浏览代码

[libsentry] Updated to latest Thrift to get list_sentry_privileges_by_authorizable

Romain Rigaux 11 年之前
父节点
当前提交
3118c5803b

+ 7 - 0
desktop/libs/libsentry/gen-py/sentry_policy_service/SentryPolicyService-remote

@@ -34,6 +34,7 @@ if len(sys.argv) <= 1 or sys.argv[1] == '--help':
   print '  TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(TListSentryPrivilegesForProviderRequest request)'
   print '  TDropPrivilegesResponse drop_sentry_privilege(TDropPrivilegesRequest request)'
   print '  TRenamePrivilegesResponse rename_sentry_privilege(TRenamePrivilegesRequest request)'
+  print '  TListSentryPrivilegesByAuthResponse list_sentry_privileges_by_authorizable(TListSentryPrivilegesByAuthRequest request)'
   print ''
   sys.exit(0)
 
@@ -151,6 +152,12 @@ elif cmd == 'rename_sentry_privilege':
     sys.exit(1)
   pp.pprint(client.rename_sentry_privilege(eval(args[0]),))
 
+elif cmd == 'list_sentry_privileges_by_authorizable':
+  if len(args) != 1:
+    print 'list_sentry_privileges_by_authorizable requires 1 args'
+    sys.exit(1)
+  pp.pprint(client.list_sentry_privileges_by_authorizable(eval(args[0]),))
+
 else:
   print 'Unrecognized method %s' % cmd
   sys.exit(1)

+ 170 - 0
desktop/libs/libsentry/gen-py/sentry_policy_service/SentryPolicyService.py

@@ -95,6 +95,13 @@ class Iface(object):
     """
     pass
 
+  def list_sentry_privileges_by_authorizable(self, request):
+    """
+    Parameters:
+     - request
+    """
+    pass
+
 
 class Client(Iface):
   def __init__(self, iprot, oprot=None):
@@ -433,6 +440,36 @@ class Client(Iface):
       return result.success
     raise TApplicationException(TApplicationException.MISSING_RESULT, "rename_sentry_privilege failed: unknown result");
 
+  def list_sentry_privileges_by_authorizable(self, request):
+    """
+    Parameters:
+     - request
+    """
+    self.send_list_sentry_privileges_by_authorizable(request)
+    return self.recv_list_sentry_privileges_by_authorizable()
+
+  def send_list_sentry_privileges_by_authorizable(self, request):
+    self._oprot.writeMessageBegin('list_sentry_privileges_by_authorizable', TMessageType.CALL, self._seqid)
+    args = list_sentry_privileges_by_authorizable_args()
+    args.request = request
+    args.write(self._oprot)
+    self._oprot.writeMessageEnd()
+    self._oprot.trans.flush()
+
+  def recv_list_sentry_privileges_by_authorizable(self, ):
+    (fname, mtype, rseqid) = self._iprot.readMessageBegin()
+    if mtype == TMessageType.EXCEPTION:
+      x = TApplicationException()
+      x.read(self._iprot)
+      self._iprot.readMessageEnd()
+      raise x
+    result = list_sentry_privileges_by_authorizable_result()
+    result.read(self._iprot)
+    self._iprot.readMessageEnd()
+    if result.success is not None:
+      return result.success
+    raise TApplicationException(TApplicationException.MISSING_RESULT, "list_sentry_privileges_by_authorizable failed: unknown result");
+
 
 class Processor(Iface, TProcessor):
   def __init__(self, handler):
@@ -449,6 +486,7 @@ class Processor(Iface, TProcessor):
     self._processMap["list_sentry_privileges_for_provider"] = Processor.process_list_sentry_privileges_for_provider
     self._processMap["drop_sentry_privilege"] = Processor.process_drop_sentry_privilege
     self._processMap["rename_sentry_privilege"] = Processor.process_rename_sentry_privilege
+    self._processMap["list_sentry_privileges_by_authorizable"] = Processor.process_list_sentry_privileges_by_authorizable
 
   def process(self, iprot, oprot):
     (name, type, seqid) = iprot.readMessageBegin()
@@ -586,6 +624,17 @@ class Processor(Iface, TProcessor):
     oprot.writeMessageEnd()
     oprot.trans.flush()
 
