Quellcode durchsuchen

HUE-3667 [libsentry] Update thrift API to support SENTRY-993

Romain Rigaux vor 9 Jahren
Ursprung
Commit
a812c79

+ 7 - 0
desktop/libs/libsentry/gen-py/sentry_generic_policy_service/SentryGenericPolicyService-remote

@@ -33,6 +33,7 @@ if len(sys.argv) <= 1 or sys.argv[1] == '--help':
   print('  TListSentryRolesResponse list_sentry_roles_by_group(TListSentryRolesRequest request)')
   print('  TListSentryPrivilegesResponse list_sentry_privileges_by_role(TListSentryPrivilegesRequest request)')
   print('  TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(TListSentryPrivilegesForProviderRequest request)')
+  print('  TListSentryPrivilegesByAuthResponse list_sentry_privileges_by_authorizable(TListSentryPrivilegesByAuthRequest request)')
   print('  TDropPrivilegesResponse drop_sentry_privilege(TDropPrivilegesRequest request)')
   print('  TRenamePrivilegesResponse rename_sentry_privilege(TRenamePrivilegesRequest request)')
   print('')
@@ -145,6 +146,12 @@ elif cmd == 'list_sentry_privileges_for_provider':
     sys.exit(1)
   pp.pprint(client.list_sentry_privileges_for_provider(eval(args[0]),))
 
+elif cmd == 'list_sentry_privileges_by_authorizable':
+  if len(args) != 1:
+    print('list_sentry_privileges_by_authorizable requires 1 args')
+    sys.exit(1)
+  pp.pprint(client.list_sentry_privileges_by_authorizable(eval(args[0]),))
+
 elif cmd == 'drop_sentry_privilege':
   if len(args) != 1:
     print('drop_sentry_privilege requires 1 args')

+ 189 - 0
desktop/libs/libsentry/gen-py/sentry_generic_policy_service/SentryGenericPolicyService.py

@@ -82,6 +82,13 @@ class Iface(object):
     """
     pass
 
+  def list_sentry_privileges_by_authorizable(self, request):
+    """
+    Parameters:
+     - request
+    """
+    pass
+
   def drop_sentry_privilege(self, request):
     """
     Parameters:
@@ -383,6 +390,37 @@ class Client(Iface):
       return result.success
     raise TApplicationException(TApplicationException.MISSING_RESULT, "list_sentry_privileges_for_provider failed: unknown result")
 
+  def list_sentry_privileges_by_authorizable(self, request):
+    """
+    Parameters:
+     - request
+    """
+    self.send_list_sentry_privileges_by_authorizable(request)
+    return self.recv_list_sentry_privileges_by_authorizable()
+
+  def send_list_sentry_privileges_by_authorizable(self, request):
+    self._oprot.writeMessageBegin('list_sentry_privileges_by_authorizable', TMessageType.CALL, self._seqid)
+    args = list_sentry_privileges_by_authorizable_args()
+    args.request = request
+    args.write(self._oprot)
+    self._oprot.writeMessageEnd()
+    self._oprot.trans.flush()
+
+  def recv_list_sentry_privileges_by_authorizable(self):
+    iprot = self._iprot
+    (fname, mtype, rseqid) = iprot.readMessageBegin()
+    if mtype == TMessageType.EXCEPTION:
+      x = TApplicationException()
+      x.read(iprot)
+      iprot.readMessageEnd()
+      raise x
+    result = list_sentry_privileges_by_authorizable_result()
+    result.read(iprot)
+    iprot.readMessageEnd()
+    if result.success is not None:
+      return result.success
+    raise TApplicationException(TApplicationException.MISSING_RESULT, "list_sentry_privileges_by_authorizable failed: unknown result")
+
   def drop_sentry_privilege(self, request):
     """
     Parameters:
@@ -459,6 +497,7 @@ class Processor(Iface, TProcessor):
     self._processMap["list_sentry_roles_by_group"] = Processor.process_list_sentry_roles_by_group
     self._processMap["list_sentry_privileges_by_role"] = Processor.process_list_sentry_privileges_by_role
     self._processMap["list_sentry_privileges_for_provider"] = Processor.process_list_sentry_privileges_for_provider
+    self._processMap["list_sentry_privileges_by_authorizable"] = Processor.process_list_sentry_privileges_by_authorizable
     self._processMap["drop_sentry_privilege"] = Processor.process_drop_sentry_privilege
     self._processMap["rename_sentry_privilege"] = Processor.process_rename_sentry_privilege
 
