProcedure(ConnectorSecurityContext context, SchemaRoutineName procedure)
default void	checkCanExecuteTableProcedure(ConnectorSecurityContext context, SchemaTableName tableName, String procedure)
default void	checkCanGrantRoles(ConnectorSecurityContext context, Set<String> roles, Set<TrinoPrincipal> grantees, boolean adminOption, Optional<TrinoPrincipal> grantor)
default void	checkCanGrantSchemaPrivilege(ConnectorSecurityContext context, Privilege privilege, String schemaName, TrinoPrincipal grantee, boolean grantOption)	Check if identity is allowed to grant to any other user the specified privilege on the specified schema.
default void	checkCanGrantTablePrivilege(ConnectorSecurityContext context, Privilege privilege, SchemaTableName tableName, TrinoPrincipal grantee, boolean grantOption)	Check if identity is allowed to grant to any other user the specified privilege on the specified table.
default void	checkCanInsertIntoTable(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to insert into the specified table.
default void	checkCanRefreshMaterializedView(ConnectorSecurityContext context, SchemaTableName materializedViewName)	Check if identity is allowed to refresh the specified materialized view.
default void	checkCanRenameColumn(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to rename a column in the specified table.
default void	checkCanRenameMaterializedView(ConnectorSecurityContext context, SchemaTableName viewName, SchemaTableName newViewName)	Check if identity is allowed to rename the specified materialized view.
default void	checkCanRenameSchema(ConnectorSecurityContext context, String schemaName, String newSchemaName)	Check if identity is allowed to rename the specified schema.
default void	checkCanRenameTable(ConnectorSecurityContext context, SchemaTableName tableName, SchemaTableName newTableName)	Check if identity is allowed to rename the specified table.
default void	checkCanRenameView(ConnectorSecurityContext context, SchemaTableName viewName, SchemaTableName newViewName)	Check if identity is allowed to rename the specified view.
default void	checkCanRevokeRoles(ConnectorSecurityContext context, Set<String> roles, Set<TrinoPrincipal> grantees, boolean adminOption, Optional<TrinoPrincipal> grantor)
default void	checkCanRevokeSchemaPrivilege(ConnectorSecurityContext context, Privilege privilege, String schemaName, TrinoPrincipal revokee, boolean grantOption)
default void	checkCanRevokeTablePrivilege(ConnectorSecurityContext context, Privilege privilege, SchemaTableName tableName, TrinoPrincipal revokee, boolean grantOption)	Check if identity is allowed to revoke the specified privilege on the specified table from any user.
default void	checkCanSelectFromColumns(ConnectorSecurityContext context, SchemaTableName tableName, Set<String> columnNames)	Check if identity is allowed to select from the specified columns in a relation.
default void	checkCanSetCatalogSessionProperty(ConnectorSecurityContext context, String propertyName)	Check if identity is allowed to set the specified property.
default void	checkCanSetColumnComment(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to comment the column in the specified table.
default void	checkCanSetMaterializedViewProperties(ConnectorSecurityContext context, SchemaTableName materializedViewName, Map<String,Optional<Object>> properties)	Check if identity is allowed to set the properties of the specified materialized view.
default void	checkCanSetRole(ConnectorSecurityContext context, String role)
default void	checkCanSetSchemaAuthorization(ConnectorSecurityContext context, String schemaName, TrinoPrincipal principal)	Check if identity is allowed to change the specified schema's user/role.
default void	checkCanSetTableAuthorization(ConnectorSecurityContext context, SchemaTableName tableName, TrinoPrincipal principal)	Check if identity is allowed to change the specified table's user/role.
default void	checkCanSetTableComment(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to comment the specified table.
default void	checkCanSetTableProperties(ConnectorSecurityContext context, SchemaTableName tableName, Map<String,Optional<Object>> properties)	Check if identity is allowed to set properties to the specified table.
default void	checkCanSetViewAuthorization(ConnectorSecurityContext context, SchemaTableName viewName, TrinoPrincipal principal)	Check if identity is allowed to change the specified view's user/role.
default void	checkCanSetViewComment(ConnectorSecurityContext context, SchemaTableName viewName)	Check if identity is allowed to comment the specified view.
default void	checkCanShowColumns(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to show columns of tables by executing SHOW COLUMNS, DESCRIBE etc.
default void	checkCanShowCreateFunction(ConnectorSecurityContext context, SchemaRoutineName function)	Check if identity is allowed to execute SHOW CREATE FUNCTION.
default void	checkCanShowCreateSchema(ConnectorSecurityContext context, String schemaName)	Check if identity is allowed to execute SHOW CREATE SCHEMA.
default void	checkCanShowCreateTable(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to execute SHOW CREATE TABLE, SHOW CREATE VIEW or SHOW CREATE MATERIALIZED VIEW
default void	checkCanShowCurrentRoles(ConnectorSecurityContext context)	Check if identity is allowed to show current roles.
default void	checkCanShowFunctions(ConnectorSecurityContext context, String schemaName)	Check if identity is allowed to show functions by executing SHOW FUNCTIONS.
default void	checkCanShowRoleGrants(ConnectorSecurityContext context)	Check if identity is allowed to show its own role grants.
default void	checkCanShowRoles(ConnectorSecurityContext context)	Check if identity is allowed to show roles.
default void	checkCanShowSchemas(ConnectorSecurityContext context)	Check if identity is allowed to execute SHOW SCHEMAS.
default void	checkCanShowTables(ConnectorSecurityContext context, String schemaName)	Check if identity is allowed to show metadata of tables by executing SHOW TABLES, SHOW GRANTS etc..
default void	checkCanTruncateTable(ConnectorSecurityContext context, SchemaTableName tableName)	Check if identity is allowed to truncate the specified table in this catalog.
default void	checkCanUpdateTableColumns(ConnectorSecurityContext context, SchemaTableName tableName, Set<String> updatedColumns)	Check if identity is allowed to update the supplied columns in the specified table in this catalog.
default Map<SchemaTableName,Set<String>>	filterColumns(ConnectorSecurityContext context, Map<SchemaTableName,Set<String>> tableColumns)	Filter lists of columns of multiple tables to those visible to the identity.
default Set<SchemaFunctionName>	filterFunctions(ConnectorSecurityContext context, Set<SchemaFunctionName> functionNames)	Filter the list of functions to those visible to the identity.
default Set<String>	filterSchemas(ConnectorSecurityContext context, Set<String> schemaNames)	Filter the list of schemas to those visible to the identity.
default Set<SchemaTableName>	filterTables(ConnectorSecurityContext context, Set<SchemaTableName> tableNames)	Filter the list of tables and views to those visible to the identity.
default Optional<ViewExpression>	getColumnMask(ConnectorSecurityContext context, SchemaTableName tableName, String columnName, Type type)	Deprecated. use getColumnMasks(ConnectorSecurityContext, SchemaTableName, List)
default Map<ColumnSchema,ViewExpression>	getColumnMasks(ConnectorSecurityContext context, SchemaTableName tableName, List<ColumnSchema> columns)	Bulk method for getting column masks for a subset of columns in a table.
default List<ViewExpression>	getRowFilters(ConnectorSecurityContext context, SchemaTableName tableName)	Get row filters associated with the given table and identity.

