fix(trino): allow scoped table and view definition reads

Author: EDsCODE

README.md

@@ -96,6 +96,11 @@ for deployment requirements, local verification, and recovery.
 See the [Trino admin API documentation](controlplane/admin/README.md#trino-cell-views-trinogo--trino_clientgo)
 for local verification, compatibility details, and recovery instructions.
 
+Trino `SHOW CREATE TABLE` and `SHOW CREATE VIEW` use the same catalog, schema,
+and relation read grants as table reads. Project-scoped logins can inspect only
+relations their scope permits; this does not grant access to the `system` catalog.
+Run `just test-trino-opa` to check the authorization policy locally.
+
 ## Metrics
 
 Duckgres exposes Prometheus metrics on `:9090/metrics`. The metrics port is currently fixed at 9090 and cannot be changed via configuration.

controlplane/provisioner/opa/policy.rego

@@ -459,6 +459,16 @@ allow if {
 	)
 }
 
+# Trino uses this operation for both SHOW CREATE TABLE and SHOW CREATE VIEW.
+allow if {
+	input.action.operation == "ShowCreateTable"
+	readable_table(
+		input.action.resource.table.catalogName,
+		input.action.resource.table.schemaName,
+		input.action.resource.table.tableName,
+	)
+}
+
 allow if {
 	input.action.operation == "FilterTables"
 	readable_table(

controlplane/provisioner/opa/policy_test.go

@@ -293,7 +293,7 @@ func TestSchemaScopeOps(t *testing.T) {
 func TestTableScopeOps(t *testing.T) {
 	q := preparedPolicy(t, twoOrgFixture())
 
-	for _, op := range []string{"SelectFromColumns", "FilterTables", "ShowColumns", "FilterColumns"} {
+	for _, op := range []string{"SelectFromColumns", "ShowCreateTable", "FilterTables", "ShowColumns", "FilterColumns"} {
 		if !evalAllow(t, q, buildInput("42", op, tableResource("org_42", "public", "events"))) {
 			t.Errorf("%s on own catalog must allow", op)
 		}
@@ -306,6 +306,30 @@ func TestTableScopeOps(t *testing.T) {
 	}
 }
 
+func TestShowCreateTableReadAuthority(t *testing.T) {
+	q := preparedPolicy(t, twoOrgFixture())
+	for _, tc := range []struct {
+		name    string
+		user    string
+		catalog string
+		allowed bool
+	}{
+		{"admin bundle read grant", AdminPrincipal, "org_42", true},
+		{"admin orphan catalog", AdminPrincipal, "org_99", false},
+		{"observer", ObserverPrincipal, "org_42", false},
+		{"tenant system catalog", "42", "system", false},
+		{"admin system catalog", AdminPrincipal, "system", false},
+		{"observer system catalog", ObserverPrincipal, "system", false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := evalAllow(t, q, buildInput(tc.user, "ShowCreateTable", tableResource(tc.catalog, "metadata", "table_comments")))
+			if got != tc.allowed {
+				t.Errorf("ShowCreateTable = %v, want %v", got, tc.allowed)
+			}
+		})
+	}
+}
+
 // --------------------------------------------------------------------------
 // Tenant writes: a customer has full DuckLake DDL/DML authority inside the
 // catalog projected for its org, and no write authority anywhere else.
@@ -853,6 +877,7 @@ func TestIsolationMatrix(t *testing.T) {
 		{"FilterSchemas", func(c string) map[string]interface{} { return schemaResource(c, "s") }},
 		{"ShowTables", func(c string) map[string]interface{} { return schemaResource(c, "s") }},
 		{"SelectFromColumns", func(c string) map[string]interface{} { return tableResource(c, "s", "t") }},
+		{"ShowCreateTable", func(c string) map[string]interface{} { return tableResource(c, "s", "t") }},
 		{"FilterTables", func(c string) map[string]interface{} { return tableResource(c, "s", "t") }},
 		{"ShowColumns", func(c string) map[string]interface{} { return tableResource(c, "s", "t") }},
 		{"FilterColumns", func(c string) map[string]interface{} { return tableResource(c, "s", "t") }},
@@ -1959,7 +1984,7 @@ func TestScopedGroupReadsOnlyItsOwnSchemas(t *testing.T) {
 		{"a shared schema it holds no grant in", "public", "anything", false},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			for _, op := range []string{"SelectFromColumns", "FilterTables", "ShowColumns"} {
+			for _, op := range []string{"SelectFromColumns", "ShowCreateTable", "FilterTables", "ShowColumns"} {
 				got := evalAllow(t, q, tableInput(op, "org_acme", tc.schema, tc.table, scopedIdentity()))
 				if got != tc.want {
 					t.Errorf("%s on %s.%s = %v, want %v", op, tc.schema, tc.table, got, tc.want)
@@ -1978,11 +2003,13 @@ func TestScopedGroupRelationGrantDoesNotLeakItsSchema(t *testing.T) {
 	gc, gs := scopedFixture()
 	q := preparedScopedPolicy(t, gc, gs)
 
-	if !evalAllow(t, q, tableInput("SelectFromColumns", "org_acme", "posthog", "events", scopedIdentity())) {
-		t.Error("granted relation posthog.events must be readable")
-	}
-	if evalAllow(t, q, tableInput("SelectFromColumns", "org_acme", "posthog", "persons", scopedIdentity())) {
-		t.Error("posthog.persons was NOT granted and must not be readable")
+	for _, op := range []string{"SelectFromColumns", "ShowCreateTable"} {
+		if !evalAllow(t, q, tableInput(op, "org_acme", "posthog", "events", scopedIdentity())) {
+			t.Errorf("%s must allow the granted relation posthog.events", op)
+		}
+		if evalAllow(t, q, tableInput(op, "org_acme", "posthog", "persons", scopedIdentity())) {
+			t.Errorf("%s must deny the ungranted relation posthog.persons", op)
+		}
 	}
 }
 
@@ -2013,7 +2040,7 @@ func TestScopedGroupStillCannotCrossTenants(t *testing.T) {
 	gc, gs := scopedFixture()
 	q := preparedScopedPolicy(t, gc, gs)
 
-	for _, op := range []string{"SelectFromColumns", "FilterTables", "ShowColumns"} {
+	for _, op := range []string{"SelectFromColumns", "ShowCreateTable", "FilterTables", "ShowColumns"} {
 		if evalAllow(t, q, tableInput(op, "org_other", "posthog_7", "events", scopedIdentity())) {
 			t.Errorf("%s reached another tenant's catalog", op)
 		}

justfile

@@ -333,6 +333,11 @@ test-controlplane:
 test-configstore-integration:
     go test -v -count=1 ./tests/configstore/...
 
+# Test Trino authorization policy, including tenant and project isolation
+[group('test')]
+test-trino-opa pattern="":
+    go test -v -count=1 -run '{{pattern}}' ./controlplane/provisioner/opa
+
 # Run Kubernetes-only control plane package tests
 [group('test')]
 test-trino pattern="Trino":