Browse Source

HUE-5275 [libsentry] Add optional key function aren, refactor tests by scenario

Jenny Kim 9 years ago
parent
commit
333537398e

+ 36 - 17
desktop/libs/libsentry/src/libsentry/privilege_checker.py

@@ -60,7 +60,7 @@ class PrivilegeChecker(object):
     self.api_v2 = api_v2 if api_v2 else get_api_v2(self.user, component='solr')
     self.api_v2 = api_v2 if api_v2 else get_api_v2(self.user, component='solr')
 
 
 
 
-  def filter_objects(self, authorizableSet, action='READ'):
+  def filter_objects(self, authorizableSet, action='READ', key=None):
     """
     """
     Given a set of authorizable Sentry objects and a requested action, return a filtered set of objects that the user
     Given a set of authorizable Sentry objects and a requested action, return a filtered set of objects that the user
     has privileges to perform the given action upon.
     has privileges to perform the given action upon.
@@ -68,21 +68,20 @@ class PrivilegeChecker(object):
       V1 - {'column': 'total_emp', 'table': 'sample_08', 'db': 'default', 'server': 'server1', 'URI': None}
       V1 - {'column': 'total_emp', 'table': 'sample_08', 'db': 'default', 'server': 'server1', 'URI': None}
       V2 - {'component': 'solr', 'serviceName': 'server1', 'type': 'COLLECTION', 'name': 'twitter_demo', 'URI': None}
       V2 - {'component': 'solr', 'serviceName': 'server1', 'type': 'COLLECTION', 'name': 'twitter_demo', 'URI': None}
     :param action: requested action-level that we should check privileges against (default: READ)
     :param action: requested action-level that we should check privileges against (default: READ)
+    :param key: a function that will be applied to each object in the authorizableSet to convert it to a Sentry format
     """
     """
     action = action.upper()
     action = action.upper()
     filtered_objects = []
     filtered_objects = []
-    privileges = []
+
+    # Apply Sentry formatting key function
+    authorizableSet = self._to_sentry_authorizables(objects=authorizableSet, key=key)
 
 
     # Separate V1 (Hive) and V2 (Solr) authorizable objects
     # Separate V1 (Hive) and V2 (Solr) authorizable objects
     v1_authorizables = [obj for obj in authorizableSet if 'db' in obj]
     v1_authorizables = [obj for obj in authorizableSet if 'db' in obj]
     v2_authorizables = [obj for obj in authorizableSet if 'component' in obj]
     v2_authorizables = [obj for obj in authorizableSet if 'component' in obj]
 
 
     if v1_authorizables:
     if v1_authorizables:
-      user_roles = self.api_v1.list_sentry_roles_by_group('*')  # Get all roles for user
-      for role in user_roles:
-        role_privileges = self.api_v1.list_sentry_privileges_by_role(role['name'])
-        privileges.extend(role_privileges)  # This may result in duplicates but will get reduced in hierarchy tree
-
+      privileges = self._get_privileges_for_user(self.api_v1)
       privilege_hierarchy = self._to_privilege_hierarchy_v1(privileges)
       privilege_hierarchy = self._to_privilege_hierarchy_v1(privileges)
 
 
       for authorizable in v1_authorizables:
       for authorizable in v1_authorizables:
@@ -90,21 +89,41 @@ class PrivilegeChecker(object):
           filtered_objects.append(authorizable)
           filtered_objects.append(authorizable)
 
 
     if v2_authorizables:
     if v2_authorizables:
-      privileges = []
-      user_roles = self.api_v2.list_sentry_roles_by_group('*')  # Get all roles for user
-      for role in user_roles:
-        role_privileges = self.api_v2.list_sentry_privileges_by_role(role['name'])
-        privileges.extend(role_privileges)
-
-        privilege_hierarchy = self._to_privilege_hierarchy_v2(privileges)
+      privileges = self._get_privileges_for_user(self.api_v2)
+      privilege_hierarchy = self._to_privilege_hierarchy_v2(privileges)
 