+  def process_list_sentry_privileges_by_authorizable(self, seqid, iprot, oprot):
+    args = list_sentry_privileges_by_authorizable_args()
+    args.read(iprot)
+    iprot.readMessageEnd()
+    result = list_sentry_privileges_by_authorizable_result()
+    result.success = self._handler.list_sentry_privileges_by_authorizable(args.request)
+    oprot.writeMessageBegin("list_sentry_privileges_by_authorizable", TMessageType.REPLY, seqid)
+    result.write(oprot)
+    oprot.writeMessageEnd()
+    oprot.trans.flush()
+
 
 # HELPER FUNCTIONS AND STRUCTURES
 
@@ -1909,6 +1958,127 @@ class rename_sentry_privilege_result(object):
     return
 
 
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class list_sentry_privileges_by_authorizable_args(object):
+  """
+  Attributes:
+   - request
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.STRUCT, 'request', (TListSentryPrivilegesByAuthRequest, TListSentryPrivilegesByAuthRequest.thrift_spec), None, ), # 1
+  )
+
+  def __init__(self, request=None,):
+    self.request = request
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.STRUCT:
+          self.request = TListSentryPrivilegesByAuthRequest()
+          self.request.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('list_sentry_privileges_by_authorizable_args')
+    if self.request is not None:
+      oprot.writeFieldBegin('request', TType.STRUCT, 1)
+      self.request.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    return
+
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class list_sentry_privileges_by_authorizable_result(object):
+  """
+  Attributes:
+   - success
+  """
+
+  thrift_spec = (
+    (0, TType.STRUCT, 'success', (TListSentryPrivilegesByAuthResponse, TListSentryPrivilegesByAuthResponse.thrift_spec), None, ), # 0
+  )
+
+  def __init__(self, success=None,):
+    self.success = success
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 0:
+        if ftype == TType.STRUCT:
+          self.success = TListSentryPrivilegesByAuthResponse()
+          self.success.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('list_sentry_privileges_by_authorizable_result')
+    if self.success is not None:
+      oprot.writeFieldBegin('success', TType.STRUCT, 0)
+      self.success.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    return
+
+
   def __repr__(self):
     L = ['%s=%r' % (key, value)
       for key, value in self.__dict__.iteritems()]

+ 305 - 16
desktop/libs/libsentry/gen-py/sentry_policy_service/ttypes.py

@@ -46,7 +46,6 @@ class TSentryPrivilege(object):
    - URI
    - action
    - createTime
-   - grantorPrincipal
    - grantOption
   """
 
@@ -60,11 +59,10 @@ class TSentryPrivilege(object):
     (6, TType.STRING, 'URI', None, "", ), # 6
     (7, TType.STRING, 'action', None, "", ), # 7
     (8, TType.I64, 'createTime', None, None, ), # 8
-    (9, TType.STRING, 'grantorPrincipal', None, None, ), # 9
-    (10, TType.I32, 'grantOption', None,     0, ), # 10
+    (9, TType.I32, 'grantOption', None,     0, ), # 9
   )
 
-  def __init__(self, privilegeScope=None, serverName=None, dbName=thrift_spec[4][4], tableName=thrift_spec[5][4], URI=thrift_spec[6][4], action=thrift_spec[7][4], createTime=None, grantorPrincipal=None, grantOption=thrift_spec[10][4],):
+  def __init__(self, privilegeScope=None, serverName=None, dbName=thrift_spec[4][4], tableName=thrift_spec[5][4], URI=thrift_spec[6][4], action=thrift_spec[7][4], createTime=None, grantOption=thrift_spec[9][4],):
     self.privilegeScope = privilegeScope
     self.serverName = serverName
     self.dbName = dbName
@@ -72,7 +70,6 @@ class TSentryPrivilege(object):
     self.URI = URI
     self.action = action
     self.createTime = createTime
-    self.grantorPrincipal = grantorPrincipal
     self.grantOption = grantOption
 