@@ -648,6 +687,25 @@ class Processor(Iface, TProcessor):
     oprot.writeMessageEnd()
     oprot.trans.flush()
 
+  def process_list_sentry_privileges_by_authorizable(self, seqid, iprot, oprot):
+    args = list_sentry_privileges_by_authorizable_args()
+    args.read(iprot)
+    iprot.readMessageEnd()
+    result = list_sentry_privileges_by_authorizable_result()
+    try:
+      result.success = self._handler.list_sentry_privileges_by_authorizable(args.request)
+      msg_type = TMessageType.REPLY
+    except (TTransport.TTransportException, KeyboardInterrupt, SystemExit):
+      raise
+    except Exception as ex:
+      msg_type = TMessageType.EXCEPTION
+      logging.exception(ex)
+      result = TApplicationException(TApplicationException.INTERNAL_ERROR, 'Internal error')
+    oprot.writeMessageBegin("list_sentry_privileges_by_authorizable", msg_type, seqid)
+    result.write(oprot)
+    oprot.writeMessageEnd()
+    oprot.trans.flush()
+
   def process_drop_sentry_privilege(self, seqid, iprot, oprot):
     args = drop_sentry_privilege_args()
     args.read(iprot)
@@ -1868,6 +1926,137 @@ class list_sentry_privileges_for_provider_result(object):
   def __ne__(self, other):
     return not (self == other)
 
+class list_sentry_privileges_by_authorizable_args(object):
+  """
+  Attributes:
+   - request
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.STRUCT, 'request', (TListSentryPrivilegesByAuthRequest, TListSentryPrivilegesByAuthRequest.thrift_spec), None, ), # 1
+  )
+
+  def __init__(self, request=None,):
+    self.request = request
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.STRUCT:
+          self.request = TListSentryPrivilegesByAuthRequest()
+          self.request.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('list_sentry_privileges_by_authorizable_args')
+    if self.request is not None:
+      oprot.writeFieldBegin('request', TType.STRUCT, 1)
+      self.request.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    return
+
+
+  def __hash__(self):
+    value = 17
+    value = (value * 31) ^ hash(self.request)
+    return value
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class list_sentry_privileges_by_authorizable_result(object):
+  """
+  Attributes:
+   - success
+  """
+
+  thrift_spec = (
+    (0, TType.STRUCT, 'success', (TListSentryPrivilegesByAuthResponse, TListSentryPrivilegesByAuthResponse.thrift_spec), None, ), # 0
+  )
+
+  def __init__(self, success=None,):
+    self.success = success
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 0:
+        if ftype == TType.STRUCT:
+          self.success = TListSentryPrivilegesByAuthResponse()
+          self.success.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('list_sentry_privileges_by_authorizable_result')
+    if self.success is not None:
+      oprot.writeFieldBegin('success', TType.STRUCT, 0)
+      self.success.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    return
+
+
+  def __hash__(self):
+    value = 17
+    value = (value * 31) ^ hash(self.success)
+    return value
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
 class drop_sentry_privilege_args(object):
   """
   Attributes:

+ 350 - 2
desktop/libs/libsentry/gen-py/sentry_generic_policy_service/ttypes.py

@@ -261,7 +261,7 @@ class TSentryPrivilege(object):
     value = 17
     value = (value * 31) ^ hash(self.component)
     value = (value * 31) ^ hash(self.serviceName)
-    value = (value * 31) ^ hash(frozenset(self.authorizables))
+    value = (value * 31) ^ hash(self.authorizables)
     value = (value * 31) ^ hash(self.action)
     value = (value * 31) ^ hash(self.createTime)
     value = (value * 31) ^ hash(self.grantorPrincipal)
@@ -1623,7 +1623,7 @@ class TSentryRole(object):
   def __hash__(self):
     value = 17
     value = (value * 31) ^ hash(self.roleName)
-    value = (value * 31) ^ hash(frozenset(self.groups))
+    value = (value * 31) ^ hash(self.groups)
     return value
 
   def __repr__(self):
@@ -2713,3 +2713,351 @@ class TListSentryPrivilegesForProviderResponse(object):
 