 
-        for authorizable in v2_authorizables:
-          if self._is_object_action_authorized_v2(hierarchy=privilege_hierarchy, object=authorizable, action=action):
-            filtered_objects.append(authorizable)
+      for authorizable in v2_authorizables:
+        if self._is_object_action_authorized_v2(hierarchy=privilege_hierarchy, object=authorizable, action=action):
+          filtered_objects.append(authorizable)
 
 
     return filtered_objects
     return filtered_objects
 
 
 
 
+  def _to_sentry_authorizables(self, objects, key=None):
+
+    def add_default_server(object):
+      if 'db' in object and not object.get('server'):  # V1
+        object.update({'server': 'server1'})
+      elif 'component' in object and not object.get('serviceName'):  # V2
+        object.update({'serviceName': 'server1'})
+      return object
+
+    if key:
+      objects = [key(obj) for obj in objects]
+
+    objects = [add_default_server(obj) for obj in objects]
+    return objects
+
+
+  def _get_privileges_for_user(self, api):
+    privileges = []
+    user_roles = api.list_sentry_roles_by_group('*')  # Get all roles for user
+    for role in user_roles:
+      role_privileges = api.list_sentry_privileges_by_role(role['name'])
+      privileges.extend(role_privileges)  # This may result in duplicates but will get reduced in hierarchy tree
+    return privileges
+
+
   def _to_privilege_hierarchy_v1(self, privileges):
   def _to_privilege_hierarchy_v1(self, privileges):
     """
     """
     Converts a list of privileges to a hierarchical tree of privileges by object, where the privilege is stored into a
     Converts a list of privileges to a hierarchical tree of privileges by object, where the privilege is stored into a

+ 152 - 119
desktop/libs/libsentry/src/libsentry/test_privilege_checker.py

@@ -17,163 +17,196 @@
 # limitations under the License.
 # limitations under the License.
 
 
 from django.contrib.auth.models import User
 from django.contrib.auth.models import User
-from nose.plugins.skip import SkipTest
 from nose.tools import assert_equal, assert_false, assert_true
 from nose.tools import assert_equal, assert_false, assert_true
 
 
 from desktop.lib.django_test_util import make_logged_in_client
 from desktop.lib.django_test_util import make_logged_in_client
 from desktop.lib.test_utils import grant_access
 from desktop.lib.test_utils import grant_access
 
 
-from libsentry.api import get_api as get_api_v1
-from libsentry.api2 import get_api as get_api_v2
 from libsentry.privilege_checker import PrivilegeChecker
 from libsentry.privilege_checker import PrivilegeChecker
 
 
 
