Browse Source

[libsentry] Adding rename and delete privilege API calls

Romain Rigaux 11 năm trước cách đây
mục cha
commit
d587f0bc9c

+ 2 - 0
apps/security/src/security/api/hive.py

@@ -108,6 +108,8 @@ def save_privileges(request):
     role = json.loads(request.POST['role'])
 
     new_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'new']
+    deleted_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'deleted']
+
     result['privileges'] = _hive_add_privileges(request.user, role, new_privileges)
     result['message'] = ''
     result['status'] = 0

+ 22 - 21
apps/security/src/security/templates/hive.mako

@@ -51,17 +51,19 @@ ${ layout.menubar(section='hive') }
 
 
 <script type="text/html" id="display-privilege">
-  <div data-bind="visible: status() != 'deleted', with: $data.properties">
-    <span data-bind="text: name"></span>
-    <span data-bind="text: timestamp"></span>
-    <a data-bind="attr: { href: '/metastore/' + database() }" target="_blank"><span data-bind="text: database"></span></a>
-    <span data-bind="text: action"></span>
-    <span data-bind="text: scope"></span>
-    <span data-bind="text: table"></span>
-    <span data-bind="text: URI"></span>
-    <span data-bind="text: grantor"></span>
-    <span data-bind="text: server"></span>
-    <span data-bind="text: ko.mapping.toJSON($data)"></span> <a href="javascript:void(0);"><i class="fa fa-minus"></i></a>
+  <div data-bind="visible: status() != 'deleted'">
+    <span data-bind="with: $data.properties">
+      <span data-bind="text: name"></span>
+      <span data-bind="text: timestamp"></span>
+      <a data-bind="attr: { href: '/metastore/' + database() }" target="_blank"><span data-bind="text: database"></span></a>
+      <span data-bind="text: action"></span>
+      <span data-bind="text: scope"></span>
+      <span data-bind="text: table"></span>
+      <span data-bind="text: URI"></span>
+      <span data-bind="text: grantor"></span>
+      <span data-bind="text: server"></span>
+    </span>
+    <span data-bind="text: ko.mapping.toJSON($data)"></span> <a href="javascript:void(0)"><i class="fa fa-minus" data-bind="click: remove"></i></a>
   </div>
 </script>
 
@@ -203,17 +205,16 @@ ${ layout.menubar(section='hive') }
               <td>
                 <a href=""><span data-bind="text: grantorPrincipal"></span></a>
               </td>
-            </tr>
-            
+            </tr>            
             <!-- ko if: $data.showPrivileges -->
-            <!-- ko foreach: $data.privileges -->
-            <tr>
-              <td colspan="2"></td>
-              <td colspan="3">
-                <div data-bind="template: { name: 'privilege'}"></div>
-              </td>
-            </tr>
-            <!-- /ko -->
+              <!-- ko foreach: $data.privileges -->
+              <tr>
+                <td colspan="2"></td>
+                <td colspan="3">
+                  <div data-bind="template: { name: 'privilege'}"></div>
+                </td>
+              </tr>
+              <!-- /ko -->
             <!-- /ko -->
             <tr>
               <td colspan="2"></td>

+ 14 - 0
desktop/libs/libsentry/gen-py/sentry_policy_service/SentryPolicyService-remote

@@ -32,6 +32,8 @@ if len(sys.argv) <= 1 or sys.argv[1] == '--help':
   print '  TListSentryRolesResponse list_sentry_roles_by_group(TListSentryRolesRequest request)'
   print '  TListSentryPrivilegesResponse list_sentry_privileges_by_role(TListSentryPrivilegesRequest request)'
   print '  TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(TListSentryPrivilegesForProviderRequest request)'
+  print '  TDropPrivilegesResponse drop_sentry_privilege(TDropPrivilegesRequest request)'
+  print '  TRenamePrivilegesResponse rename_sentry_privilege(TRenamePrivilegesRequest request)'
   print ''
   sys.exit(0)
 
@@ -137,6 +139,18 @@ elif cmd == 'list_sentry_privileges_for_provider':
     sys.exit(1)
   pp.pprint(client.list_sentry_privileges_for_provider(eval(args[0]),))
 
