Extending the FileBasedSystemAccessControl to add additional help context

[kirkhansen]

Hey all,
I'll preface this with I'm a Java noob.

I recently tried to extend the FileBasedSystemAccessControl and config classes to add some functionality. Specifically, I wanted to display a URL to a website that can help users request access to tables they don't have access to.

The result is an access-control.properties file that looks like:

access-control.name=help-text-file
security.config-file=etc/rules.json
security.refresh-period=60s
security.request-access-url=https://url-to-tool-for-requesting-access.com

The result is SQL error messages that look like:

SQL Error [4]: Query failed (#20240821_220657_00000_4upnq): Access Denied: Cannot select from table sample.public.my_table: Please visit https://url-to-tool-for-requesting-access.com?catalog=sample&schema=public&table_name=my_table to request access.

I ended up needing to copy a lot more files than I'd have originally thought or hoped due to some of the SPI methods having undeclared privacy, so outside packages can't call the methods directly. The end result was me being unable to use these classes as base classes to inject my functionality and instead copy everything out.

An example of this is the CatalogSchemaAccessControlRule::toAnyCatalogPermissionsRule calls within the FileBasedSystemAccessControl private constructor.

Stepping out a bit, this is what I added to a custom FileBasedSystemAccessControl class: note the help_text variable.

private String buildAccessRequestURL(CatalogSchemaTableName table) {
        return String.format(
                "%s?catalog=%s&schema=%s&table_name=%s",
                this.requestAccessURL,
                table.getCatalogName(),
                table.getSchemaTableName().getSchemaName(),
                table.getSchemaTableName().getTableName()
        );
    }

    @Override
    public void checkCanSelectFromColumns(SystemSecurityContext context, CatalogSchemaTableName table, Set<String> columns)
    {
        String help_text = String.format("Please visit %s to request access.",
                this.buildAccessRequestURL(table));

        if (!canAccessCatalog(context, table.getCatalogName(), READ_ONLY)) {
            denySelectTable(table.toString(), help_text);
        }

        if (INFORMATION_SCHEMA_NAME.equals(table.getSchemaTableName().getSchemaName())) {
            return;
        }

        Identity identity = context.getIdentity();
        boolean allowed = tableRules.stream()
                .filter(rule -> rule.matches(identity.getUser(), identity.getEnabledRoles(), identity.getGroups(), table))
                .map(rule -> rule.canSelectColumns(columns))
                .findFirst()
                .orElse(false);
        if (!allowed) {
            denySelectTable(table.toString(), help_text);
        }
    }

My original idea was to extend Trino's FileBasedSystemAccessControl, override this checkCanSelectFromColumns, call super.checkCanSelectFromColumns(), catch the AccessDenied exception, and re-raise it adding my help-text to it.
I actually needed to copy paste the entire implementation.

Is there a better way to inherit / delegate calls so we can use the built in logic without needing to maintain an entire copy of the access control business logic?

The classes I ended up needing to copy out verbatim were:

CatalogAccessControlRule.java
CatalogFunctionAccessControlRule.java
CatalogProcedureAccessControlRule.java
CatalogSchemaAccessControlRule.java
CatalogSessionPropertyAccessControlRule.java
CatalogTableAccessControlRule.java
FileBasedSystemAccessControlRules.java
FunctionAccessControlRule.java
ProcedureAccessControlRule.java
SchemaAccessControlRule.java
SessionPropertyAccessControlRule.java
TableAccessControlRule.java

These are the ones that needed some slight modifications:

FileBasedAccessControlConfig.java
FileBasedSystemAccessControl.java
FileBasedSystemAccessControlModule.java
FileBasedSystemAccessControlPlugin.java