Method Details

checkCanCreateSchema

default void checkCanCreateSchema(ConnectorSecurityContext context,
 String schemaName,
 Map<String,Object> properties)

Check if identity is allowed to create the specified schema with properties.

Throws:

AccessDeniedException - if not allowed

checkCanDropSchema

default void checkCanDropSchema(ConnectorSecurityContext context,
 String schemaName)

Check if identity is allowed to drop the specified schema.

Throws:

AccessDeniedException - if not allowed

checkCanRenameSchema

default void checkCanRenameSchema(ConnectorSecurityContext context,
 String schemaName,
 String newSchemaName)

Check if identity is allowed to rename the specified schema.

Throws:

AccessDeniedException - if not allowed

checkCanSetSchemaAuthorization

default void checkCanSetSchemaAuthorization(ConnectorSecurityContext context,
 String schemaName,
 TrinoPrincipal principal)

Check if identity is allowed to change the specified schema's user/role.

Throws:

AccessDeniedException - if not allowed

checkCanShowSchemas

default void checkCanShowSchemas(ConnectorSecurityContext context)

Check if identity is allowed to execute SHOW SCHEMAS.

NOTE: This method is only present to give users an error message when listing is not allowed. The filterSchemas(io.trino.spi.connector.ConnectorSecurityContext, java.util.Set<java.lang.String>) method must handle filter all results for unauthorized users, since there are multiple way to list schemas.

Throws:

AccessDeniedException - if not allowed

filterSchemas

default Set<String> filterSchemas(ConnectorSecurityContext context,
 Set<String> schemaNames)

Filter the list of schemas to those visible to the identity.

checkCanShowCreateSchema

default void checkCanShowCreateSchema(ConnectorSecurityContext context,
 String schemaName)

Check if identity is allowed to execute SHOW CREATE SCHEMA.

