[api] Add REST permission management

paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java

@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import javax.annotation.Nullable;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
+
+/** Exact resource or scope, principal, and pagination filters for permission assignments. */
+@Experimental
+public class ListPermissionsRequest {
+
+ public static final int MAX_PAGE_SIZE = 1000;
+
+ private final PermissionResource resource;
+ @Nullable private final String principal;
+ @Nullable private final String access;
+ @Nullable private final String pageToken;
+ @Nullable private final Integer maxResults;
+
+ public ListPermissionsRequest(
+ ResourceType resourceType,
+ @Nullable String database,
+ @Nullable String table,
+ @Nullable String function,
+ @Nullable String view,
+ @Nullable String principal,
+ @Nullable String access,
+ @Nullable String pageToken,
+ @Nullable Integer maxResults) {
+ this.resource = exactResource(resourceType, database, table, function, view);
+ if (!isBlank(principal)) {
+ PermissionAssignment.validatePrincipal(principal);
+ }
+ checkArgument(maxResults == null || maxResults > 0, "maxResults must be greater than 0.");
+ checkArgument(
+ maxResults == null || maxResults <= MAX_PAGE_SIZE,
+ "maxResults must be at most %s.",
+ MAX_PAGE_SIZE);
+ this.principal = isBlank(principal) ? null : principal;
+ this.access = isBlank(access) ? null : PermissionAccess.canonicalize(resource, access);
+ this.pageToken = pageToken;
+ this.maxResults = maxResults;
+ }
+
+ public ResourceType getResourceType() {
+ return resource.getType();
+ }
+
+ @Nullable
+ public String getDatabase() {
+ return resource.getDatabase();
+ }
+
+ @Nullable
+ public String getTable() {
+ return resource.getTable();
+ }
+
+ @Nullable
+ public String getFunction() {
+ return resource.getFunction();
+ }
+
+ @Nullable
+ public String getView() {
+ return resource.getView();
+ }
+
+ @Nullable
+ public String getPrincipal() {
+ return principal;
+ }
+
+ @Nullable
+ public String getAccess() {
+ return access;
+ }
+
+ @Nullable
+ public String getPageToken() {
+ return pageToken;
+ }
+
+ @Nullable
+ public Integer getMaxResults() {
+ return maxResults;
+ }
+
+ public PermissionResource resource() {
+ return resource;
+ }
+
+ public ListPermissionsRequest withPageToken(@Nullable String newPageToken) {
+ return new ListPermissionsRequest(
+ resource.getType(),
+ resource.getDatabase(),
+ resource.getTable(),
+ resource.getFunction(),
+ resource.getView(),
+ principal,
+ access,
+ newPageToken,
+ maxResults);
+ }
+
+ private static PermissionResource exactResource(
+ ResourceType resourceType,
+ @Nullable String database,
+ @Nullable String table,
+ @Nullable String function,
+ @Nullable String view) {
+ checkNotNull(resourceType, "resourceType cannot be null");
+ try {
+ return new PermissionResource(resourceType, database, table, function, view);
+ } catch (IllegalArgumentException e) {
+ throw new IllegalArgumentException(
+ "Permission listing requires an exact target resource: " + e.getMessage(), e);
+ }
+ }
+
+ private static boolean isBlank(@Nullable String value) {
+ return value == null || value.trim().isEmpty();
+ }
+}

paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java

@@ -0,0 +1,130 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.EnumMap;
+import java.util.HashSet;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
+
+/** Built-in access names and validation for permission assignments. */
+@Experimental
+public final class PermissionAccess {
+
+ /** Maximum wire length supported by the portable permission storage contract. */
+ public static final int MAX_LENGTH = 32;
+
+ public static final String ALL = "ALL";
+ public static final String CREATEDATABASE = "CREATEDATABASE";
+ public static final String DESCRIBE = "DESCRIBE";
+ public static final String ALTER = "ALTER";
+ public static final String DROP = "DROP";
+ public static final String CREATETABLE = "CREATETABLE";
+ public static final String CREATEFUNCTION = "CREATEFUNCTION";
+ public static final String CREATEVIEW = "CREATEVIEW";
+ public static final String LIST = "LIST";
+ public static final String SELECT = "SELECT";
+ public static final String UPDATE = "UPDATE";
+ public static final String GRANT = "GRANT";
+
+ private static final Map<ResourceType, Set<String>> BUILT_INS = builtIns();
+
+ private PermissionAccess() {}
+
+ public static String canonicalize(String access) {
+ checkArgument(access != null && !access.trim().isEmpty(), "access cannot be empty.");
+ checkArgument(
+ access.length() <= MAX_LENGTH,
+ "access must contain at most %s characters.",
+ MAX_LENGTH);
+ String canonical = access.toUpperCase(Locale.ROOT);
+ checkArgument(
+ canonical.length() <= MAX_LENGTH,
+ "access must contain at most %s characters after canonicalization.",
+ MAX_LENGTH);
+ if (BUILT_INS.values().stream().anyMatch(values -> values.contains(canonical))) {
+ return canonical;
+ }
+ throw new IllegalArgumentException(String.format("Unknown access '%s'.", canonical));
+ }
+
+ public static String canonicalize(PermissionResource resource, String access) {
+ checkNotNull(resource, "resource cannot be null");
+ String canonical = canonicalize(access);
+ checkArgument(
+ BUILT_INS.get(resource.getType()).contains(canonical),
+ "Access '%s' is not valid for %s.",
+ canonical,
+ resource.getType());
+ return canonical;
+ }
+
+ public static Set<String> builtIns(ResourceType type) {
+ return BUILT_INS.get(checkNotNull(type, "resource type cannot be null"));
+ }
+
+ private static Map<ResourceType, Set<String>> builtIns() {
+ Map<ResourceType, Set<String>> accesses = new EnumMap<>(ResourceType.class);
+ accesses.put(ResourceType.CATALOG, values(ALL, ALTER, DROP, GRANT, CREATEDATABASE));
+ accesses.put(
+ ResourceType.CATALOG_ALL,
+ values(
+ ALL,
+ DESCRIBE,
+ ALTER,
+ DROP,
+ GRANT,
+ CREATETABLE,
+ CREATEVIEW,
+ CREATEFUNCTION,
+ LIST,
+ SELECT,
+ UPDATE));
+ accesses.put(
+ ResourceType.DATABASE,
+ values(
+ ALL,
+ DESCRIBE,
+ ALTER,
+ DROP,
+ GRANT,
+ CREATETABLE,
+ CREATEVIEW,
+ CREATEFUNCTION,
+ LIST));
+ accesses.put(ResourceType.DATABASE_ALL, values(ALL, SELECT, UPDATE, ALTER, DROP, GRANT));
+ accesses.put(ResourceType.TABLE, values(ALL, SELECT, UPDATE, ALTER, DROP, GRANT));
+ accesses.put(ResourceType.COLUMN, values(SELECT));
+ accesses.put(ResourceType.VIEW, values(ALL, SELECT, ALTER, DROP, GRANT));
+ accesses.put(ResourceType.FUNCTION, values(ALL, SELECT, ALTER, DROP, GRANT));
+ return Collections.unmodifiableMap(accesses);
+ }
+
+ private static Set<String> values(String... accesses) {
+ return Collections.unmodifiableSet(new HashSet<>(Arrays.asList(accesses)));
+ }
+}