+elif cmd == 'drop_sentry_privilege':
+  if len(args) != 1:
+    print 'drop_sentry_privilege requires 1 args'
+    sys.exit(1)
+  pp.pprint(client.drop_sentry_privilege(eval(args[0]),))
+
+elif cmd == 'rename_sentry_privilege':
+  if len(args) != 1:
+    print 'rename_sentry_privilege requires 1 args'
+    sys.exit(1)
+  pp.pprint(client.rename_sentry_privilege(eval(args[0]),))
+
 else:
   print 'Unrecognized method %s' % cmd
   sys.exit(1)

+ 340 - 0
desktop/libs/libsentry/gen-py/sentry_policy_service/SentryPolicyService.py

@@ -81,6 +81,20 @@ class Iface(object):
     """
     pass
 
+  def drop_sentry_privilege(self, request):
+    """
+    Parameters:
+     - request
+    """
+    pass
+
+  def rename_sentry_privilege(self, request):
+    """
+    Parameters:
+     - request
+    """
+    pass
+
 
 class Client(Iface):
   def __init__(self, iprot, oprot=None):
@@ -359,6 +373,66 @@ class Client(Iface):
       return result.success
     raise TApplicationException(TApplicationException.MISSING_RESULT, "list_sentry_privileges_for_provider failed: unknown result");
 
+  def drop_sentry_privilege(self, request):
+    """
+    Parameters:
+     - request
+    """
+    self.send_drop_sentry_privilege(request)
+    return self.recv_drop_sentry_privilege()
+
+  def send_drop_sentry_privilege(self, request):
+    self._oprot.writeMessageBegin('drop_sentry_privilege', TMessageType.CALL, self._seqid)
+    args = drop_sentry_privilege_args()
+    args.request = request
+    args.write(self._oprot)
+    self._oprot.writeMessageEnd()
+    self._oprot.trans.flush()
+
+  def recv_drop_sentry_privilege(self, ):
+    (fname, mtype, rseqid) = self._iprot.readMessageBegin()
+    if mtype == TMessageType.EXCEPTION:
+      x = TApplicationException()
+      x.read(self._iprot)
+      self._iprot.readMessageEnd()
+      raise x
+    result = drop_sentry_privilege_result()
+    result.read(self._iprot)
+    self._iprot.readMessageEnd()
+    if result.success is not None:
+      return result.success
+    raise TApplicationException(TApplicationException.MISSING_RESULT, "drop_sentry_privilege failed: unknown result");
+
+  def rename_sentry_privilege(self, request):
+    """
+    Parameters:
+     - request
+    """
+    self.send_rename_sentry_privilege(request)
+    return self.recv_rename_sentry_privilege()
+
+  def send_rename_sentry_privilege(self, request):
+    self._oprot.writeMessageBegin('rename_sentry_privilege', TMessageType.CALL, self._seqid)
+    args = rename_sentry_privilege_args()
+    args.request = request
+    args.write(self._oprot)
+    self._oprot.writeMessageEnd()
+    self._oprot.trans.flush()
+
+  def recv_rename_sentry_privilege(self, ):
+    (fname, mtype, rseqid) = self._iprot.readMessageBegin()
+    if mtype == TMessageType.EXCEPTION:
+      x = TApplicationException()
+      x.read(self._iprot)
+      self._iprot.readMessageEnd()
+      raise x
+    result = rename_sentry_privilege_result()
+    result.read(self._iprot)
+    self._iprot.readMessageEnd()
+    if result.success is not None:
+      return result.success
+    raise TApplicationException(TApplicationException.MISSING_RESULT, "rename_sentry_privilege failed: unknown result");
+
 
 class Processor(Iface, TProcessor):
   def __init__(self, handler):
@@ -373,6 +447,8 @@ class Processor(Iface, TProcessor):
     self._processMap["list_sentry_roles_by_group"] = Processor.process_list_sentry_roles_by_group
     self._processMap["list_sentry_privileges_by_role"] = Processor.process_list_sentry_privileges_by_role
     self._processMap["list_sentry_privileges_for_provider"] = Processor.process_list_sentry_privileges_for_provider
+    self._processMap["drop_sentry_privilege"] = Processor.process_drop_sentry_privilege
+    self._processMap["rename_sentry_privilege"] = Processor.process_rename_sentry_privilege
 
   def process(self, iprot, oprot):
     (name, type, seqid) = iprot.readMessageBegin()
@@ -488,6 +564,28 @@ class Processor(Iface, TProcessor):
     oprot.writeMessageEnd()
     oprot.trans.flush()
 
+  def process_drop_sentry_privilege(self, seqid, iprot, oprot):
+    args = drop_sentry_privilege_args()
+    args.read(iprot)
+    iprot.readMessageEnd()
+    result = drop_sentry_privilege_result()
+    result.success = self._handler.drop_sentry_privilege(args.request)
+    oprot.writeMessageBegin("drop_sentry_privilege", TMessageType.REPLY, seqid)
+    result.write(oprot)
+    oprot.writeMessageEnd()
+    oprot.trans.flush()
+
+  def process_rename_sentry_privilege(self, seqid, iprot, oprot):
+    args = rename_sentry_privilege_args()
+    args.read(iprot)
+    iprot.readMessageEnd()
+    result = rename_sentry_privilege_result()
+    result.success = self._handler.rename_sentry_privilege(args.request)
+    oprot.writeMessageBegin("rename_sentry_privilege", TMessageType.REPLY, seqid)
+    result.write(oprot)
+    oprot.writeMessageEnd()
+    oprot.trans.flush()
+
 
 # HELPER FUNCTIONS AND STRUCTURES
 
@@ -1569,6 +1667,248 @@ class list_sentry_privileges_for_provider_result(object):
     return
 
 
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class drop_sentry_privilege_args(object):
+  """
+  Attributes:
+   - request
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.STRUCT, 'request', (TDropPrivilegesRequest, TDropPrivilegesRequest.thrift_spec), None, ), # 1
+  )
+
+  def __init__(self, request=None,):
+    self.request = request
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.STRUCT:
+          self.request = TDropPrivilegesRequest()
+          self.request.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('drop_sentry_privilege_args')
+    if self.request is not None:
+      oprot.writeFieldBegin('request', TType.STRUCT, 1)
+      self.request.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    return
+
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class drop_sentry_privilege_result(object):
+  """
+  Attributes:
+   - success
+  """
+
+  thrift_spec = (
+    (0, TType.STRUCT, 'success', (TDropPrivilegesResponse, TDropPrivilegesResponse.thrift_spec), None, ), # 0
+  )
+
+  def __init__(self, success=None,):
+    self.success = success
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 0:
+        if ftype == TType.STRUCT:
+          self.success = TDropPrivilegesResponse()
+          self.success.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('drop_sentry_privilege_result')
+    if self.success is not None:
+      oprot.writeFieldBegin('success', TType.STRUCT, 0)
+      self.success.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    return
+
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class rename_sentry_privilege_args(object):
+  """
+  Attributes:
+   - request
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.STRUCT, 'request', (TRenamePrivilegesRequest, TRenamePrivilegesRequest.thrift_spec), None, ), # 1
+  )
+
+  def __init__(self, request=None,):
+    self.request = request
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.STRUCT:
+          self.request = TRenamePrivilegesRequest()
+          self.request.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('rename_sentry_privilege_args')
+    if self.request is not None:
+      oprot.writeFieldBegin('request', TType.STRUCT, 1)
+      self.request.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    return
+
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class rename_sentry_privilege_result(object):
+  """
+  Attributes:
+   - success
+  """
+
+  thrift_spec = (
+    (0, TType.STRUCT, 'success', (TRenamePrivilegesResponse, TRenamePrivilegesResponse.thrift_spec), None, ), # 0
+  )
+
+  def __init__(self, success=None,):
+    self.success = success
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 0:
+        if ftype == TType.STRUCT:
+          self.success = TRenamePrivilegesResponse()
+          self.success.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('rename_sentry_privilege_result')
+    if self.success is not None:
+      oprot.writeFieldBegin('success', TType.STRUCT, 0)
+      self.success.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    return
+
+
   def __repr__(self):
     L = ['%s=%r' % (key, value)
       for key, value in self.__dict__.iteritems()]

+ 323 - 0
desktop/libs/libsentry/gen-py/sentry_policy_service/ttypes.py

@@ -1798,6 +1798,329 @@ class TListSentryPrivilegesResponse(object):
   def __ne__(self, other):
     return not (self == other)
 