Throws:

AccessDeniedException - if not allowed

checkCanShowCreateTable

default void checkCanShowCreateTable(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to execute SHOW CREATE TABLE, SHOW CREATE VIEW or SHOW CREATE MATERIALIZED VIEW

Throws:

AccessDeniedException - if not allowed

checkCanCreateTable

default void checkCanCreateTable(ConnectorSecurityContext context,
 SchemaTableName tableName,
 Map<String,Object> properties)

Check if identity is allowed to create the specified table with properties.

Throws:

AccessDeniedException - if not allowed

checkCanDropTable

default void checkCanDropTable(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to drop the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanRenameTable

default void checkCanRenameTable(ConnectorSecurityContext context,
 SchemaTableName tableName,
 SchemaTableName newTableName)

Check if identity is allowed to rename the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanSetTableProperties

default void checkCanSetTableProperties(ConnectorSecurityContext context,
 SchemaTableName tableName,
 Map<String,Optional<Object>> properties)

Check if identity is allowed to set properties to the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanSetTableComment

default void checkCanSetTableComment(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to comment the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanSetViewComment

default void checkCanSetViewComment(ConnectorSecurityContext context,
 SchemaTableName viewName)

Check if identity is allowed to comment the specified view.

Throws:

AccessDeniedException - if not allowed

checkCanSetColumnComment

default void checkCanSetColumnComment(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to comment the column in the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanShowTables

default void checkCanShowTables(ConnectorSecurityContext context,
 String schemaName)

Check if identity is allowed to show metadata of tables by executing SHOW TABLES, SHOW GRANTS etc..

NOTE: This method is only present to give users an error message when listing is not allowed. The filterTables(io.trino.spi.connector.ConnectorSecurityContext, java.util.Set<io.trino.spi.connector.SchemaTableName>) method must filter all results for unauthorized users, since there are multiple ways to list tables.

Throws:

AccessDeniedException - if not allowed

filterTables

default Set<SchemaTableName> filterTables(ConnectorSecurityContext context,
 Set<SchemaTableName> tableNames)

Filter the list of tables and views to those visible to the identity.

checkCanShowColumns

default void checkCanShowColumns(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to show columns of tables by executing SHOW COLUMNS, DESCRIBE etc.

NOTE: This method is only present to give users an error message when listing is not allowed. The filterColumns(io.trino.spi.connector.ConnectorSecurityContext, java.util.Map<io.trino.spi.connector.SchemaTableName, java.util.Set<java.lang.String>>) method must filter all results for unauthorized users, since there are multiple ways to list columns.

Throws:

AccessDeniedException - if not allowed

filterColumns

default Map<SchemaTableName,Set<String>> filterColumns(ConnectorSecurityContext context,
 Map<SchemaTableName,Set<String>> tableColumns)

Filter lists of columns of multiple tables to those visible to the identity.

checkCanAddColumn

default void checkCanAddColumn(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to add columns to the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanAlterColumn

default void checkCanAlterColumn(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to alter columns for the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanDropColumn

default void checkCanDropColumn(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to drop columns from the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanSetTableAuthorization

default void checkCanSetTableAuthorization(ConnectorSecurityContext context,
 SchemaTableName tableName,
 TrinoPrincipal principal)

Check if identity is allowed to change the specified table's user/role.

Throws:

AccessDeniedException - if not allowed

checkCanRenameColumn

default void checkCanRenameColumn(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to rename a column in the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanSelectFromColumns

default void checkCanSelectFromColumns(ConnectorSecurityContext context,
 SchemaTableName tableName,
 Set<String> columnNames)

Check if identity is allowed to select from the specified columns in a relation. The column set can be empty.

Throws:

AccessDeniedException - if not allowed

checkCanInsertIntoTable

default void checkCanInsertIntoTable(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to insert into the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanDeleteFromTable

default void checkCanDeleteFromTable(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to delete from the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanTruncateTable

default void checkCanTruncateTable(ConnectorSecurityContext context,
 SchemaTableName tableName)

Check if identity is allowed to truncate the specified table in this catalog.

Throws:

AccessDeniedException - if not allowed

checkCanUpdateTableColumns

default void checkCanUpdateTableColumns(ConnectorSecurityContext context,
 SchemaTableName tableName,
 Set<String> updatedColumns)

Check if identity is allowed to update the supplied columns in the specified table in this catalog.

Throws:

AccessDeniedException - if not allowed

checkCanCreateView

default void checkCanCreateView(ConnectorSecurityContext context,
 SchemaTableName viewName)

Check if identity is allowed to create the specified view.

Throws:

AccessDeniedException - if not allowed

checkCanRenameView

default void checkCanRenameView(ConnectorSecurityContext context,
 SchemaTableName viewName,
 SchemaTableName newViewName)

Check if identity is allowed to rename the specified view.