   def read(self, iprot):
@@ -120,11 +117,6 @@ class TSentryPrivilege(object):
         else:
           iprot.skip(ftype)
       elif fid == 9:
-        if ftype == TType.STRING:
-          self.grantorPrincipal = iprot.readString();
-        else:
-          iprot.skip(ftype)
-      elif fid == 10:
         if ftype == TType.I32:
           self.grantOption = iprot.readI32();
         else:
@@ -167,12 +159,8 @@ class TSentryPrivilege(object):
       oprot.writeFieldBegin('createTime', TType.I64, 8)
       oprot.writeI64(self.createTime)
       oprot.writeFieldEnd()
-    if self.grantorPrincipal is not None:
-      oprot.writeFieldBegin('grantorPrincipal', TType.STRING, 9)
-      oprot.writeString(self.grantorPrincipal)
-      oprot.writeFieldEnd()
     if self.grantOption is not None:
-      oprot.writeFieldBegin('grantOption', TType.I32, 10)
+      oprot.writeFieldBegin('grantOption', TType.I32, 9)
       oprot.writeI32(self.grantOption)
       oprot.writeFieldEnd()
     oprot.writeFieldStop()
@@ -1031,15 +1019,18 @@ class TAlterSentryRoleGrantPrivilegeResponse(object):
   """
   Attributes:
    - status
+   - privilege
   """
 
   thrift_spec = (
     None, # 0
     (1, TType.STRUCT, 'status', (sentry_common_service.ttypes.TSentryResponseStatus, sentry_common_service.ttypes.TSentryResponseStatus.thrift_spec), None, ), # 1
+    (2, TType.STRUCT, 'privilege', (TSentryPrivilege, TSentryPrivilege.thrift_spec), None, ), # 2
   )
 
-  def __init__(self, status=None,):
+  def __init__(self, status=None, privilege=None,):
     self.status = status
+    self.privilege = privilege
 
   def read(self, iprot):
     if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
@@ -1056,6 +1047,12 @@ class TAlterSentryRoleGrantPrivilegeResponse(object):
           self.status.read(iprot)
         else:
           iprot.skip(ftype)
+      elif fid == 2:
+        if ftype == TType.STRUCT:
+          self.privilege = TSentryPrivilege()
+          self.privilege.read(iprot)
+        else:
+          iprot.skip(ftype)
       else:
         iprot.skip(ftype)
       iprot.readFieldEnd()
@@ -1070,6 +1067,10 @@ class TAlterSentryRoleGrantPrivilegeResponse(object):
       oprot.writeFieldBegin('status', TType.STRUCT, 1)
       self.status.write(oprot)
       oprot.writeFieldEnd()
+    if self.privilege is not None:
+      oprot.writeFieldBegin('privilege', TType.STRUCT, 2)
+      self.privilege.write(oprot)
+      oprot.writeFieldEnd()
     oprot.writeFieldStop()
     oprot.writeStructEnd()
 
@@ -2409,6 +2410,294 @@ class TListSentryPrivilegesForProviderResponse(object):
     return
 
