diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala index 532a11436..c2e886f02 100644 --- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala +++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala @@ -895,4 +895,50 @@ class HiveCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite { } } } + + test("[KYUUBI #5472] Permanent View should pass column when child plan no output ") { + val db1 = defaultDb + val table1 = "table1" + val view1 = "view1" + val view2 = "view2" + withSingleCallEnabled { + withCleanTmpResources( + Seq((s"$db1.$table1", "table"), (s"$db1.$view1", "view"), (s"$db1.$view2", "view"))) { + doAs(admin, sql(s"CREATE TABLE IF NOT EXISTS $db1.$table1 (id int, scope int)")) + doAs(admin, sql(s"CREATE VIEW $db1.$view1 AS SELECT * FROM $db1.$table1")) + doAs( + admin, + sql( + s""" + |CREATE VIEW $db1.$view2 + |AS + |SELECT count(*) as cnt, sum(id) as sum_id FROM $db1.$table1 + """.stripMargin)) + val e1 = intercept[AccessControlException]( + doAs(someone, sql(s"SELECT count(*) FROM $db1.$table1").show())) + assert(e1.getMessage.contains( + s"does not have [select] privilege on [$db1/$table1/id,$db1/$table1/scope]")) + + val e2 = intercept[AccessControlException]( + doAs(someone, sql(s"SELECT count(*) FROM $db1.$view1").show())) + assert(e2.getMessage.contains( + s"does not have [select] privilege on [$db1/$view1/id,$db1/$view1/scope]")) + + val e3 = intercept[AccessControlException]( + doAs(someone, sql(s"SELECT count(*) FROM $db1.$view2").show())) + assert(e3.getMessage.contains( + s"does not have [select] privilege on [$db1/$view2/cnt,$db1/$view2/sum_id]")) + + val e4 = intercept[AccessControlException]( + doAs(someone, sql(s"SELECT count(*) FROM $db1.$view2 WHERE cnt > 10").show())) + assert(e4.getMessage.contains( + s"does not have [select] privilege on [$db1/$view2/cnt,$db1/$view2/sum_id]")) + + val e5 = intercept[AccessControlException]( + doAs(someone, sql(s"SELECT count(cnt) FROM $db1.$view2 WHERE cnt > 10").show())) + assert(e5.getMessage.contains( + s"does not have [select] privilege on [$db1/$view2/cnt,$db1/$view2/sum_id]")) + } + } + } }