Enable getRowFilter to be column aware #26582
Draft
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Summary
Enable getRowFilter to be column aware.
Detail
Presently the access control interfaces provide
getRowFilter
with the security context, catalog name and schema name.This works well when adding the row filter based on a restricted list of rules (
FileBasedAccessControl
) or where the metadata is known elsewhere (OPA or Ranger).However this does not allow for filters to be dynamically added based on the columns.
For example - whenever a table has a
security_group
column, add a filter to enable row-level security against the user's current groups.To enable this use case, this PR modifies the
getRowFilter
so that theList<ColumnSchema>
is also passed in as a parameter, matchinggetColumnMasks
.Implementation Notes
trino-main
calls the new method. However the old method is deprecated but called by the default implementation of the new method within the interfaces. Hopefully this preserves backwards compatibility?FileBasedAccessControl
and associated documentation.Additional context and related issues
#1480 - original implementation of row filtering
#21046 - a question around this functionality
Release notes
( ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
(x) Release notes are required, with the following suggested text: