HIVE-29628: Incorrect objectName in PARTITION HivePrivilegeObject for…

[rtrivedi12]

… view queries on partitioned tables

What changes were proposed in this pull request?

Fixed incorrect PARTITION HivePrivilegeObject generation in CommandAuthorizerV2 for queries that access a regular (non-deferred) view over a partitioned base table.
In CommandAuthorizerV2.getHivePrivObjects(), skip emitting a HivePrivilegeObject for PARTITION / DUMMYPARTITION entities when access is through a regular view. The view’s TABLE_OR_VIEW object already covers authorization.

Skip logic (isPartitionAccessedViaRegularView):

1. If the partition entity has a regular (non-deferred) view parent → skip.
2. If the partition entity lacks parent entity but a sibling indirect TABLE entity for the same base table has a regular view parent → skip.
3. If the partition is accessed through a deferred-auth view (Authorized=false) → emit PARTITION on the base table (existing behaviour).
4. If the partition is accessed directly (no view) → emit PARTITION on the base table

Why are the changes needed?

HIVE-27892 added handling for PARTITION / DUMMYPARTITION entities in addHivePrivObject, always using the physical base-table name (datadb/t1). For view queries, this causes authorizers to receive an extra PARTITION object on the base table in addition to the view’s TABLE_OR_VIEW object. Users with view-only policies are getting PERMISSION denied.

Does this PR introduce any user-facing change?

yes
View queries through regular views send only the view TABLE_OR_VIEW privilege object. Direct queries on partitioned tables and deferred-auth views still emit base-table PARTITION objects as before.

How was this patch tested?

mvn test -Dtest=TestViewPartitionPrivilegeObjects

[soumyakanti3578]

Overall looks good to me, I just have one question about a potential NPE. I will approve when it's resolved.

[soumyakanti3578]

Do you think getTTable() can return null? Although I see similar pattern elsewhere too, so I will leave it up to you.
nit: Also maybe this method can be used inside isDeferredAuthView?

[rtrivedi12]

Thanks for pointing that out @soumyakanti3578 ! Table already exposes isView() and isMaterializedView() instance methods which are used everywhere. Hence removed this helper method.

[difin]

There are a few Sonar issues regarding unused imports and method namings, can you please handle that?

[rtrivedi12]

There are a few Sonar issues regarding unused imports and method namings, can you please handle that?

Thanks, handled sonar issues.

[difin]

LGTM

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[soumyakanti3578]

LGTM. Approving, pending tests.