Add tables with authorization information to system.metadata #25907

homar · 2025-06-02T21:01:43Z

Description

Trino supports ALTER (TABLE | FUNCTION | SCHEMA) SET AUTHORIZATION for quite some time.
However there is no way to retrieve this information. This commit fixes this by
introducing system.metadata.(tables | schemas | functions)_authorization tables.

Additional context and related issues

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
(x) Release notes are required, with the following suggested text:

## Section
* Introduces system.metadata.(tables | schemas | functions)_authorization tables that expose the information about the authorization for given entities.

lukasz-walkiewicz · 2025-06-04T07:38:58Z

core/trino-main/src/main/java/io/trino/metadata/Metadata.java

nit: put schema first, then tables and functions last?

lukasz-walkiewicz · 2025-06-04T07:49:34Z

core/trino-main/src/main/java/io/trino/metadata/SystemSecurityMetadata.java

nit: I'd say All infix is redundant

lukasz-walkiewicz · 2025-06-04T08:07:27Z

testing/trino-tests/src/test/java/io/trino/security/TestingSystemSecurityMetadata.java

nit: just combine maps instead of extracting this method?

lukasz-walkiewicz · 2025-06-04T08:14:33Z

core/trino-main/src/main/java/io/trino/metadata/MetadataListing.java

Is this method actually needed if all it does is delegating to listCatalogNames and listSchemas?

it only does delegation BUT i would need to reuse this code in 3 places so I decided it is a good idea to actually extract it to a separated method

lukasz-walkiewicz · 2025-06-04T08:17:28Z

testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java

That's the only test using blackhole catalog instead of memory_test, why?

because I was not able to create a function in blackhole catalog so functions are tested using memory (and memory_test to check that table returns functions from different catalogs).
I can change this to also use memory

core/trino-main/src/main/java/io/trino/metadata/SystemSecurityMetadata.java

kokosing · 2025-06-04T19:42:58Z

core/trino-main/src/main/java/io/trino/metadata/SystemSecurityMetadata.java

nit: This javadocs does not say more that the method name. I would drop it.

kokosing · 2025-06-04T19:45:14Z

core/trino-main/src/main/java/io/trino/metadata/SystemSecurityMetadata.java

It is odd to pass QualifiedTablePrefix as it is not a table. I mean if one passed schema_name parameter then you should return just that schema.

when schema name is passed then it is easy, but this is an optimization for situation when only catalog is known, instead of returning all schemas from all catalogs when can just get schemas for a specific catalog

kokosing · 2025-06-17T14:02:35Z

core/trino-main/src/main/java/io/trino/connector/system/TablesAuthorization.java

How do you know what is domain 0?

I don't, I saw it in other places like

trino/core/trino-main/src/main/java/io/trino/connector/system/TableCommentSystemTable.java

Line 99 in 0f360f7

Domain catalogDomain = constraint.getDomain(0, VARCHAR);

and from my testing it looks like it works this way. So 0 is catalog, 1 is schema etc.

kokosing · 2025-06-17T14:05:37Z

core/trino-main/src/main/java/io/trino/connector/system/FunctionsAuthorization.java

I think it would be nice to enumerate only functions that in constraint

kokosing · 2025-06-17T14:06:48Z

core/trino-main/src/main/java/io/trino/connector/system/SchemasAuthorization.java

I think it would be nice to enumerate only schemas that in constraint

kokosing · 2025-06-17T14:07:26Z

core/trino-main/src/main/java/io/trino/connector/system/TablesAuthorization.java

I think it would be nice to enumerate only tables that in constraint

kokosing · 2025-06-17T14:08:25Z

core/trino-main/src/main/java/io/trino/metadata/DisabledSystemSecurityMetadata.java

We should not use QualifiedTablePrefix here as table has no sense

So I believe it is a naming problem, I can copy code of QualifiedTablePrefix and name it QualifiedObjectPrefix but would that really make sense?
I may rename QualifiedTablePrefix to QualifiedObjectPrefix but I don't believe it is a big deal actually

So I believe it is a naming problem, I can copy code of QualifiedTablePrefix and name it QualifiedObjectPrefix but would that really make sense?

