Add checkCanGrantExecuteFunctionPrivilege to ConnectorAccessControl

[huberty89]

Description

Follow-up to #13944
I will needed this to complete #13713

Release notes

( ) This is not user-visible and no release notes are required.
( ) Release notes are required, please propose a release note for me.
(x) Release notes are required, with the following suggested text:

# SPI
* Add `ConnectorAccessControl.checkCanGrantExecuteFunctionPrivilege` overload that needs to be implemented
  to allow views that use table functions. ({issue}`13944`)

[huberty89]

I would like to add a test for that, but not sure where should I start.

[ksobolew]

Makes sense, but I wonder... How much are we going to phase out connector access control in favor of global access control? (I know, this is a bigger question :) )

[kokosing]

You can write a test against sql-standard access control, to see it is rejecting table functions by default.

[kokosing]

I am under impression that this throw is not needed. However, it leaves no question that is a dead code.

Or maybe you can use return switch here?

[ksobolew]

I wanted to say the same, but the return value is void so it won't work.

[findepi]

lgtm % let's have a test

[kokosing]

You can use io.trino.tests.product.hive.TestSqlStandardAccessControlChecks for testing

[kokosing]

LGTM % test

[huberty89]

I rebased and add few tests in TestAccessControlManager

[kokosing]

Maven checks are failiing

[ssheikin]

May be { not needed?

What about testing checkCanExecuteFunction?

[huberty89]

May be { not needed?

execute is overloaded and in-lining cause compilation error

What about testing checkCanExecuteFunction?

This is already checked in other tests

[ssheikin]

could you please verify that you have access before setting DenyConnectorAccessControl?

[huberty89]

This is checked in testAllowExecuteTableFunction test

[ssheikin]

Yeah, I'd prefer to have these tests duplicated, than not to have it here.
It would underline that just before setting DenyConnectorAccessControl it was possible to select from that connector. Actually that's @kokosing's style.

[huberty89]

@findepi @dain Would you like to take a look? I'm adding new method to SPI so I want to be sure if that's ok

[kokosing]

Merged, thanks!