+class TDropPrivilegesRequest(object):
+  """
+  Attributes:
+   - protocol_version
+   - requestorUserName
+   - authorizable
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.I32, 'protocol_version', None, 1, ), # 1
+    (2, TType.STRING, 'requestorUserName', None, None, ), # 2
+    (3, TType.STRUCT, 'authorizable', (TSentryAuthorizable, TSentryAuthorizable.thrift_spec), None, ), # 3
+  )
+
+  def __init__(self, protocol_version=thrift_spec[1][4], requestorUserName=None, authorizable=None,):
+    self.protocol_version = protocol_version
+    self.requestorUserName = requestorUserName
+    self.authorizable = authorizable
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.I32:
+          self.protocol_version = iprot.readI32();
+        else:
+          iprot.skip(ftype)
+      elif fid == 2:
+        if ftype == TType.STRING:
+          self.requestorUserName = iprot.readString();
+        else:
+          iprot.skip(ftype)
+      elif fid == 3:
+        if ftype == TType.STRUCT:
+          self.authorizable = TSentryAuthorizable()
+          self.authorizable.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('TDropPrivilegesRequest')
+    if self.protocol_version is not None:
+      oprot.writeFieldBegin('protocol_version', TType.I32, 1)
+      oprot.writeI32(self.protocol_version)
+      oprot.writeFieldEnd()
+    if self.requestorUserName is not None:
+      oprot.writeFieldBegin('requestorUserName', TType.STRING, 2)
+      oprot.writeString(self.requestorUserName)
+      oprot.writeFieldEnd()
+    if self.authorizable is not None:
+      oprot.writeFieldBegin('authorizable', TType.STRUCT, 3)
+      self.authorizable.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    if self.protocol_version is None:
+      raise TProtocol.TProtocolException(message='Required field protocol_version is unset!')
+    if self.requestorUserName is None:
+      raise TProtocol.TProtocolException(message='Required field requestorUserName is unset!')
+    if self.authorizable is None:
+      raise TProtocol.TProtocolException(message='Required field authorizable is unset!')
+    return
+
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class TDropPrivilegesResponse(object):
+  """
+  Attributes:
+   - status
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.STRUCT, 'status', (sentry_common_service.ttypes.TSentryResponseStatus, sentry_common_service.ttypes.TSentryResponseStatus.thrift_spec), None, ), # 1
+  )
+
+  def __init__(self, status=None,):
+    self.status = status
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.STRUCT:
+          self.status = sentry_common_service.ttypes.TSentryResponseStatus()
+          self.status.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('TDropPrivilegesResponse')
+    if self.status is not None:
+      oprot.writeFieldBegin('status', TType.STRUCT, 1)
+      self.status.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    if self.status is None:
+      raise TProtocol.TProtocolException(message='Required field status is unset!')
+    return
+
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class TRenamePrivilegesRequest(object):
+  """
+  Attributes:
+   - protocol_version
+   - requestorUserName
+   - oldAuthorizable
+   - newAuthorizable
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.I32, 'protocol_version', None, 1, ), # 1
+    (2, TType.STRING, 'requestorUserName', None, None, ), # 2
+    (3, TType.STRUCT, 'oldAuthorizable', (TSentryAuthorizable, TSentryAuthorizable.thrift_spec), None, ), # 3
+    (4, TType.STRUCT, 'newAuthorizable', (TSentryAuthorizable, TSentryAuthorizable.thrift_spec), None, ), # 4
+  )
+
+  def __init__(self, protocol_version=thrift_spec[1][4], requestorUserName=None, oldAuthorizable=None, newAuthorizable=None,):
+    self.protocol_version = protocol_version
+    self.requestorUserName = requestorUserName
+    self.oldAuthorizable = oldAuthorizable
+    self.newAuthorizable = newAuthorizable
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.I32:
+          self.protocol_version = iprot.readI32();
+        else:
+          iprot.skip(ftype)
+      elif fid == 2:
+        if ftype == TType.STRING:
+          self.requestorUserName = iprot.readString();
+        else:
+          iprot.skip(ftype)
+      elif fid == 3:
+        if ftype == TType.STRUCT:
+          self.oldAuthorizable = TSentryAuthorizable()
+          self.oldAuthorizable.read(iprot)
+        else:
+          iprot.skip(ftype)
+      elif fid == 4:
+        if ftype == TType.STRUCT:
+          self.newAuthorizable = TSentryAuthorizable()
+          self.newAuthorizable.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('TRenamePrivilegesRequest')
+    if self.protocol_version is not None:
+      oprot.writeFieldBegin('protocol_version', TType.I32, 1)
+      oprot.writeI32(self.protocol_version)
+      oprot.writeFieldEnd()
+    if self.requestorUserName is not None:
+      oprot.writeFieldBegin('requestorUserName', TType.STRING, 2)
+      oprot.writeString(self.requestorUserName)
+      oprot.writeFieldEnd()
+    if self.oldAuthorizable is not None:
+      oprot.writeFieldBegin('oldAuthorizable', TType.STRUCT, 3)
+      self.oldAuthorizable.write(oprot)
+      oprot.writeFieldEnd()
+    if self.newAuthorizable is not None:
+      oprot.writeFieldBegin('newAuthorizable', TType.STRUCT, 4)
+      self.newAuthorizable.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    if self.protocol_version is None:
+      raise TProtocol.TProtocolException(message='Required field protocol_version is unset!')
+    if self.requestorUserName is None:
+      raise TProtocol.TProtocolException(message='Required field requestorUserName is unset!')
+    if self.oldAuthorizable is None:
+      raise TProtocol.TProtocolException(message='Required field oldAuthorizable is unset!')
+    if self.newAuthorizable is None:
+      raise TProtocol.TProtocolException(message='Required field newAuthorizable is unset!')
+    return
+
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
+class TRenamePrivilegesResponse(object):
+  """
+  Attributes:
+   - status
+  """
+
+  thrift_spec = (
+    None, # 0
+    (1, TType.STRUCT, 'status', (sentry_common_service.ttypes.TSentryResponseStatus, sentry_common_service.ttypes.TSentryResponseStatus.thrift_spec), None, ), # 1
+  )
+
+  def __init__(self, status=None,):
+    self.status = status
+
+  def read(self, iprot):
+    if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+      fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+      return
+    iprot.readStructBegin()
+    while True:
+      (fname, ftype, fid) = iprot.readFieldBegin()
+      if ftype == TType.STOP:
+        break
+      if fid == 1:
+        if ftype == TType.STRUCT:
+          self.status = sentry_common_service.ttypes.TSentryResponseStatus()
+          self.status.read(iprot)
+        else:
+          iprot.skip(ftype)
+      else:
+        iprot.skip(ftype)
+      iprot.readFieldEnd()
+    iprot.readStructEnd()
+
+  def write(self, oprot):
+    if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+      oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+      return
+    oprot.writeStructBegin('TRenamePrivilegesResponse')
+    if self.status is not None:
+      oprot.writeFieldBegin('status', TType.STRUCT, 1)
+      self.status.write(oprot)
+      oprot.writeFieldEnd()
+    oprot.writeFieldStop()
+    oprot.writeStructEnd()
+
+  def validate(self):
+    if self.status is None:
+      raise TProtocol.TProtocolException(message='Required field status is unset!')
+    return
+
+
+  def __repr__(self):
+    L = ['%s=%r' % (key, value)
+      for key, value in self.__dict__.iteritems()]
+    return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+  def __eq__(self, other):
+    return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+  def __ne__(self, other):
+    return not (self == other)
+
 class TSentryActiveRoleSet(object):
   """
   Attributes:

+ 45 - 27
desktop/libs/libsentry/src/libsentry/api.py

@@ -42,61 +42,61 @@ class SentryApi(object):
 
   def create_sentry_role(self, roleName):
     response = self.client.create_sentry_role(roleName)
-    
+
     if response.status.value == 0:
       return response
     else:
-      raise SentryException(response)  
+      raise SentryException(response)
 
 
   def drop_sentry_role(self, roleName):
     response = self.client.drop_sentry_role(roleName)
-    
+
     if response.status.value == 0:
       return response
     else:
-      raise SentryException(response) 
+      raise SentryException(response)
 
 
   def alter_sentry_role_grant_privilege(self, roleName, tSentryPrivilege):
     response = self.client.alter_sentry_role_grant_privilege(roleName, tSentryPrivilege)
-    
+
     if response.status.value == 0:
       return response
     else:
       raise SentryException(response)
-    
+
 
   def alter_sentry_role_revoke_privilege(self, roleName, tSentryPrivilege):
     response = self.client.alter_sentry_role_revoke_privilege(roleName, tSentryPrivilege)
-    
+
     if response.status.value == 0:
       return response
     else:
-      raise SentryException(response) 
-    
-    
+      raise SentryException(response)
+
+
   def alter_sentry_role_add_groups(self, roleName, groups):
     response = self.client.alter_sentry_role_add_groups(roleName, groups)
-    
+
     if response.status.value == 0:
       return response
     else:
       raise SentryException(response)
-        
-        
+
+
   def alter_sentry_role_delete_groups(self, roleName, groups):
     response = self.client.alter_sentry_role_delete_groups(roleName, groups)
-    
+
     if response.status.value == 0:
       return response
     else:
-      raise SentryException(response)        
-        
-    
+      raise SentryException(response)
+
+
   def list_sentry_roles_by_group(self, groupName=None):
     response = self.client.list_sentry_roles_by_group()
-    
+
     if response.status.value == 0:
       roles = []
       for role in response.roles:
@@ -107,27 +107,45 @@ class SentryApi(object):
         })
       return roles
     else:
-      raise SentryException(response)  
+      raise SentryException(response)
 
 
   def list_sentry_privileges_by_role(self, roleName, authorizableHierarchy=None):
     response = self.client.list_sentry_privileges_by_role(roleName, authorizableHierarchy)
-    
+
     if response.status.value == 0:
       return [self._massage_priviledges(privilege) for privilege in response.privileges]
     else:
       raise SentryException(response)
-    
-    
+
+
   def list_sentry_privileges_for_provider(self, groups, roleSet=None, authorizableHierarchy=None):
     response = self.client.list_sentry_privileges_for_provider(groups, roleSet, authorizableHierarchy)
-    
+
+    if response.status.value == 0:
+      return response
+    else:
+      raise SentryException(response)
+
+
+  def drop_sentry_privilege(self, authorizableHierarchy):
+    response = self.client.drop_sentry_privilege(authorizableHierarchy)
+
     if response.status.value == 0:
-      return list(response.privileges) # e.g. set(['server=+'])
+      return response
+    else:
+      raise SentryException(response)
+
+
+  def rename_sentry_privilege(self, oldAuthorizable, newAuthorizable):
+    response = self.client.rename_sentry_privilege(oldAuthorizable, newAuthorizable)
+
+    if response.status.value == 0:
+      return response
     else:
       raise SentryException(response)
-    
-    
+
+
   def _massage_priviledges(self, privilege):
     return {
         'scope': privilege.privilegeScope,
@@ -139,4 +157,4 @@ class SentryApi(object):
         'action': privilege.action,
         'timestamp': privilege.createTime,
         'grantor': privilege.grantorPrincipal
-    }     
+    }

+ 24 - 11
desktop/libs/libsentry/src/libsentry/client.py

@@ -23,7 +23,7 @@ from sentry_policy_service import SentryPolicyService
 from sentry_policy_service.ttypes import TListSentryRolesRequest, TListSentryPrivilegesRequest, TSentryAuthorizable, TCreateSentryRoleRequest, \
     TDropSentryRoleRequest, TAlterSentryRoleGrantPrivilegeRequest, TSentryPrivilege, TAlterSentryRoleGrantPrivilegeResponse, \
     TAlterSentryRoleRevokePrivilegeRequest, TAlterSentryRoleAddGroupsRequest, TSentryGroup, TAlterSentryRoleDeleteGroupsRequest, \
-    TListSentryPrivilegesForProviderRequest, TSentryActiveRoleSet, TSentryAuthorizable
+    TListSentryPrivilegesForProviderRequest, TSentryActiveRoleSet, TSentryAuthorizable, TDropPrivilegesRequest, TRenamePrivilegesRequest
 