 
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class TSentryPrivilegeMap(object):
+  """
+  Attributes:
+   - privilegeMap
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.MAP, 'privilegeMap', (TType.STRING,None,TType.SET,(TType.STRUCT,(TSentryPrivilege, TSentryPrivilege.thrift_spec))), None, ), # 1
+  )
+
+  def __init__(self, privilegeMap=None,):
+    self.privilegeMap = privilegeMap
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.MAP:
+          self.privilegeMap = {}
+          (_ktype57, _vtype58, _size56 ) = iprot.readMapBegin() 
+          for _i60 in xrange(_size56):
+            _key61 = iprot.readString();
+            _val62 = set()
+            (_etype66, _size63) = iprot.readSetBegin()
+            for _i67 in xrange(_size63):
+              _elem68 = TSentryPrivilege()
+              _elem68.read(iprot)
+              _val62.add(_elem68)
+            iprot.readSetEnd()
+            self.privilegeMap[_key61] = _val62
+          iprot.readMapEnd()
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('TSentryPrivilegeMap')
+    if self.privilegeMap is not None:
+      oprot.writeFieldBegin('privilegeMap', TType.MAP, 1)
+      oprot.writeMapBegin(TType.STRING, TType.SET, len(self.privilegeMap))
+      for kiter69,viter70 in self.privilegeMap.items():
+        oprot.writeString(kiter69)
+        oprot.writeSetBegin(TType.STRUCT, len(viter70))
+        for iter71 in viter70:
+          iter71.write(oprot)
+        oprot.writeSetEnd()
+      oprot.writeMapEnd()
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    if self.privilegeMap is None:
+      raise TProtocol.TProtocolException(message='Required field privilegeMap is unset!')
+    return
+
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class TListSentryPrivilegesByAuthRequest(object):
+  """
+  Attributes:
+   - protocol_version
+   - authorizableSet
+   - groups
+   - roleSet
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.I32, 'protocol_version', None, 1, ), # 1
+    (2, TType.SET, 'authorizableSet', (TType.STRUCT,(TSentryAuthorizable, TSentryAuthorizable.thrift_spec)), None, ), # 2
+    (3, TType.SET, 'groups', (TType.STRING,None), None, ), # 3
+    (4, TType.STRUCT, 'roleSet', (TSentryActiveRoleSet, TSentryActiveRoleSet.thrift_spec), None, ), # 4
+  )
+
+  def __init__(self, protocol_version=thrift_spec[1][4], authorizableSet=None, groups=None, roleSet=None,):
+    self.protocol_version = protocol_version
+    self.authorizableSet = authorizableSet
+    self.groups = groups
+    self.roleSet = roleSet
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.I32:
+          self.protocol_version = iprot.readI32();
+        else:
+          iprot.skip(ftype)
+      elif fid == 2:
+        if ftype == TType.SET:
+          self.authorizableSet = set()
+          (_etype75, _size72) = iprot.readSetBegin()
+          for _i76 in xrange(_size72):
+            _elem77 = TSentryAuthorizable()
+            _elem77.read(iprot)
+            self.authorizableSet.add(_elem77)
+          iprot.readSetEnd()
+        else:
+          iprot.skip(ftype)
+      elif fid == 3:
+        if ftype == TType.SET:
+          self.groups = set()
+          (_etype81, _size78) = iprot.readSetBegin()
+          for _i82 in xrange(_size78):
+            _elem83 = iprot.readString();
+            self.groups.add(_elem83)
+          iprot.readSetEnd()
+        else:
+          iprot.skip(ftype)
+      elif fid == 4:
+        if ftype == TType.STRUCT:
+          self.roleSet = TSentryActiveRoleSet()
+          self.roleSet.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('TListSentryPrivilegesByAuthRequest')
+    if self.protocol_version is not None:
+      oprot.writeFieldBegin('protocol_version', TType.I32, 1)
+      oprot.writeI32(self.protocol_version)
+      oprot.writeFieldEnd()
+    if self.authorizableSet is not None:
+      oprot.writeFieldBegin('authorizableSet', TType.SET, 2)
+      oprot.writeSetBegin(TType.STRUCT, len(self.authorizableSet))
+      for iter84 in self.authorizableSet:
+        iter84.write(oprot)
+      oprot.writeSetEnd()
+      oprot.writeFieldEnd()
+    if self.groups is not None:
+      oprot.writeFieldBegin('groups', TType.SET, 3)
+      oprot.writeSetBegin(TType.STRING, len(self.groups))
+      for iter85 in self.groups:
+        oprot.writeString(iter85)
+      oprot.writeSetEnd()
+      oprot.writeFieldEnd()
+    if self.roleSet is not None:
+      oprot.writeFieldBegin('roleSet', TType.STRUCT, 4)
+      self.roleSet.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    if self.protocol_version is None:
+      raise TProtocol.TProtocolException(message='Required field protocol_version is unset!')
+    if self.authorizableSet is None:
+      raise TProtocol.TProtocolException(message='Required field authorizableSet is unset!')
+    return
+
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class TListSentryPrivilegesByAuthResponse(object):
+  """
+  Attributes:
+   - status
+   - privilegesMapByAuth
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.STRUCT, 'status', (sentry_common_service.ttypes.TSentryResponseStatus, sentry_common_service.ttypes.TSentryResponseStatus.thrift_spec), None, ), # 1
+    (2, TType.MAP, 'privilegesMapByAuth', (TType.STRUCT,(TSentryAuthorizable, TSentryAuthorizable.thrift_spec),TType.STRUCT,(TSentryPrivilegeMap, TSentryPrivilegeMap.thrift_spec)), None, ), # 2
+  )
+
+  def __init__(self, status=None, privilegesMapByAuth=None,):
+    self.status = status
+    self.privilegesMapByAuth = privilegesMapByAuth
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.STRUCT:
+          self.status = sentry_common_service.ttypes.TSentryResponseStatus()
+          self.status.read(iprot)
+        else:
+          iprot.skip(ftype)
+      elif fid == 2:
+        if ftype == TType.MAP:
+          self.privilegesMapByAuth = {}
+          (_ktype87, _vtype88, _size86 ) = iprot.readMapBegin() 
+          for _i90 in xrange(_size86):
+            _key91 = TSentryAuthorizable()
+            _key91.read(iprot)
+            _val92 = TSentryPrivilegeMap()
+            _val92.read(iprot)
+            self.privilegesMapByAuth[_key91] = _val92
+          iprot.readMapEnd()
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('TListSentryPrivilegesByAuthResponse')
+    if self.status is not None:
+      oprot.writeFieldBegin('status', TType.STRUCT, 1)
+      self.status.write(oprot)
+      oprot.writeFieldEnd()
+    if self.privilegesMapByAuth is not None:
+      oprot.writeFieldBegin('privilegesMapByAuth', TType.MAP, 2)
+      oprot.writeMapBegin(TType.STRUCT, TType.STRUCT, len(self.privilegesMapByAuth))
+      for kiter93,viter94 in self.privilegesMapByAuth.items():
+        kiter93.write(oprot)
+        viter94.write(oprot)
+      oprot.writeMapEnd()
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    if self.status is None:
+      raise TProtocol.TProtocolException(message='Required field status is unset!')
+    if self.privilegesMapByAuth is None:
+      raise TProtocol.TProtocolException(message='Required field privilegesMapByAuth is unset!')
+    return
+
+
   def __repr__(self):
     L = ['%s=%r' % (key, value)
       for key, value in self.__dict__.iteritems()]