 
-class TestDocumentConverter(object):
+class MockSentryApiV1(object):
+
+
+  def __init__(self, *args, **kwargs):
+    pass
+
+
+  def list_sentry_roles_by_group(self, *args, **kwargs):
+    return [{'name': 'test', 'group': 'test'}]
+
+
+  def list_sentry_privileges_by_role(self, *args, **kwargs):
+    return [
+      # Column ALL
+      {'column': 'column_all', 'grantOption': False, 'timestamp': 1478810635396, 'database': 'default', 'action': 'ALL', 'scope': 'COLUMN', 'table': 'test_column', 'URI': '', 'server': 'server1'},
+      # Column INSERT
+      {'column': 'column_insert', 'grantOption': False, 'timestamp': 1478810635378, 'database': 'default', 'action': 'INSERT', 'scope': 'COLUMN', 'table': 'test_column', 'URI': '', 'server': 'server1'},
+      # Column SELECT
+      {'column': 'column_select', 'grantOption': False, 'timestamp': 1478810590335, 'database': 'default', 'action': 'SELECT', 'scope': 'TABLE', 'table': 'test_column', 'URI': '', 'server': 'server1'},
+      # Table ALL
+      {'column': '', 'grantOption': False, 'timestamp': 1478810513849, 'database': 'default', 'action': 'SELECT', 'scope': 'TABLE', 'table': 'test_table_all', 'URI': '', 'server': 'server1'},
+      # Table INSERT
+      {'column': '', 'grantOption': False, 'timestamp': 1478810513849, 'database': 'default', 'action': 'INSERT', 'scope': 'TABLE', 'table': 'test_table_insert', 'URI': '', 'server': 'server1'},
+      # Table SELECT
+      {'column': '', 'grantOption': False, 'timestamp': 1478810422058, 'database': 'default', 'action': 'SELECT', 'scope': 'TABLE', 'table': 'test_table_select', 'URI': '', 'server': 'server1'},
+      # DB ALL
+      {'column': '', 'grantOption': False, 'timestamp': 1478810513849, 'database': 'test_db_all', 'action': 'ALL', 'scope': 'DATABASE', 'table': '', 'URI': '', 'server': 'server1'},
+      # DB INSERT
+      {'column': '', 'grantOption': False, 'timestamp': 1478810513849, 'database': 'test_db_insert', 'action': 'INSERT', 'scope': 'DATABASE', 'table': '', 'URI': '', 'server': 'server1'},
+      # DB SELECT
+      {'column': '', 'grantOption': False, 'timestamp': 1478810513849, 'database': 'test_db_select', 'action': 'SELECT', 'scope': 'DATABASE', 'table': '', 'URI': '', 'server': 'server1'},
+      # URI ALL
+      {'column': '', 'grantOption': False, 'timestamp': 1478810513849, 'database': '', 'action': 'ALL', 'scope': 'URI', 'table': '', 'URI': 'hdfs://ha-nn-uri/data/landing-skid', 'server': 'server1'},
+    ]
+
+
+class MockSentryApiV2(object):
+
+
+  def __init__(self, *args, **kwargs):
+    pass
+
+
+  def list_sentry_roles_by_group(self, *args, **kwargs):
+    return [{'name': 'test', 'group': 'test'}]
+
+
+  def list_sentry_privileges_by_role(self, *args, **kwargs):
+    return [
+      # Collection ALL
+      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'ALL', 'authorizables': [{'type': 'COLLECTION', 'name': 'web_logs_demo'}]},
+      # Collection UPDATE
+      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'UPDATE', 'authorizables': [{'type': 'COLLECTION', 'name': 'yelp_demo'}]},
+      # Collection QUERY
+      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'QUERY', 'authorizables': [{'type': 'COLLECTION', 'name': 'twitter_demo'}]},
+      # Config ALL
+      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'ALL', 'authorizables': [{'type': 'CONFIG', 'name': 'yelp_demo'}]},
+      # URI ALL
+      {'grantOption': False, 'timestamp': None, 'component': 'hdfs', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'ALL', 'authorizables': [{'type': 'URI', 'name': 'hdfs://ha-nn-uri/data/landing-skid'}]},
+      # S3 URI ALL
+      {'grantOption': False, 'timestamp': None, 'component': 'hdfs', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'ALL', 'authorizables': [{'type': 'URI', 'name': 's3a://hue-datasets/test'}]},
+    ]
+
+
+class TestPrivilegeChecker(object):
+
 
 
   def setUp(self):
   def setUp(self):
     self.client = make_logged_in_client(username="test", groupname="test", recreate=True, is_superuser=False)
     self.client = make_logged_in_client(username="test", groupname="test", recreate=True, is_superuser=False)
     self.user = User.objects.get(username="test")
     self.user = User.objects.get(username="test")
     grant_access("test", "test", "libsentry")
     grant_access("test", "test", "libsentry")
 
 
-    self.api_v1 = get_api_v1(self.user)
-    self.api_v2 = get_api_v2(self.user, component='solr')
+    self.api_v1 = MockSentryApiV1()
+    self.api_v2 = MockSentryApiV2()
     self.checker = PrivilegeChecker(user=self.user, api_v1=self.api_v1, api_v2=self.api_v2)
     self.checker = PrivilegeChecker(user=self.user, api_v1=self.api_v1, api_v2=self.api_v2)
 
 
 
