File system access control can't match

[hqbhoho]

I have a rules.json like this:

{
     "tables": [
       {
            "user": "bi",
            "schema": "bbx",
            "privileges": ["OWNERSHIP"]
       },
       {
            "user": "bi",
            "privileges": ["SELECT"]
       }
       ,
       {
            "user": "bi",
            "schema": "uds",
            "privileges": ["OWNERSHIP"]
       }

    ]
}

So, I have CREATE privilege on database uds and bbx. But I can't create table on uds。

In source code (

trino/lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/security/FileBasedSystemAccessControl.java

Line 907 in b72fbf7

private boolean checkTablePermission(SystemSecurityContext context, CatalogSchemaTableName table, TableAccessControlRule.TablePrivilege requiredPrivilege)

), privilege match is:

private boolean checkTablePermission(
            SystemSecurityContext context,
            CatalogSchemaTableName table,
            AccessMode requiredCatalogAccess,
            Predicate<Set<TablePrivilege>> checkPrivileges)
    {
        if (!canAccessCatalog(context, table.getCatalogName(), requiredCatalogAccess)) {
            return false;
        }

        if (INFORMATION_SCHEMA_NAME.equals(table.getSchemaTableName().getSchemaName())) {
            return true;
        }

        Identity identity = context.getIdentity();
        for (CatalogTableAccessControlRule rule : tableRules) {
            if (rule.matches(identity.getUser(), identity.getGroups(), table)) {
                return checkPrivileges.test(rule.getPrivileges());
            }
        }
        return false;
    }

I think traverse all tableRules is good ，like this：

private boolean checkTablePermission(
            SystemSecurityContext context,
            CatalogSchemaTableName table,
            AccessMode requiredCatalogAccess,
            Predicate<Set<TablePrivilege>> checkPrivileges)
    {
        if (!canAccessCatalog(context, table.getCatalogName(), requiredCatalogAccess)) {
            return false;
        }

        if (INFORMATION_SCHEMA_NAME.equals(table.getSchemaTableName().getSchemaName())) {
            return true;
        }

        Identity identity = context.getIdentity();
        for (CatalogTableAccessControlRule rule : tableRules) {
            if (rule.matches(identity.getUser(), identity.getGroups(), table)) {
                // todo 遍历全部权限
                Boolean flag = checkPrivileges.test(rule.getPrivileges());
                if (flag) {
                    return true;
                }
            }
        }
        return false;
    }

[haldes]

@hqbhoho You can try this
{
"tables": [
{
"user": "bi",
"schema": "bbx|uds",
"privileges": ["OWNERSHIP"]
},
{
"user": "bi",
"privileges": ["SELECT"]
}

]

}