Throws:

AccessDeniedException - if not allowed

checkCanSetViewAuthorization

default void checkCanSetViewAuthorization(ConnectorSecurityContext context,
 SchemaTableName viewName,
 TrinoPrincipal principal)

Check if identity is allowed to change the specified view's user/role.

Throws:

AccessDeniedException - if not allowed

checkCanDropView

default void checkCanDropView(ConnectorSecurityContext context,
 SchemaTableName viewName)

Check if identity is allowed to drop the specified view.

Throws:

AccessDeniedException - if not allowed

checkCanCreateViewWithSelectFromColumns

default void checkCanCreateViewWithSelectFromColumns(ConnectorSecurityContext context,
 SchemaTableName tableName,
 Set<String> columnNames)

Check if identity is allowed to create a view that selects from the specified columns in a relation.

Throws:

AccessDeniedException - if not allowed

checkCanCreateMaterializedView

default void checkCanCreateMaterializedView(ConnectorSecurityContext context,
 SchemaTableName materializedViewName,
 Map<String,Object> properties)

Check if identity is allowed to create the specified materialized view.

Throws:

AccessDeniedException - if not allowed

checkCanRefreshMaterializedView

default void checkCanRefreshMaterializedView(ConnectorSecurityContext context,
 SchemaTableName materializedViewName)

Check if identity is allowed to refresh the specified materialized view.

Throws:

AccessDeniedException - if not allowed

checkCanSetMaterializedViewProperties

default void checkCanSetMaterializedViewProperties(ConnectorSecurityContext context,
 SchemaTableName materializedViewName,
 Map<String,Optional<Object>> properties)

Check if identity is allowed to set the properties of the specified materialized view.

Throws:

AccessDeniedException - if not allowed

checkCanDropMaterializedView

default void checkCanDropMaterializedView(ConnectorSecurityContext context,
 SchemaTableName materializedViewName)

Check if identity is allowed to drop the specified materialized view.

Throws:

AccessDeniedException - if not allowed

checkCanRenameMaterializedView

default void checkCanRenameMaterializedView(ConnectorSecurityContext context,
 SchemaTableName viewName,
 SchemaTableName newViewName)

Check if identity is allowed to rename the specified materialized view.

Throws:

AccessDeniedException - if not allowed

checkCanSetCatalogSessionProperty

default void checkCanSetCatalogSessionProperty(ConnectorSecurityContext context,
 String propertyName)

Check if identity is allowed to set the specified property.

Throws:

AccessDeniedException - if not allowed

checkCanGrantSchemaPrivilege

default void checkCanGrantSchemaPrivilege(ConnectorSecurityContext context,
 Privilege privilege,
 String schemaName,
 TrinoPrincipal grantee,
 boolean grantOption)

Check if identity is allowed to grant to any other user the specified privilege on the specified schema.

Throws:

AccessDeniedException - if not allowed

checkCanDenySchemaPrivilege

default void checkCanDenySchemaPrivilege(ConnectorSecurityContext context,
 Privilege privilege,
 String schemaName,
 TrinoPrincipal grantee)

Check if identity is allowed to deny to any other user the specified privilege on the specified schema.

Throws:

AccessDeniedException - if not allowed

checkCanRevokeSchemaPrivilege

default void checkCanRevokeSchemaPrivilege(ConnectorSecurityContext context,
 Privilege privilege,
 String schemaName,
 TrinoPrincipal revokee,
 boolean grantOption)

checkCanGrantTablePrivilege

default void checkCanGrantTablePrivilege(ConnectorSecurityContext context,
 Privilege privilege,
 SchemaTableName tableName,
 TrinoPrincipal grantee,
 boolean grantOption)

Check if identity is allowed to grant to any other user the specified privilege on the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanDenyTablePrivilege

default void checkCanDenyTablePrivilege(ConnectorSecurityContext context,
 Privilege privilege,
 SchemaTableName tableName,
 TrinoPrincipal grantee)

Check if identity is allowed to deny to any other user the specified privilege on the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanRevokeTablePrivilege

default void checkCanRevokeTablePrivilege(ConnectorSecurityContext context,
 Privilege privilege,
 SchemaTableName tableName,
 TrinoPrincipal revokee,
 boolean grantOption)

Check if identity is allowed to revoke the specified privilege on the specified table from any user.