   def __ne__(self, other):
     return not (self == other)
+
+class TSentryPrivilegeMap(object):
+  """
+  Attributes:
+   - privilegeMap
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.MAP, 'privilegeMap', (TType.STRING,None,TType.SET,(TType.STRUCT,(TSentryPrivilege, TSentryPrivilege.thrift_spec))), None, ), # 1
+  )
+
+  def __init__(self, privilegeMap=None,):
+    self.privilegeMap = privilegeMap
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.MAP:
+          self.privilegeMap = {}
+          (_ktype92, _vtype93, _size91 ) = iprot.readMapBegin()
+          for _i95 in xrange(_size91):
+            _key96 = iprot.readString()
+            _val97 = set()
+            (_etype101, _size98) = iprot.readSetBegin()
+            for _i102 in xrange(_size98):
+              _elem103 = TSentryPrivilege()
+              _elem103.read(iprot)
+              _val97.add(_elem103)
+            iprot.readSetEnd()
+            self.privilegeMap[_key96] = _val97
+          iprot.readMapEnd()
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('TSentryPrivilegeMap')
+    if self.privilegeMap is not None:
+      oprot.writeFieldBegin('privilegeMap', TType.MAP, 1)
+      oprot.writeMapBegin(TType.STRING, TType.SET, len(self.privilegeMap))
+      for kiter104,viter105 in self.privilegeMap.items():
+        oprot.writeString(kiter104)
+        oprot.writeSetBegin(TType.STRUCT, len(viter105))
+        for iter106 in viter105:
+          iter106.write(oprot)
+        oprot.writeSetEnd()
+      oprot.writeMapEnd()
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    if self.privilegeMap is None:
+      raise TProtocol.TProtocolException(message='Required field privilegeMap is unset!')
+    return
+
+
+  def __hash__(self):
+    value = 17
+    value = (value * 31) ^ hash(self.privilegeMap)
+    return value
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class TListSentryPrivilegesByAuthRequest(object):
+  """
+  Attributes:
+   - protocol_version
+   - requestorUserName
+   - component
+   - serviceName
+   - authorizablesSet
+   - groups
+   - roleSet
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.I32, 'protocol_version', None, 2, ), # 1
+    (2, TType.STRING, 'requestorUserName', None, None, ), # 2
+    (3, TType.STRING, 'component', None, None, ), # 3
+    (4, TType.STRING, 'serviceName', None, None, ), # 4
+    (5, TType.SET, 'authorizablesSet', (TType.STRING,None), None, ), # 5
+    (6, TType.SET, 'groups', (TType.STRING,None), None, ), # 6
+    (7, TType.STRUCT, 'roleSet', (TSentryActiveRoleSet, TSentryActiveRoleSet.thrift_spec), None, ), # 7
+  )
+
+  def __init__(self, protocol_version=thrift_spec[1][4], requestorUserName=None, component=None, serviceName=None, authorizablesSet=None, groups=None, roleSet=None,):
+    self.protocol_version = protocol_version
+    self.requestorUserName = requestorUserName
+    self.component = component
+    self.serviceName = serviceName
+    self.authorizablesSet = authorizablesSet
+    self.groups = groups
+    self.roleSet = roleSet
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.I32:
+          self.protocol_version = iprot.readI32()
+        else:
+          iprot.skip(ftype)
+      elif fid == 2:
+        if ftype == TType.STRING:
+          self.requestorUserName = iprot.readString()
+        else:
+          iprot.skip(ftype)
+      elif fid == 3:
+        if ftype == TType.STRING:
+          self.component = iprot.readString()
+        else:
+          iprot.skip(ftype)
+      elif fid == 4:
+        if ftype == TType.STRING:
+          self.serviceName = iprot.readString()
+        else:
+          iprot.skip(ftype)
+      elif fid == 5:
+        if ftype == TType.SET:
+          self.authorizablesSet = set()
+          (_etype110, _size107) = iprot.readSetBegin()
+          for _i111 in xrange(_size107):
+            _elem112 = iprot.readString()
+            self.authorizablesSet.add(_elem112)
+          iprot.readSetEnd()
+        else:
+          iprot.skip(ftype)
+      elif fid == 6:
+        if ftype == TType.SET:
+          self.groups = set()
+          (_etype116, _size113) = iprot.readSetBegin()
+          for _i117 in xrange(_size113):
+            _elem118 = iprot.readString()
+            self.groups.add(_elem118)
+          iprot.readSetEnd()
+        else:
+          iprot.skip(ftype)
+      elif fid == 7:
+        if ftype == TType.STRUCT:
+          self.roleSet = TSentryActiveRoleSet()
+          self.roleSet.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('TListSentryPrivilegesByAuthRequest')
+    if self.protocol_version is not None:
+      oprot.writeFieldBegin('protocol_version', TType.I32, 1)
+      oprot.writeI32(self.protocol_version)
