fix: Add missing OPA rules for Trino batched API (#11)

stackabletech · Jan 2, 2024 · 60856ef · 60856ef
1 parent 0bb9692
commit 60856ef
Show file tree

Hide file tree

Showing 4 changed files with 54 additions and 4 deletions.
diff --git a/stacks/data-lakehouse-iceberg-trino-spark/trino.yaml b/stacks/data-lakehouse-iceberg-trino-spark/trino.yaml
@@ -129,16 +129,28 @@ data:
   trino.rego: |
     package trino
 
+    import future.keywords.in
+
     default allow = false
 
+    # Allow non-batched access
     allow {
       is_admin
     }
+    # Allow batched access
     extended[i] {
       some i
       input.action.filterResources[i]
       is_admin
     }
+    # Corner case: filtering columns is done with a single table item, and many columns inside
+    extended[i] {
+      some i
+      input.action.operation == "FilterColumns"
+      count(input.action.filterResources) == 1
+      input.action.filterResources[0].table.columns[i]
+      is_admin
+    }
 
     is_admin() {
       input.context.identity.user == "admin"

diff --git a/stacks/dual-hive-hdfs-s3/trino.yaml b/stacks/dual-hive-hdfs-s3/trino.yaml
@@ -61,7 +61,7 @@ metadata:
   name: trino
 spec:
   image:
-    productVersion: "414"
+    productVersion: "428"
   clusterConfig:
     authorization:
       opa:
@@ -101,12 +101,30 @@ metadata:
 data:
   trino.rego: |
     package trino
+
+    import future.keywords.in
+
     default allow = false
 
+    # Allow non-batched access
     allow {
-      input.context.identity.user == "admin"
+      is_admin
+    }
+    # Allow batched access
+    extended[i] {
+      some i
+      input.action.filterResources[i]
+      is_admin
+    }
+    # Corner case: filtering columns is done with a single table item, and many columns inside
+    extended[i] {
+      some i
+      input.action.operation == "FilterColumns"
+      count(input.action.filterResources) == 1
+      input.action.filterResources[0].table.columns[i]
+      is_admin
     }
 
-    allow {
-      input.context.identity.user == "demo"
+    is_admin() {
+      input.context.identity.user == "admin"
     }
diff --git a/stacks/trino-iceberg/trino.yaml b/stacks/trino-iceberg/trino.yaml
@@ -122,14 +122,24 @@ data:
 
     default allow = false
 
+    # Allow non-batched access
     allow {
       is_admin
     }
+    # Allow batched access
     extended[i] {
       some i
       input.action.filterResources[i]
       is_admin
     }
+    # Corner case: filtering columns is done with a single table item, and many columns inside
+    extended[i] {
+      some i
+      input.action.operation == "FilterColumns"
+      count(input.action.filterResources) == 1
+      input.action.filterResources[0].table.columns[i]
+      is_admin
+    }
 
     is_admin() {
       input.context.identity.user == "admin"

diff --git a/stacks/trino-superset-s3/trino.yaml b/stacks/trino-superset-s3/trino.yaml
@@ -90,14 +90,24 @@ data:
 
     default allow = false
 
+    # Allow non-batched access
     allow {
       is_admin
     }
+    # Allow batched access
     extended[i] {
       some i
       input.action.filterResources[i]
       is_admin
     }
+    # Corner case: filtering columns is done with a single table item, and many columns inside
+    extended[i] {
+      some i
+      input.action.operation == "FilterColumns"
+      count(input.action.filterResources) == 1
+      input.action.filterResources[0].table.columns[i]
+      is_admin
+    }
 
     is_admin() {
       input.context.identity.user == "admin"