-
Notifications
You must be signed in to change notification settings - Fork 3.2k
[OPA Plugin] Support splitting OPA filter requests in batch mode by batch size #25753
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
Thank you for your pull request and welcome to our community. We could not parse the GitHub identity of the following contributors: Thinhinane Ihadadene.
|
7634089
to
069d83d
Compare
b725506
to
fe95395
Compare
The CI seems to be failing due to a missing |
plugin/trino-opa/src/test/java/io/trino/plugin/opa/TestOpaConfig.java
Outdated
Show resolved
Hide resolved
plugin/trino-opa/src/test/java/io/trino/plugin/opa/RequestTestUtilities.java
Outdated
Show resolved
Hide resolved
plugin/trino-opa/src/main/java/io/trino/plugin/opa/OpaHttpClient.java
Outdated
Show resolved
Hide resolved
plugin/trino-opa/src/test/java/io/trino/plugin/opa/TestOpaBatchAccessControlFiltering.java
Show resolved
Hide resolved
plugin/trino-opa/src/test/java/io/trino/plugin/opa/TestOpaBatchAccessControlFiltering.java
Outdated
Show resolved
Hide resolved
assertAccessControlMethodBehaviour( | ||
(accessControl, systemSecurityContext, identities) -> accessControl.filterViewQueryOwnedBy(systemSecurityContext.getIdentity(), identities), | ||
inputIdentities, | ||
identityToJsonNode, | ||
new ExpectedRequestProperties( | ||
testCase.batchSizeToBatchNumber, | ||
testCase.numberOfRequest, | ||
"FilterViewQueryOwnedBy", | ||
inputIdentities.stream().map(identityToJsonNode).collect(toImmutableSet())), | ||
testCase.opaConfig); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we avoid using this abstraction and rather have these values explicitly like
assertAccessControlMethodBehaviour(situation1);
assertAccessControlMethodBehaviour(situation2);
...
So it is easier to understand on what are the impacts
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do you mind clarifying if you mean the TestCase abstraction or ExpectedRequestProperties? I assume you mean TestCase
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
From what I've seen in previous PRs, what Praveen is refering to is doing something like
@Test
public void testFilterViewQueryOwnedBy()
{
...
assertFilterViewQueryOwnedBy(new TestCase(OPA_CONFIG_NO_BATCH_SIZE, ImmutableMap.of(11, 1), 1));
...
}
void assertFilterViewQueryOwnedBy(TestCase testCase)
{
assertAccessControlMethodBehaviour(
(accessControl, systemSecurityContext, identities) -> accessControl.filterViewQueryOwnedBy(systemSecurityContext.getIdentity(), identities),
inputIdentities,
identityToJsonNode,
new ExpectedRequestProperties(
testCase.batchSizeToBatchNumber,
testCase.numberOfRequest,
"FilterViewQueryOwnedBy",
inputIdentities.stream().map(identityToJsonNode).collect(toImmutableSet())),
testCase.opaConfig);
}
The nice thing about this is that when a case fails the traceback will point you the line that failed, so you don't have to figure out which element in the for loop failed
plugin/trino-opa/src/test/java/io/trino/plugin/opa/TestOpaBatchAccessControlFiltering.java
Outdated
Show resolved
Hide resolved
abfd602
to
af7a59c
Compare
af7a59c
to
e15090a
Compare
plugin/trino-opa/src/test/java/io/trino/plugin/opa/TestOpaBatchAccessControlFiltering.java
Outdated
Show resolved
Hide resolved
ImmutableSet.of("\"table_one_column_1\"", "\"table_one_column_2\"", "\"table_one_column_3\"", "\"table_two_column_1\"") | ||
.stream() | ||
.map(RequestTestUtilities::toJsonNode) | ||
.collect(toImmutableSet()))); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: we could add a toJsonNode
util that takes an object so we don't have to double quote the string
assertAccessControlMethodBehaviour( | ||
(accessControl, systemSecurityContext, identities) -> accessControl.filterViewQueryOwnedBy(systemSecurityContext.getIdentity(), identities), | ||
inputIdentities, | ||
identityToJsonNode, | ||
new ExpectedRequestProperties( | ||
testCase.batchSizeToBatchNumber, | ||
testCase.numberOfRequest, | ||
"FilterViewQueryOwnedBy", | ||
inputIdentities.stream().map(identityToJsonNode).collect(toImmutableSet())), | ||
testCase.opaConfig); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
From what I've seen in previous PRs, what Praveen is refering to is doing something like
@Test
public void testFilterViewQueryOwnedBy()
{
...
assertFilterViewQueryOwnedBy(new TestCase(OPA_CONFIG_NO_BATCH_SIZE, ImmutableMap.of(11, 1), 1));
...
}
void assertFilterViewQueryOwnedBy(TestCase testCase)
{
assertAccessControlMethodBehaviour(
(accessControl, systemSecurityContext, identities) -> accessControl.filterViewQueryOwnedBy(systemSecurityContext.getIdentity(), identities),
inputIdentities,
identityToJsonNode,
new ExpectedRequestProperties(
testCase.batchSizeToBatchNumber,
testCase.numberOfRequest,
"FilterViewQueryOwnedBy",
inputIdentities.stream().map(identityToJsonNode).collect(toImmutableSet())),
testCase.opaConfig);
}
The nice thing about this is that when a case fails the traceback will point you the line that failed, so you don't have to figure out which element in the for loop failed
Description
This PR aims to address issue #25748
Additional context and related issues
Release notes
( ) This is not user-visible or is docs only, and no release notes are required.
( X ) Release notes are required. Please propose a release note for me.
() Release notes are required, with the following suggested text: