[KYUUBI #7774][AUTHZ] Resolve the table owner for v1 (Hive) tables

[attilapiros]

Why are the changes needed?

Granting ownership privileges needs the table owner on the privilege object, but it came back empty for Hive tables.

TableExtractor.getOwner assumed its argument wraps a connector Table in a table member. V1Table, which V2SessionCatalog.loadTable returns for a session-catalog (Hive) table, carries the properties itself and has no table accessor, so the lookup threw, was swallowed by the surrounding catch, and the owner was lost.

DROP TABLE on a Hive table reaches exactly this path. With spark.sql.legacy.useV1Command at its default of false the plan is not downgraded to DropTableCommand; it stays as the v2 DropTable(ResolvedIdentifier(...)), whose first table descriptor resolves the owner through loadTable.

• getOwner picks the properties holder -- V1Table itself, or the wrapped table otherwise -- and then reads the owner once, instead of duplicating the lookup.
• Empty owners are filtered out. V1Table.addV2TableProperties sets PROP_OWNER unconditionally, so a table with no owner yielded Some(""). The other owner lookups in this file already filter on nonEmpty.
• A debug line when the catalog lookup fails, so a genuinely absent owner can be told apart from a failed load.

V1Table is private[sql], so it is matched by class name; it cannot be referenced as a type from this package.

How was this patch tested?

A new test in HiveCatalogRangerSparkExtensionSuite asserts the owner on the privilege object built for DROP TABLE. It fails without this change: the owner is None, because getOwner throws on a V1Table. The test asserts the owner value rather than isDefined -- since PROP_OWNER is always set, isDefined would also hold for an empty owner.

Was this patch assisted by generative AI tooling?

Assisted-by: Claude Opus 5

[pan3793]

should move this comment to the V1Table branch?

[pan3793]

Match on the public org.apache.spark.sql.connector.catalog.Table type instead of the V1Table class name, so this handles connector tables generally:

import org.apache.spark.sql.connector.catalog.{Identifier, Table => V2Table}

val maybeTable = v match {
  case table: V2Table => table
  case _ => invokeAs[AnyRef](v, "table")
}

For example, Delta Lake\s DeltaCatalog.loadTable returns a DeltaTableV2, which exposes the owner through properties() but has no table accessor. The fallback preserves unwrapping for ResolvedTable and DataSourceV2Relation.

[attilapiros]

@pan3793 I just would not call it V2Table (by the import rename Table => V2Table) especially because it handles the V1Table so it would be a bit misleading. What about using the following rename:Table => ConnectorTable (as CatalogTable is already taken)?

[pan3793]

Spark uses import ...Table => V2Table too, it also has an ExtractV2Table tool that returns Option[Table]

https://github.com/apache/spark/blob/branch-4.3/sql/pipelines/src/main/scala/org/apache/spark/sql/pipelines/graph/DatasetManager.scala#L33

https://github.com/apache/spark/blob/branch-4.3/sql/catalyst/src/main/scala/org/apache/spark/sql/execution/datasources/v2/DataSourceV2Relation.scala#L498-L500

[attilapiros]

@pan3793 ok, I have done the rename

[pan3793]

Merge Summary:

• merged into master e130c3e
• merged into branch-1.12 d69fd34

Posted by merge_kyuubi_pr.py