 
-  def test_read_privilege(self):
-    try:
-      from mock import Mock
-    except ImportError:
-      raise SkipTest("Skips until HUE-2947 is resolved")
+  def test_to_sentry_authorizables(self):
+    authorizableSet = ['foo', 'bar', 'baz']
+    expectedSet = [
+      {'db': 'foo', 'server': 'server1'},
+      {'db': 'bar', 'server': 'server1'},
+      {'db': 'baz', 'server': 'server1'},
+    ]
+    updatedSet = self.checker._to_sentry_authorizables(objects=authorizableSet, key=lambda x: {'db': x})
+    assert_equal(expectedSet, updatedSet, updatedSet)
+
 
 
-    action = 'READ'
+  def test_columns_select(self):
+    action = 'SELECT'
     authorizableSet = [
     authorizableSet = [
-      # V1 authorizables
-      {u'column': None, u'table': u'customers', u'db': u'default', u'server': u'server1'},
-      {u'column': None, u'table': u'sample_07', u'db': u'default', u'server': u'server1'},
-      {u'column': None, u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': None, u'table': u'web_logs', u'db': u'default', u'server': u'server1'},
-      {u'column': 'salary', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': 'code', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': 'total_emp', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': 'total_emp', u'table': u'sample_07', u'db': u'default', u'server': u'server1'},
-      {u'column': None, u'table': None, u'db': None, u'server': u'server1', u'URI': u'hdfs://ha-nn-uri/data/landing-skid'},
-      {u'column': None, u'table': None, u'db': None, u'server': u'server1', u'URI': u'file:///path/to/nfs/local/to/nfs'},
-      # V2 authorizables
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'logs_demo'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'test_demo'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'twitter_demo'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'yelp_demo'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'CONFIG', u'name': u'twitter_demo'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'CONFIG', u'name': u'managedTemplate'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'CONFIG', u'name': u'yelp_demo'},
-      {u'component': u'hdfs', u'serviceName': u'server1', u'type': u'URI', u'name': u'hdfs://ha-nn-uri/data/landing-skid'},
-      {u'component': u'nfs', u'serviceName': u'server1', u'type': u'URI', u'name': u'file:///path/to/nfs/local/to/nfs'},
+      # column-level SELECT privilege exists
+      {u'column': 'column_select', u'table': u'test_column', u'db': u'default', u'server': u'server1'},
+      # table-level SELECT privileges exists
+      {u'column': 'id', u'table': u'test_table_select', u'db': u'default', u'server': u'server1'},
+      # db-level SELECT privileges exist
+      {u'column': 'id', u'table': u'test_db_select', u'db': u'test_db_select', u'server': u'server1'},
+      # no privileges exist
+      {u'column': 'id', u'table': u'test_none', u'db': u'default', u'server': u'server1'},
     ]
     ]
 
 
-    self.api_v1.list_sentry_roles_by_group = Mock(return_value=[{'name': 'test', 'group': 'test'}])
-    self.api_v1.list_sentry_privileges_by_role = Mock(return_value=[
-      {'column': 'total_emp', 'grantOption': False, 'timestamp': 1478810635378, 'database': 'default', 'action': 'INSERT', 'scope': 'COLUMN', 'table': 'sample_08', 'URI': '', 'server': 'server1'},
-      {'column': '', 'grantOption': False, 'timestamp': 1478810422058, 'database': 'default', 'action': 'SELECT', 'scope': 'TABLE', 'table': 'customers', 'URI': '', 'server': 'server1'},
-      {'column': '', 'grantOption': False, 'timestamp': 1478810513849, 'database': 'default', 'action': 'SELECT', 'scope': 'TABLE', 'table': 'web_logs', 'URI': '', 'server': 'server1'},
-      {'column': '', 'grantOption': False, 'timestamp': 1478810590335, 'database': 'default', 'action': 'SELECT', 'scope': 'TABLE', 'table': 'sample_08', 'URI': '', 'server': 'server1'},
-      {'column': 'salary', 'grantOption': False, 'timestamp': 1478810635396, 'database': 'default', 'action': 'ALL', 'scope': 'COLUMN', 'table': 'sample_08', 'URI': '', 'server': 'server1'},
-      {'column': '', 'grantOption': False, 'timestamp': 1478810513849, 'database': '', 'action': 'ALL', 'scope': 'URI', 'table': '', 'URI': 'hdfs://ha-nn-uri/data/landing-skid', 'server': 'server1'},
-    ])
+    filtered_set = self.checker.filter_objects(authorizableSet=authorizableSet, action=action)
+    expected_filtered_set = [
+      {u'column': 'column_select', u'table': u'test_column', u'db': u'default', u'server': u'server1'},
+     {u'column': 'id', u'table': u'test_table_select', u'db': u'default', u'server': u'server1'},
+     {u'column': 'id', u'table': u'test_db_select', u'db': u'test_db_select', u'server': u'server1'}
+    ]
 