 
 LOG = logging.getLogger(__name__)
@@ -64,23 +64,23 @@ class SentryClient(object):
         timeout_seconds=30,
         multiple=True
     )
-    
+
   def create_sentry_role(self, roleName):
     request = TCreateSentryRoleRequest(requestorUserName=self.username, roleName=roleName)
     return self.client.create_sentry_role(request)
-  
-  
-  def drop_sentry_role(self, roleName):    
+
+
+  def drop_sentry_role(self, roleName):
     request = TDropSentryRoleRequest(requestorUserName=self.username, roleName=roleName, )
-    return self.client.drop_sentry_role(request)  
+    return self.client.drop_sentry_role(request)
 
 
   def alter_sentry_role_grant_privilege(self, roleName, tSentryPrivilege):
     privilege = TSentryPrivilege(**tSentryPrivilege)
     request = TAlterSentryRoleGrantPrivilegeRequest(requestorUserName=self.username, roleName=roleName, privilege=privilege)
     return self.client.alter_sentry_role_grant_privilege(request)
-    
-    
+
+
   def alter_sentry_role_revoke_privilege(self, roleName, tSentryPrivilege):
     privilege = TSentryPrivilege(**tSentryPrivilege)
     request = TAlterSentryRoleRevokePrivilegeRequest(requestorUserName=self.username, roleName=roleName, privilege=privilege)
@@ -111,21 +111,34 @@ class SentryClient(object):
     return self.client.list_sentry_privileges_by_role(request)
 
 
+  def drop_sentry_privilege(self, authorizableHierarchy):
+    authorizableHierarchy = TSentryAuthorizable(**authorizableHierarchy)
+    request = TDropPrivilegesRequest(requestorUserName=self.username, authorizableHierarchy=authorizableHierarchy)
+    return self.client.drop_sentry_privilege(request)
+
+
+  def rename_sentry_privilege(self, oldAuthorizable, newAuthorizable):
+    oldAuthorizable = TSentryAuthorizable(**oldAuthorizable)
+    newAuthorizable = TSentryAuthorizable(**newAuthorizable)
+    request = TRenamePrivilegesRequest(requestorUserName=self.username, oldAuthorizable=oldAuthorizable, newAuthorizable=newAuthorizable)
+    return self.client.rename_sentry_privilege(request)
+
+
   def list_sentry_privileges_for_provider(self, groups, roleSet=None, authorizableHierarchy=None):
     """
     struct TSentryActiveRoleSet {
       1: required bool all,
       2: required set<string> roles,
     }
-    
+
     struct TListSentryPrivilegesForProviderResponse {
       1: required sentry_common_service.TSentryResponseStatus status
       2: required set<string> privileges
     }
     """
-    if roleSet is not None:        
+    if roleSet is not None:
       roleSet = TSentryActiveRoleSet(**roleSet)
     if authorizableHierarchy is not None:
-      authorizableHierarchy = TSentryAuthorizable(**authorizableHierarchy) 
+      authorizableHierarchy = TSentryAuthorizable(**authorizableHierarchy)
     request = TListSentryPrivilegesForProviderRequest(groups=groups, roleSet=roleSet, authorizableHierarchy=authorizableHierarchy)
     return self.client.list_sentry_privileges_for_provider(request)

+ 26 - 0
desktop/libs/libsentry/thrift/sentry_policy_service.thrift

@@ -149,6 +149,28 @@ struct TListSentryPrivilegesResponse {
 2: optional set<TSentryPrivilege> privileges
 }
 
+# Drop privilege
+struct TDropPrivilegesRequest {
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
+2: required string requestorUserName, # user on whose behalf the request is issued
+3: required TSentryAuthorizable authorizable
+}
+
+struct TDropPrivilegesResponse {
+1: required sentry_common_service.TSentryResponseStatus status
+}
+
+struct TRenamePrivilegesRequest {
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
+2: required string requestorUserName, # user on whose behalf the request is issued
+3: required TSentryAuthorizable oldAuthorizable
+4: required TSentryAuthorizable newAuthorizable
+}
+
+struct TRenamePrivilegesResponse {
+1: required sentry_common_service.TSentryResponseStatus status
+}
+
 # This API was created specifically for ProviderBackend.getPrivileges
 # and is not mean for general purpose privilege retrieval.
 # This request/response pair are created specifically so we can
@@ -185,4 +207,8 @@ service SentryPolicyService
 
   # For use with ProviderBackend.getPrivileges only
   TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(1:TListSentryPrivilegesForProviderRequest request)
+
+ TDropPrivilegesResponse drop_sentry_privilege(1:TDropPrivilegesRequest request);
+
+ TRenamePrivilegesResponse rename_sentry_privilege(1:TRenamePrivilegesRequest request);
 }