Yes. Please. Also you may want them to become records. So then there is not that much copying :)

kokosing · 2025-06-17T15:27:51Z

core/trino-main/src/main/java/io/trino/metadata/DisabledSystemSecurityMetadata.java

We should not use QualifiedTablePrefix here as table has no sense

#25907 (comment)

core/trino-main/src/main/java/io/trino/metadata/MetadataListing.java

core/trino-main/src/main/java/io/trino/metadata/SystemSecurityMetadata.java

kokosing · 2025-06-17T15:35:40Z

testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java

add test for VIEW and MATERIALIZED VIEW

VIEWS are covered in testViewColumnAccessControl, unfortunately there is no available connector in TestAccessControl that can create MATERIALIZED VIEWs.. So testing that is nor feasible right now

kokosing · 2025-06-20T08:52:29Z

core/trino-main/src/main/java/io/trino/connector/system/FunctionsAuthorization.java

nit: extracting this as variable would make the code more readable. I need to go up and down to understand what 0 or 2 means.

core/trino-main/src/main/java/io/trino/connector/system/FunctionsAuthorization.java

kokosing · 2025-06-20T08:57:26Z

core/trino-main/src/main/java/io/trino/connector/system/FunctionsAuthorization.java

Hm.... maybe I was wrong. Now when I see this code I think we don't need to do it as it will be filtered anyway. When I requested filtering I wanted to avoid metadata calls, but once the call is done filtering more is not useful.

I think it is better this way

I think it unnecessarly complicates the logic here. I wanted to try eliminate the number of metadata calls. Filtering the set here does not improve the performance much and makes code here complex.

Please apply the same comment in other places.

core/trino-main/src/main/java/io/trino/connector/system/SchemasAuthorization.java

kokosing · 2025-06-20T08:59:17Z

core/trino-main/src/main/java/io/trino/connector/system/SchemasAuthorization.java

same comments. It could be a set.

kokosing · 2025-06-20T09:05:00Z

core/trino-main/src/main/java/io/trino/connector/system/SchemasAuthorization.java

nit: extract variable for it too

core/trino-main/src/main/java/io/trino/connector/system/TablesAuthorization.java

core/trino-main/src/main/java/io/trino/metadata/DisabledSystemSecurityMetadata.java

kokosing · 2025-06-20T09:07:56Z

core/trino-main/src/main/java/io/trino/metadata/QualifiedObjectPrefix.java

why not record? So much boilerplate..

kokosing · 2025-06-20T09:08:32Z

core/trino-main/src/test/java/io/trino/metadata/AbstractMockMetadata.java

core/trino-main/src/main/java/io/trino/connector/system/FunctionsAuthorization.java

kokosing · 2025-06-20T20:26:22Z

core/trino-main/src/main/java/io/trino/connector/system/FunctionsAuthorization.java

I think it unnecessarly complicates the logic here. I wanted to try eliminate the number of metadata calls. Filtering the set here does not improve the performance much and makes code here complex.

Please apply the same comment in other places.

kokosing · 2025-06-20T20:29:10Z

core/trino-main/src/main/java/io/trino/metadata/MetadataManager.java

Instead of passing QualifiedObjectPrefix, pass String catalog, Optional<String> schema, or some QualifiedSchemaPrefix

Sorry but I don't agree. I believe QualifiedObjectPrefix should be treated as generic and could be used in any scenario - can represent as short path as the one to catalog and as long as the one to table. Currently it is kind of hardcoded but I believe it can be reimplemented to support prefixes of any length if necessary

kokosing · 2025-06-20T20:31:05Z

core/trino-main/src/main/java/io/trino/metadata/QualifiedObjectPrefix.java

I don't think you need this if you use record. Same for getters.

kokosing · 2025-06-26T09:45:06Z

core/trino-main/src/main/java/io/trino/connector/system/FunctionsAuthorization.java

This is wrong. See e9b931f

It is obvious that query on system catalog in Trino fails in this case. We care here about the catalog from constraint.getDomain(0, VARCHAR);.

However ownership is taken from SystemSecurityMetadata not a connector metadata so we could potentially skip that.

kokosing · 2025-06-26T09:49:11Z

core/trino-main/src/main/java/io/trino/connector/system/FunctionsAuthorization.java

kokosing · 2025-06-26T09:49:25Z

core/trino-main/src/main/java/io/trino/connector/system/SchemasAuthorization.java

kokosing · 2025-06-26T09:50:48Z

core/trino-main/src/main/java/io/trino/connector/system/SchemasAuthorization.java

There is no need to filter it. You already passed schema filter to getSchemasAuthorizationInfo

schemaName is taken from the constraint, it can be empty, in that case getSchemasAuthorizationInfo will return all schemas so I still need to filter. In case it is provided there will be only 1 result so it is fine

kokosing · 2025-06-26T09:51:11Z

core/trino-main/src/main/java/io/trino/connector/system/TablesAuthorization.java

kokosing · 2025-06-26T09:52:03Z

core/trino-main/src/main/java/io/trino/connector/system/TablesAuthorization.java

same with filtering. You already passed prefix to getTablesAuthorizationInfo

same answer, that filtering may not happen as the source of that value is in constraint TupleDomain which may be empty

kokosing · 2025-06-26T09:56:25Z

core/trino-main/src/main/java/io/trino/metadata/MetadataManager.java

requireNonNull(prefix, "prefix is null"); Optional<CatalogMetadata> catalog = getOptionalCatalogMetadata(session, prefix.getCatalogName()); if (catalog.filter(SYSTEM::equals).present) { return systemSecurityMetadata.getSchemasAuthorizationInfo(session, prefix); } return ImmutableSet.of();

kokosing · 2025-06-26T10:00:33Z

core/trino-main/src/main/java/io/trino/metadata/QualifiedObjectPrefix.java

there is no need to write getters for record

ehh i used copilot and it failed miserably.. (i did fail to as I didn't check what it did..)