 
-    self.api_v2.list_sentry_roles_by_group = Mock(return_value=[{'name': 'test', 'group': 'test'}])
-    self.api_v2.list_sentry_privileges_by_role = Mock(return_value=[
-      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'ALL', 'authorizables': [{'type': 'CONFIG', 'name': 'managedTemplate'}]},
-      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'QUERY', 'authorizables': [{'type': 'COLLECTION', 'name': 'twitter_demo'}]},
-      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'UPDATE', 'authorizables': [{'type': 'COLLECTION', 'name': 'yelp_demo'}]},
-      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'ALL', 'authorizables': [{'type': 'CONFIG', 'name': 'yelp_demo'}]},
-      {'grantOption': False, 'timestamp': None, 'component': 'hdfs', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'ALL', 'authorizables': [{'type': 'URI', 'name': 'hdfs://ha-nn-uri/data/landing-skid'}]},
-    ])
+    sort_keys = ['server', 'db', 'table', 'column', 'URI']
+    assert_equal(expected_filtered_set, sorted(filtered_set, key=lambda obj: ([obj.get(key) for key in sort_keys])))
+
+
+  def test_columns_insert(self):
+    action = 'INSERT'
+    authorizableSet = [
+      # column-level ALL privilege exists
+      {u'column': 'column_all', u'table': u'test_column', u'db': u'default', u'server': u'server1'},
+      # column-level INSERT privileges exist
+      {u'column': 'column_insert', u'table': u'test_column', u'db': u'default', u'server': u'server1'},
+      # SELECT, but not INSERT, privilege exists
+      {u'column': 'column_select', u'table': u'test_column', u'db': u'default', u'server': u'server1'},
+      # no privileges exist
+      {u'column': 'salary', u'table': u'sample_07', u'db': u'default', u'server': u'server1'},
+    ]
 
 
     filtered_set = self.checker.filter_objects(authorizableSet=authorizableSet, action=action)
     filtered_set = self.checker.filter_objects(authorizableSet=authorizableSet, action=action)
     expected_filtered_set = [
     expected_filtered_set = [
-      # V2 authorizables
-      {u'type': u'URI', u'serviceName': u'server1', u'component': u'hdfs', u'name': u'hdfs://ha-nn-uri/data/landing-skid'},
-      {u'type': u'COLLECTION', u'serviceName': u'server1', u'component': u'solr', u'name': u'twitter_demo'},
-      {u'type': u'COLLECTION', u'serviceName': u'server1', u'component': u'solr', u'name': u'yelp_demo'},
-      {u'type': u'CONFIG', u'serviceName': u'server1', u'component': u'solr', u'name': u'managedTemplate'},
-      {u'type': u'CONFIG', u'serviceName': u'server1', u'component': u'solr', u'name': u'yelp_demo'},
-      # V1 authorizables
-      {u'column': None, u'table': None, u'db': None, u'server': u'server1', u'URI': u'hdfs://ha-nn-uri/data/landing-skid'},
-      {u'column': None, u'table': u'customers', u'db': u'default', u'server': u'server1'},
-      {u'column': None, u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': 'code', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': 'salary', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': 'total_emp', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': None, u'table': u'web_logs', u'db': u'default', u'server': u'server1'},
+      {u'column': 'column_all', u'table': u'test_column', u'db': u'default', u'server': u'server1'},
+      {u'column': 'column_insert', u'table': u'test_column', u'db': u'default', u'server': u'server1'},
     ]
     ]
 