+      oprot.writeFieldEnd()
+    if self.requestorUserName is not None:
+      oprot.writeFieldBegin('requestorUserName', TType.STRING, 2)
+      oprot.writeString(self.requestorUserName)
+      oprot.writeFieldEnd()
+    if self.component is not None:
+      oprot.writeFieldBegin('component', TType.STRING, 3)
+      oprot.writeString(self.component)
+      oprot.writeFieldEnd()
+    if self.serviceName is not None:
+      oprot.writeFieldBegin('serviceName', TType.STRING, 4)
+      oprot.writeString(self.serviceName)
+      oprot.writeFieldEnd()
+    if self.authorizablesSet is not None:
+      oprot.writeFieldBegin('authorizablesSet', TType.SET, 5)
+      oprot.writeSetBegin(TType.STRING, len(self.authorizablesSet))
+      for iter119 in self.authorizablesSet:
+        oprot.writeString(iter119)
+      oprot.writeSetEnd()
+      oprot.writeFieldEnd()
+    if self.groups is not None:
+      oprot.writeFieldBegin('groups', TType.SET, 6)
+      oprot.writeSetBegin(TType.STRING, len(self.groups))
+      for iter120 in self.groups:
+        oprot.writeString(iter120)
+      oprot.writeSetEnd()
+      oprot.writeFieldEnd()
+    if self.roleSet is not None:
+      oprot.writeFieldBegin('roleSet', TType.STRUCT, 7)
+      self.roleSet.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    if self.protocol_version is None:
+      raise TProtocol.TProtocolException(message='Required field protocol_version is unset!')
+    if self.requestorUserName is None:
+      raise TProtocol.TProtocolException(message='Required field requestorUserName is unset!')
+    if self.component is None:
+      raise TProtocol.TProtocolException(message='Required field component is unset!')
+    if self.serviceName is None:
+      raise TProtocol.TProtocolException(message='Required field serviceName is unset!')
+    if self.authorizablesSet is None:
+      raise TProtocol.TProtocolException(message='Required field authorizablesSet is unset!')
+    return
+
+
+  def __hash__(self):
+    value = 17
+    value = (value * 31) ^ hash(self.protocol_version)
+    value = (value * 31) ^ hash(self.requestorUserName)
+    value = (value * 31) ^ hash(self.component)
+    value = (value * 31) ^ hash(self.serviceName)
+    value = (value * 31) ^ hash(self.authorizablesSet)
+    value = (value * 31) ^ hash(self.groups)
+    value = (value * 31) ^ hash(self.roleSet)
+    return value
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class TListSentryPrivilegesByAuthResponse(object):
+  """
+  Attributes:
+   - status
+   - privilegesMapByAuth
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.STRUCT, 'status', (sentry_common_service.ttypes.TSentryResponseStatus, sentry_common_service.ttypes.TSentryResponseStatus.thrift_spec), None, ), # 1
+    (2, TType.MAP, 'privilegesMapByAuth', (TType.STRING,None,TType.STRUCT,(TSentryPrivilegeMap, TSentryPrivilegeMap.thrift_spec)), None, ), # 2
+  )
+
+  def __init__(self, status=None, privilegesMapByAuth=None,):
+    self.status = status
+    self.privilegesMapByAuth = privilegesMapByAuth
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.STRUCT:
+          self.status = sentry_common_service.ttypes.TSentryResponseStatus()
+          self.status.read(iprot)
+        else:
+          iprot.skip(ftype)
+      elif fid == 2:
+        if ftype == TType.MAP:
+          self.privilegesMapByAuth = {}
+          (_ktype122, _vtype123, _size121 ) = iprot.readMapBegin()
+          for _i125 in xrange(_size121):
+            _key126 = iprot.readString()
+            _val127 = TSentryPrivilegeMap()
+            _val127.read(iprot)
+            self.privilegesMapByAuth[_key126] = _val127
+          iprot.readMapEnd()
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('TListSentryPrivilegesByAuthResponse')
+    if self.status is not None:
+      oprot.writeFieldBegin('status', TType.STRUCT, 1)
+      self.status.write(oprot)
+      oprot.writeFieldEnd()
+    if self.privilegesMapByAuth is not None:
+      oprot.writeFieldBegin('privilegesMapByAuth', TType.MAP, 2)
+      oprot.writeMapBegin(TType.STRING, TType.STRUCT, len(self.privilegesMapByAuth))
+      for kiter128,viter129 in self.privilegesMapByAuth.items():
+        oprot.writeString(kiter128)
+        viter129.write(oprot)
+      oprot.writeMapEnd()
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    if self.status is None:
+      raise TProtocol.TProtocolException(message='Required field status is unset!')
+    return
+
+
+  def __hash__(self):
+    value = 17
+    value = (value * 31) ^ hash(self.status)
+    value = (value * 31) ^ hash(self.privilegesMapByAuth)
+    return value
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)

+ 1 - 1
desktop/libs/libsentry/gen-py/sentry_policy_service/ttypes.py

@@ -1615,7 +1615,7 @@ class TSentryRole(object):
   def __hash__(self):
     value = 17
     value = (value * 31) ^ hash(self.roleName)
-    value = (value * 31) ^ hash(frozenset(self.groups))
+    value = (value * 31) ^ hash(self.groups)
     value = (value * 31) ^ hash(self.grantorPrincipal)
     return value
 

+ 48 - 0
desktop/libs/libsentry/thrift/sentry_generic_policy_service.thrift

@@ -195,6 +195,7 @@ struct TSentryActiveRoleSet {
 1: required bool all,
 2: required set<string> roles,
 }
+
 struct TListSentryPrivilegesForProviderRequest {
 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
 2: required string component, # The request is issued to which component
@@ -203,11 +204,56 @@ struct TListSentryPrivilegesForProviderRequest {
 5: required TSentryActiveRoleSet roleSet,
 6: optional list<TAuthorizable>  authorizables # authorizable hierarchys
 }
+
 struct TListSentryPrivilegesForProviderResponse {
 1: required TSentryResponseStatus status
 2: required set<string> privileges
 }
 
+# Map of role:set<privileges> for the given authorizable
+# Optionally use the set of groups to filter the roles
+struct TSentryPrivilegeMap {
+1: required map<string, set<TSentryPrivilege>> privilegeMap
+}
+
+struct TListSentryPrivilegesByAuthRequest {
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
+
+# User on whose behalf the request is issued
+2: required string requestorUserName,
+
+# The request is issued to which component
+3: required string component,
+
+# The privilege belongs to which service
+4: required string serviceName,
+
+# The authorizable hierarchys, it is represented as a string. e.g
+# resourceType1=resourceName1->resourceType2=resourceName2->resourceType3=resourceName3
+5: required set<string> authorizablesSet,
+
+# The requested groups. For admin, the requested groups can be empty, if so it is
+# treated as a wildcard query. Otherwise, it is a query on this specifc groups.
+# For non-admin user, the requested groups must be the groups they are part of.
+6: optional set<string> groups,
+
+# The active role set.
+7: optional TSentryActiveRoleSet roleSet
+}
+
+struct TListSentryPrivilegesByAuthResponse {
+1: required sentry_common_service.TSentryResponseStatus status,
+
+# Will not be set in case of an error. Otherwise it will be a
+# <Authorizables, <Role, Set<Privileges>>> mapping. For non-admin
+# requestor, the roles are intersection of active roles and granted roles.
+# For admin requestor, the roles are filtered based on the active roles
+# and requested group from TListSentryPrivilegesByAuthRequest.
+# The authorizable hierarchys is represented as a string in the form
+# of the request.
+2: optional map<string, TSentryPrivilegeMap> privilegesMapByAuth
+}
+
 service SentryGenericPolicyService
 {
   TCreateSentryRoleResponse create_sentry_role(1:TCreateSentryRoleRequest request)
@@ -225,6 +271,8 @@ service SentryGenericPolicyService
 
   TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(1:TListSentryPrivilegesForProviderRequest request)
 
+  TListSentryPrivilegesByAuthResponse list_sentry_privileges_by_authorizable(1:TListSentryPrivilegesByAuthRequest request);
+
   TDropPrivilegesResponse drop_sentry_privilege(1:TDropPrivilegesRequest request);
 
   TRenamePrivilegesResponse rename_sentry_privilege(1:TRenamePrivilegesRequest request);