+ 21 - 3
desktop/libs/libsentry/thrift/sentry_policy_service.thrift

@@ -48,8 +48,7 @@ struct TSentryPrivilege {
 6: optional string URI = "",
 7: required string action = "",
 8: optional i64 createTime, # Set on server side
-9: optional string grantorPrincipal, # Set on server side
-10: optional TSentryGrantOption grantOption = TSentryGrantOption.FALSE
+9: optional TSentryGrantOption grantOption = TSentryGrantOption.FALSE
 }
 
 # TODO can this be deleted? it's not adding value to TAlterSentryRoleAddGroupsRequest
@@ -109,6 +108,7 @@ struct TAlterSentryRoleGrantPrivilegeRequest {
 }
 struct TAlterSentryRoleGrantPrivilegeResponse {
 1: required sentry_common_service.TSentryResponseStatus status
+2: optional TSentryPrivilege privilege
 }
 
 # REVOKE ... ON ... FROM ROLE ...
@@ -132,7 +132,7 @@ struct TListSentryRolesRequest {
 struct TSentryRole {
 1: required string roleName,
 2: required set<TSentryGroup> groups,
-3: required string grantorPrincipal
+3: required string grantorPrincipal #Deprecated
 }
 struct TListSentryRolesResponse {
 1: required sentry_common_service.TSentryResponseStatus status
@@ -199,6 +199,22 @@ struct TListSentryPrivilegesForProviderResponse {
 2: required set<string> privileges
 }
 
+# List role:set<privileges> for the given authorizable
+# Optionally use the set of groups to filter the roles
+struct TSentryPrivilegeMap {
+1: required map<string, set<TSentryPrivilege>> privilegeMap
+}
+struct TListSentryPrivilegesByAuthRequest {
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
+2: required set<TSentryAuthorizable> authorizableSet,
+3: optional set<string> groups,
+4: optional TSentryActiveRoleSet roleSet
+}
+struct TListSentryPrivilegesByAuthResponse {
+1: required sentry_common_service.TSentryResponseStatus status,
+2: required map<TSentryAuthorizable, TSentryPrivilegeMap> privilegesMapByAuth
+}
+
 service SentryPolicyService
 {
   TCreateSentryRoleResponse create_sentry_role(1:TCreateSentryRoleRequest request)
@@ -220,4 +236,6 @@ service SentryPolicyService
  TDropPrivilegesResponse drop_sentry_privilege(1:TDropPrivilegesRequest request);
 
  TRenamePrivilegesResponse rename_sentry_privilege(1:TRenamePrivilegesRequest request);
+
+ TListSentryPrivilegesByAuthResponse list_sentry_privileges_by_authorizable(1:TListSentryPrivilegesByAuthRequest request);
 }