in service/common/src/main/java/org/apache/polaris/service/admin/PolarisServiceImpl.java [521:587]
public Response addGrantToCatalogRole(
String catalogName,
String catalogRoleName,
AddGrantRequest grantRequest,
RealmContext realmContext,
SecurityContext securityContext) {
LOGGER.info(
"Adding grant {} to catalogRole {} in catalog {}",
grantRequest,
catalogRoleName,
catalogName);
PolarisAdminService adminService = newAdminService(realmContext, securityContext);
switch (grantRequest.getGrant()) {
// The per-securable-type Privilege enums must be exact String match for a subset of all
// PolarisPrivilege values.
case ViewGrant viewGrant:
{
PolarisPrivilege privilege =
PolarisPrivilege.valueOf(viewGrant.getPrivilege().toString());
String viewName = viewGrant.getViewName();
String[] namespaceParts = viewGrant.getNamespace().toArray(new String[0]);
adminService.grantPrivilegeOnViewToRole(
catalogName,
catalogRoleName,
TableIdentifier.of(Namespace.of(namespaceParts), viewName),
privilege);
break;
}
case TableGrant tableGrant:
{
PolarisPrivilege privilege =
PolarisPrivilege.valueOf(tableGrant.getPrivilege().toString());
String tableName = tableGrant.getTableName();
String[] namespaceParts = tableGrant.getNamespace().toArray(new String[0]);
adminService.grantPrivilegeOnTableToRole(
catalogName,
catalogRoleName,
TableIdentifier.of(Namespace.of(namespaceParts), tableName),
privilege);
break;
}
case NamespaceGrant namespaceGrant:
{
PolarisPrivilege privilege =
PolarisPrivilege.valueOf(namespaceGrant.getPrivilege().toString());
String[] namespaceParts = namespaceGrant.getNamespace().toArray(new String[0]);
adminService.grantPrivilegeOnNamespaceToRole(
catalogName, catalogRoleName, Namespace.of(namespaceParts), privilege);
break;
}
case CatalogGrant catalogGrant:
{
PolarisPrivilege privilege =
PolarisPrivilege.valueOf(catalogGrant.getPrivilege().toString());
adminService.grantPrivilegeOnCatalogToRole(catalogName, catalogRoleName, privilege);
break;
}
default:
LOGGER
.atWarn()
.addKeyValue("catalog", catalogName)
.addKeyValue("role", catalogRoleName)
.log("Don't know how to handle privilege grant: {}", grantRequest);
return Response.status(Response.Status.BAD_REQUEST).build();
}
return Response.status(Response.Status.CREATED).build();
}