Package org.apache.druid.query.policy

Interface PolicyEnforcer

All Known Implementing Classes:

NoopPolicyEnforcer, RestrictAllTablesPolicyEnforcer

public interface PolicyEnforcer

Interface for enforcing policies on data sources and segments in Druid queries.

Note: The PolicyEnforcer is intended to serve as a sanity checker and not as a primary authorization mechanism. It should not be used to implement security rules. Instead, it acts as a last line of defense to verify that security policies have been implemented correctly and to prevent incorrect policy usage.

Method Summary

Modifier and Type	Method	Description
boolean	validate(Policy policy)	Returns true if the policy complies with the policy enforcer.
default void	validateOrElseThrow(TableDataSource ds, Policy policy)	Validates a DataSource against the policy enforcer.
default void	validateOrElseThrow(Segment segment, Policy policy)	Validates a Segment against the policy enforcer.

Method Details

validateOrElseThrow

default void validateOrElseThrow(TableDataSource ds,
 Policy policy)
                          throws DruidException

Validates a DataSource against the policy enforcer. Prior to query execution, the Query.getDataSource() tree is walked. This method is invoked once for each RestrictedDataSource and once for each TableDataSource that is not wrapped inside a RestrictedDataSource, no matter where they appear within the tree.

Parameters:

ds - the table to validate.

policy - the policy attached to the table; either RestrictedDataSource.policy or null.

Throws:

DruidException - if the data source does not comply with the policy

validateOrElseThrow

default void validateOrElseThrow(Segment segment,
 Policy policy)
                          throws DruidException

Validates a Segment against the policy enforcer. Prior to query execution, the Segment tree is walked. This method is invoked once for each RestrictedSegment and once for each ReferenceCountedSegmentProvider that is not wrapped inside a RestrictedSegment.

Direct invocation of this method is discouraged; use Segment.validateOrElseThrow(PolicyEnforcer) instead.

Parameters:

segment - the segment to validate

policy - the policy on the segment, RestrictedSegment.policy or null for other

Throws:

DruidException - if the segment does not comply with the policy

validate

boolean validate(Policy policy)

Returns true if the policy complies with the policy enforcer.