kokosing · 2025-06-26T10:00:55Z

core/trino-main/src/main/java/io/trino/metadata/QualifiedSchemaPrefix.java

kokosing · 2025-06-26T10:02:27Z

core/trino-main/src/main/java/io/trino/metadata/QualifiedObjectPrefix.java

there is no need to assign things in record constructor.

You can call requireNonNull if you like

yes, right, again copilot generated too much

…25907 Trino supports ALTER (TABLE | FUNCTION | SCHEMA) SET AUTHORIZATION for quite some time. However there is no way to retrieve this information. This commit fixes this by introducing system.metadata.(tables | schemas | functions)_authorization tables.

kokosing

All good, the last part is to make sure that we use access control properly and we do have tests for the access control filterring.

kokosing · 2025-06-30T14:09:30Z

testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java


+
+    @Test
+    public void testSchemasAuthorization()


Do you have a test where user has no access to a schema so they cannot see it in schemas_authorization?

Check last assertion in this test

kokosing · 2025-06-30T14:09:51Z

testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java

+    }
+
+    @Test
+    public void testTablesAuthorization()


Do you have a test where user has no access to a table/view so they cannot see it in tables_authorization?

check last assertion in this test

kokosing · 2025-06-30T14:10:11Z

testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java

+    }
+
+    @Test
+    public void testFunctionsAuthorization()


Do you have a test where user has no access to a schema so they cannot see it in function_authorization?

check last assertion in this test

kokosing · 2025-06-30T14:10:54Z

core/trino-main/src/main/java/io/trino/connector/system/FunctionsAuthorization.java

+        try {
+            return doGetFunctionsAuthorization(session, constraint);
+        }
+        catch (RuntimeException exception) {


What if RuntimeException is already TrinoException?

kokosing · 2025-06-30T14:12:47Z

core/trino-main/src/main/java/io/trino/connector/system/SchemasAuthorization.java

+        Map<String, Set<CatalogSchemaName>> groupedByCatalog = availableSchemas.stream()
+                .collect(groupingBy(CatalogSchemaName::getCatalogName, Collectors.toSet()));
+        ImmutableList.Builder<CatalogSchemaAuthorization> result = ImmutableList.builder();
+        for (String catalog : groupedByCatalog.keySet()) {


I don't see io.trino.security.AccessControl#filterSchemas called below.

That's good because it is not here :) It is called above inside io.trino.metadata.MetadataListing#listAllAvailableSchemas

kokosing · 2025-06-30T14:13:38Z

core/trino-main/src/main/java/io/trino/connector/system/FunctionsAuthorization.java

+    {
+        Domain catalogDomain = constraint.getDomain(0, VARCHAR);
+        Domain schemaDomain = constraint.getDomain(1, VARCHAR);
+        Set<CatalogSchemaName> availableSchemas = listAllAvailableSchemas(


is this using io.trino.security.AccessControl#filterCatalogs or io.trino.security.AccessControl#filterSchemas?

kokosing · 2025-06-30T14:14:28Z

core/trino-main/src/main/java/io/trino/connector/system/TablesAuthorization.java

+            Session session,
+            TupleDomain<Integer> constraint)
+    {
+        Set<CatalogSchemaName> availableSchemas = listAllAvailableSchemas(session,


is this using io.trino.security.AccessControl#filterCatalogs or io.trino.security.AccessControl#filterSchemas?

kokosing · 2025-06-30T14:14:50Z

core/trino-main/src/main/java/io/trino/connector/system/TablesAuthorization.java

+        ImmutableList.Builder<CatalogTableAuthorization> result = ImmutableList.builder();
+        availableSchemas.forEach(catalogSchemaName -> {
+            QualifiedTablePrefix prefix = new QualifiedTablePrefix(catalogSchemaName.getCatalogName(), Optional.of(catalogSchemaName.getSchemaName()), tableName);
+            Set<SchemaTableName> accessibleNames = listTables(session, metadata, accessControl, prefix);


I don't see io.trino.security.AccessControl#filterTables called here.

good, it is called inside io.trino.metadata.MetadataListing#listTables

kokosing · 2025-06-30T14:15:39Z

core/trino-main/src/main/java/io/trino/metadata/QualifiedSchemaPrefix.java

+    public QualifiedSchemaPrefix(String catalogName, Optional<String> schemaName)
+    {
+        this.catalogName = checkCatalogName(catalogName);
+        this.schemaName = schemaName;


nit: no need to assign anything here :)

kokosing · 2025-06-30T14:15:48Z

core/trino-main/src/main/java/io/trino/metadata/QualifiedSchemaPrefix.java

…25907 Trino supports ALTER (TABLE | FUNCTION | SCHEMA) SET AUTHORIZATION for quite some time. However there is no way to retrieve this information. This commit fixes this by introducing system.metadata.(tables | schemas | functions)_authorization tables.

kokosing · 2025-07-01T12:50:36Z

Thank you!

…25907 Trino supports ALTER (TABLE | FUNCTION | SCHEMA) SET AUTHORIZATION for quite some time. However there is no way to retrieve this information. This commit fixes this by introducing system.metadata.(tables | schemas | functions)_authorization tables.

cla-bot bot added the cla-signed label Jun 2, 2025

homar force-pushed the homar/add_authorizations_metadata branch 2 times, most recently from a7392e0 to 2ff0516 Compare June 2, 2025 22:03

homar changed the title ~~Homar/add authorizations metadata~~ Add tables with authorization information to system.metadata Jun 3, 2025

homar force-pushed the homar/add_authorizations_metadata branch from 2ff0516 to d6e48b8 Compare June 3, 2025 10:39

homar marked this pull request as ready for review June 3, 2025 10:40

lukasz-walkiewicz reviewed Jun 4, 2025

View reviewed changes

lukasz-walkiewicz requested review from kokosing and martint June 4, 2025 08:19

kokosing reviewed Jun 4, 2025

View reviewed changes

homar force-pushed the homar/add_authorizations_metadata branch from d6e48b8 to 4bdaae9 Compare June 4, 2025 21:30

homar force-pushed the homar/add_authorizations_metadata branch from 4bdaae9 to 91ca0d7 Compare June 4, 2025 22:30

homar force-pushed the homar/add_authorizations_metadata branch from 91ca0d7 to 21bc502 Compare June 5, 2025 20:35

kokosing reviewed Jun 17, 2025

View reviewed changes

homar force-pushed the homar/add_authorizations_metadata branch from 21bc502 to b78b694 Compare June 19, 2025 22:07

homar force-pushed the homar/add_authorizations_metadata branch from b78b694 to e94721b Compare June 19, 2025 23:22

kokosing reviewed Jun 20, 2025

View reviewed changes

homar force-pushed the homar/add_authorizations_metadata branch from e94721b to d44f577 Compare June 20, 2025 09:57

kokosing reviewed Jun 20, 2025

View reviewed changes

homar force-pushed the homar/add_authorizations_metadata branch from d44f577 to 56e8649 Compare June 22, 2025 20:07

homar force-pushed the homar/add_authorizations_metadata branch from 56e8649 to 98e94f5 Compare June 23, 2025 14:08

homar requested a review from lukasz-walkiewicz June 23, 2025 22:05

kokosing reviewed Jun 26, 2025

View reviewed changes

homar force-pushed the homar/add_authorizations_metadata branch from 98e94f5 to 00ee142 Compare June 26, 2025 22:00

homar force-pushed the homar/add_authorizations_metadata branch from 00ee142 to 44971df Compare June 27, 2025 07:21

homar force-pushed the homar/add_authorizations_metadata branch from 44971df to f3d1e5f Compare June 27, 2025 16:56

homar force-pushed the homar/add_authorizations_metadata branch from f3d1e5f to 2df7e83 Compare June 27, 2025 20:00

kokosing reviewed Jun 30, 2025

View reviewed changes

homar force-pushed the homar/add_authorizations_metadata branch from 2df7e83 to 56f5b80 Compare June 30, 2025 20:29

kokosing approved these changes Jul 1, 2025

View reviewed changes

kokosing merged commit 59a96c1 into trinodb:master Jul 1, 2025
95 checks passed

github-actions bot added this to the 477 milestone Jul 1, 2025

ksobolew mentioned this pull request Jul 2, 2025

Provide a way to see who the owner is of a schema/table/view #10593

Closed

ebyhr mentioned this pull request Aug 6, 2025

Add Trino 477 release notes #26350

Merged

Add tables with authorization information to system.metadata #25907

Add tables with authorization information to system.metadata #25907

Uh oh!

Conversation

homar commented Jun 2, 2025 • edited by kokosing Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Additional context and related issues

Release notes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

homar commented Jun 2, 2025 •

edited by kokosing

Loading