Source:
public void testReadOnlySystemAccessControl() { Identity identity = new Identity(USER_NAME, Optional.of(PRINCIPAL)); QualifiedObjectName tableName = new QualifiedObjectName("catalog", "schema", "table"); TransactionManager transactionManager = createTestTransactionManager(); AccessControlManager accessControlManager = new AccessControlManager(transactionManager); AccessControlContext ctx = new AccessControlContext(new QueryId(QUERY_ID), Optional.empty()); accessControlManager.setSystemAccessControl(ReadOnlySystemAccessControl.NAME, ImmutableMap.of()); accessControlManager.checkCanSetUser(ctx, Optional.of(PRINCIPAL), USER_NAME); accessControlManager.checkCanSetSystemSessionProperty(identity, ctx, "property"); transaction(transactionManager, accessControlManager) .execute(transactionId -> { accessControlManager.checkCanSetCatalogSessionProperty(transactionId, identity, ctx, "catalog", "property"); accessControlManager.checkCanShowSchemas(transactionId, identity, ctx, "catalog"); accessControlManager.checkCanShowTablesMetadata(transactionId, identity, ctx, new CatalogSchemaName("catalog", "schema")); accessControlManager.checkCanSelectFromColumns(transactionId, identity, ctx, tableName, ImmutableSet.of("column")); accessControlManager.checkCanCreateViewWithSelectFromColumns(transactionId, identity, ctx, tableName, ImmutableSet.of("column")); Set<String> catalogs = ImmutableSet.of("catalog"); assertEquals(accessControlManager.filterCatalogs(identity, ctx, catalogs), catalogs); Set<String> schemas = ImmutableSet.of("schema"); assertEquals(accessControlManager.filterSchemas(transactionId, identity, ctx, "catalog", schemas), schemas); Set<SchemaTableName> tableNames = ImmutableSet.of(new SchemaTableName("schema", "table")); assertEquals(accessControlManager.filterTables(transactionId, identity, ctx, "catalog", tableNames), tableNames); }); try { transaction(transactionManager, accessControlManager) .execute(transactionId -> { accessControlManager.checkCanInsertIntoTable(transactionId, identity, ctx, tableName); }); fail(); } catch (AccessDeniedException expected) { } }

Target:
public void testReadOnlySystemAccessControl() { Identity identity = new Identity(USER_NAME, Optional.of(PRINCIPAL)); QualifiedObjectName tableName = new QualifiedObjectName("catalog", "schema", "table"); TransactionManager transactionManager = createTestTransactionManager(); AccessControlManager accessControlManager = new AccessControlManager(transactionManager); AccessControlContext context = new AccessControlContext(new QueryId(QUERY_ID), Optional.empty(), Optional.empty()); accessControlManager.setSystemAccessControl(ReadOnlySystemAccessControl.NAME, ImmutableMap.of()); accessControlManager.checkCanSetUser(context, Optional.of(PRINCIPAL), USER_NAME); accessControlManager.checkCanSetSystemSessionProperty(identity, context, "property"); transaction(transactionManager, accessControlManager) .execute(transactionId -> { accessControlManager.checkCanSetCatalogSessionProperty(transactionId, identity, context, "catalog", "property"); accessControlManager.checkCanShowSchemas(transactionId, identity, context, "catalog"); accessControlManager.checkCanShowTablesMetadata(transactionId, identity, context, new CatalogSchemaName("catalog", "schema")); accessControlManager.checkCanSelectFromColumns(transactionId, identity, context, tableName, ImmutableSet.of("column")); accessControlManager.checkCanCreateViewWithSelectFromColumns(transactionId, identity, context, tableName, ImmutableSet.of("column")); Set<String> catalogs = ImmutableSet.of("catalog"); assertEquals(accessControlManager.filterCatalogs(identity, context, catalogs), catalogs); Set<String> schemas = ImmutableSet.of("schema"); assertEquals(accessControlManager.filterSchemas(transactionId, identity, context, "catalog", schemas), schemas); Set<SchemaTableName> tableNames = ImmutableSet.of(new SchemaTableName("schema", "table")); assertEquals(accessControlManager.filterTables(transactionId, identity, context, "catalog", tableNames), tableNames); }); try { transaction(transactionManager, accessControlManager) .execute(transactionId -> { accessControlManager.checkCanInsertIntoTable(transactionId, identity, context, tableName); }); fail(); } catch (AccessDeniedException expected) { } }