 
-    sort_keys = ['server', 'db', 'table', 'column', 'URI', 'serviceName', 'component', 'type', 'name']
+    sort_keys = ['server', 'db', 'table', 'column', 'URI']
     assert_equal(expected_filtered_set, sorted(filtered_set, key=lambda obj: ([obj.get(key) for key in sort_keys])))
     assert_equal(expected_filtered_set, sorted(filtered_set, key=lambda obj: ([obj.get(key) for key in sort_keys])))
 
 
 
 
-  def test_write_privilege(self):
-    try:
-      from mock import Mock
-    except ImportError:
-      raise SkipTest("Skips until HUE-2947 is resolved")
+  def test_tables_select(self):
+    pass
 
 
-    action = 'WRITE'
+
+  def test_tables_insert(self):
+    pass
+
+
+  def test_dbs_select(self):
+    pass
+
+
+  def test_dbs_insert(self):
+    pass
+
+
+  def test_collections_query(self):
+    action = 'QUERY'
     authorizableSet = [
     authorizableSet = [
-      # V1 authorizables
-      {u'column': None, u'table': u'customers', u'db': u'default', u'server': u'server1'},
-      {u'column': None, u'table': u'sample_07', u'db': u'default', u'server': u'server1'},
-      {u'column': None, u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': None, u'table': u'web_logs', u'db': u'default', u'server': u'server1'},
-      {u'column': 'salary', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': 'code', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': 'total_emp', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': 'total_emp', u'table': u'sample_07', u'db': u'default', u'server': u'server1'},
-      {u'column': None, u'table': None, u'db': None, u'server': u'server1', u'URI': u'hdfs://ha-nn-uri/data/landing-skid'},
-      {u'column': None, u'table': None, u'db': None, u'server': u'server1', u'URI': u'file:///path/to/nfs/local/to/nfs'},
-      # V2 authorizables
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'logs_demo'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'test_demo'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'twitter_demo'},
+      # ALL privilege
+      {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'web_logs_demo'},
+      # UPDATE privilege
       {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'yelp_demo'},
       {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'yelp_demo'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'CONFIG', u'name': u'twitter_demo'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'CONFIG', u'name': u'managedTemplate'},
-      {u'component': u'solr', u'serviceName': u'server1', u'type': u'CONFIG', u'name': u'yelp_demo'},
-      {u'component': u'hdfs', u'serviceName': u'server1', u'type': u'URI', u'name': u'hdfs://ha-nn-uri/data/landing-skid'},
-      {u'component': u'nfs', u'serviceName': u'server1', u'type': u'URI', u'name': u'file:///path/to/nfs/local/to/nfs'},
+      # QUERY privilege
+      {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'twitter_demo'},
+      # No privilege
+      {u'component': u'solr', u'serviceName': u'server1', u'type': u'COLLECTION', u'name': u'test_demo'},
     ]
     ]
 
 
-    self.api_v1.list_sentry_roles_by_group = Mock(return_value=[{'name': 'test', 'group': 'test'}])
-    self.api_v1.list_sentry_privileges_by_role = Mock(return_value=[
-      {'column': 'total_emp', 'grantOption': False, 'timestamp': 1478810635378, 'database': 'default', 'action': 'INSERT', 'scope': 'COLUMN', 'table': 'sample_08', 'URI': '', 'server': 'server1'},
-      {'column': '', 'grantOption': False, 'timestamp': 1478810422058, 'database': 'default', 'action': 'SELECT', 'scope': 'TABLE', 'table': 'customers', 'URI': '', 'server': 'server1'},
-      {'column': '', 'grantOption': False, 'timestamp': 1478810513849, 'database': 'default', 'action': 'SELECT', 'scope': 'TABLE', 'table': 'web_logs', 'URI': '', 'server': 'server1'},
-      {'column': '', 'grantOption': False, 'timestamp': 1478810590335, 'database': 'default', 'action': 'SELECT', 'scope': 'TABLE', 'table': 'sample_08', 'URI': '', 'server': 'server1'},
-      {'column': 'salary', 'grantOption': False, 'timestamp': 1478810635396, 'database': 'default', 'action': 'ALL', 'scope': 'COLUMN', 'table': 'sample_08', 'URI': '', 'server': 'server1'},
-      {'column': '', 'grantOption': False, 'timestamp': 1478810513849, 'database': '', 'action': 'ALL', 'scope': 'URI', 'table': '', 'URI': 'hdfs://ha-nn-uri/data/landing-skid', 'server': 'server1'},
-    ])
-
-    self.api_v2.list_sentry_roles_by_group = Mock(return_value=[{'name': 'test', 'group': 'test'}])
-    self.api_v2.list_sentry_privileges_by_role = Mock(return_value=[
-      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'ALL', 'authorizables': [{'type': 'CONFIG', 'name': 'managedTemplate'}]},
-      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'QUERY', 'authorizables': [{'type': 'COLLECTION', 'name': 'twitter_demo'}]},
-      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'UPDATE', 'authorizables': [{'type': 'COLLECTION', 'name': 'yelp_demo'}]},
-      {'grantOption': False, 'timestamp': None, 'component': 'solr', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'ALL', 'authorizables': [{'type': 'CONFIG', 'name': 'yelp_demo'}]},
-      {'grantOption': False, 'timestamp': None, 'component': 'hdfs', 'serviceName': 'server1', 'grantorPrincipal': None, 'action': 'ALL', 'authorizables': [{'type': 'URI', 'name': 'hdfs://ha-nn-uri/data/landing-skid'}]},
-    ])
-
     filtered_set = self.checker.filter_objects(authorizableSet=authorizableSet, action=action)
     filtered_set = self.checker.filter_objects(authorizableSet=authorizableSet, action=action)
     expected_filtered_set = [
     expected_filtered_set = [
-      # V2 authorizables
-      {u'type': u'URI', u'serviceName': u'server1', u'component': u'hdfs', u'name': u'hdfs://ha-nn-uri/data/landing-skid'},
-      {u'type': u'COLLECTION', u'serviceName': u'server1', u'component': u'solr', u'name': u'yelp_demo'},
-      {u'type': u'CONFIG', u'serviceName': u'server1', u'component': u'solr', u'name': u'managedTemplate'},
-      {u'type': u'CONFIG', u'serviceName': u'server1', u'component': u'solr', u'name': u'yelp_demo'},
-      # V1 authorizables
-      {u'column': None, u'table': None, u'db': None, u'server': u'server1', u'URI': u'hdfs://ha-nn-uri/data/landing-skid'},
-      {u'column': 'salary', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
-      {u'column': 'total_emp', u'table': u'sample_08', u'db': u'default', u'server': u'server1'},
+      {u'type': u'COLLECTION', u'serviceName': u'server1', u'component': u'solr', u'name': u'twitter_demo'},
+      {u'type': u'COLLECTION', u'serviceName': u'server1', u'component': u'solr', u'name': u'web_logs_demo'},
+      {u'type': u'COLLECTION', u'serviceName': u'server1', u'component': u'solr', u'name': u'yelp_demo'}
     ]
     ]
 
 
     sort_keys = ['server', 'db', 'table', 'column', 'URI', 'serviceName', 'component', 'type', 'name']
     sort_keys = ['server', 'db', 'table', 'column', 'URI', 'serviceName', 'component', 'type', 'name']
     assert_equal(expected_filtered_set, sorted(filtered_set, key=lambda obj: ([obj.get(key) for key in sort_keys])), sorted(filtered_set, key=lambda obj: ([obj.get(key) for key in sort_keys])))
     assert_equal(expected_filtered_set, sorted(filtered_set, key=lambda obj: ([obj.get(key) for key in sort_keys])), sorted(filtered_set, key=lambda obj: ([obj.get(key) for key in sort_keys])))
+
+
+  def test_collections_update(self):
+    pass
+
+
+  def test_config(self):
+    pass
+
+
+  def test_uri(self):
+    pass