Throws:

AccessDeniedException - if not allowed

checkCanCreateRole

default void checkCanCreateRole(ConnectorSecurityContext context,
 String role,
 Optional<TrinoPrincipal> grantor)

checkCanDropRole

default void checkCanDropRole(ConnectorSecurityContext context,
 String role)

checkCanGrantRoles

default void checkCanGrantRoles(ConnectorSecurityContext context,
 Set<String> roles,
 Set<TrinoPrincipal> grantees,
 boolean adminOption,
 Optional<TrinoPrincipal> grantor)

checkCanRevokeRoles

default void checkCanRevokeRoles(ConnectorSecurityContext context,
 Set<String> roles,
 Set<TrinoPrincipal> grantees,
 boolean adminOption,
 Optional<TrinoPrincipal> grantor)

checkCanSetRole

default void checkCanSetRole(ConnectorSecurityContext context,
 String role)

checkCanShowRoles

default void checkCanShowRoles(ConnectorSecurityContext context)

Check if identity is allowed to show roles.

Throws:

AccessDeniedException - if not allowed

checkCanShowCurrentRoles

default void checkCanShowCurrentRoles(ConnectorSecurityContext context)

Check if identity is allowed to show current roles.

Throws:

AccessDeniedException - if not allowed

checkCanShowRoleGrants

default void checkCanShowRoleGrants(ConnectorSecurityContext context)

Check if identity is allowed to show its own role grants.

Throws:

AccessDeniedException - if not allowed

checkCanExecuteProcedure

default void checkCanExecuteProcedure(ConnectorSecurityContext context,
 SchemaRoutineName procedure)

checkCanExecuteTableProcedure

default void checkCanExecuteTableProcedure(ConnectorSecurityContext context,
 SchemaTableName tableName,
 String procedure)

canExecuteFunction

default boolean canExecuteFunction(ConnectorSecurityContext context,
 SchemaRoutineName function)

Is the identity allowed to execute the specified function?

canCreateViewWithExecuteFunction

default boolean canCreateViewWithExecuteFunction(ConnectorSecurityContext context,
 SchemaRoutineName function)

Is identity allowed to create a view that executes the specified function?

checkCanShowFunctions

default void checkCanShowFunctions(ConnectorSecurityContext context,
 String schemaName)

Check if identity is allowed to show functions by executing SHOW FUNCTIONS.

NOTE: This method is only present to give users an error message when listing is not allowed. The filterFunctions(io.trino.spi.connector.ConnectorSecurityContext, java.util.Set<io.trino.spi.function.SchemaFunctionName>) method must filter all results for unauthorized users, since there are multiple ways to list functions.

Throws:

AccessDeniedException - if not allowed

filterFunctions

default Set<SchemaFunctionName> filterFunctions(ConnectorSecurityContext context,
 Set<SchemaFunctionName> functionNames)

Filter the list of functions to those visible to the identity.

checkCanCreateFunction

default void checkCanCreateFunction(ConnectorSecurityContext context,
 SchemaRoutineName function)

Check if identity is allowed to create the specified function.

Throws:

AccessDeniedException - if not allowed

checkCanDropFunction

default void checkCanDropFunction(ConnectorSecurityContext context,
 SchemaRoutineName function)

Check if identity is allowed to drop the specified function.

Throws:

AccessDeniedException - if not allowed

checkCanShowCreateFunction

default void checkCanShowCreateFunction(ConnectorSecurityContext context,
 SchemaRoutineName function)

Check if identity is allowed to execute SHOW CREATE FUNCTION.

Throws:

AccessDeniedException - if not allowed

getRowFilters

default List<ViewExpression> getRowFilters(ConnectorSecurityContext context,
 SchemaTableName tableName)

Get row filters associated with the given table and identity.

Each filter must be a scalar SQL expression of boolean type over the columns in the table.

Returns:

the list of filters, or empty list if not applicable

getColumnMask

@Deprecated
default Optional<ViewExpression> getColumnMask(ConnectorSecurityContext context,
 SchemaTableName tableName,
 String columnName,
 Type type)

Deprecated.

use getColumnMasks(ConnectorSecurityContext, SchemaTableName, List)

Get column mask associated with the given table, column and identity.

The mask must be a scalar SQL expression of a type coercible to the type of the column being masked. The expression must be written in terms of columns in the table.

Returns:

the mask if present, or empty if not applicable

getColumnMasks

default Map<ColumnSchema,ViewExpression> getColumnMasks(ConnectorSecurityContext context,
 SchemaTableName tableName,
 List<ColumnSchema> columns)

Bulk method for getting column masks for a subset of columns in a table.

Each mask must be a scalar SQL expression of a type coercible to the type of the column being masked. The expression must be written in terms of columns in the table.

Returns:

a mapping from columns to masks. The keys of the return Map are a subset of columns.