HIVE-29807

[dengzhhu653]

What changes were proposed in this pull request?

Why are the changes needed?

Does this PR introduce any user-facing change?

How was this patch tested?

[Copilot]

Pull request overview

This PR updates Hive’s analysis/authorization plumbing so that materialized CTEs propagate their underlying base-table inputs and column-access information (including nested materialized CTEs). This makes EXPLAIN hooks/test outputs and legacy authorization (V1) reflect the real tables/columns accessed, rather than only the temporary materialized CTE tables.

Changes:

• Switch multiple call sites (EXPLAIN, hooks, authorizer helpers) from getInputs() to getAllInputs() / getAllOutputs() so materialized-CTE sub-analyzer entities are included.
• Merge column-access info from materialized CTE sub-analyzers into the parent analyzer’s ColumnAccessInfo to support column-level authorization on base tables.
• Update LLAP q-test golden outputs and add a unit test for materialized CTE inputs + column access.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
ql/src/java/org/apache/hadoop/hive/ql/security/authorization/command/CommandAuthorizer.java	Use getAllInputs/getAllOutputs so authorization sees entities from materialized CTE sub-analyzers.
ql/src/java/org/apache/hadoop/hive/ql/security/authorization/command/CommandAuthorizerV1.java	Fall back to ColumnAccessInfo for table authorization column lists when direct scan-derived columns aren’t present.
ql/src/java/org/apache/hadoop/hive/ql/plan/ExplainWork.java	Populate EXPLAIN work inputs using getAllInputs().
ql/src/java/org/apache/hadoop/hive/ql/exec/ExplainTask.java	EXPLAIN formatted JSON uses getAllInputs() for auth-related entities.
ql/src/java/org/apache/hadoop/hive/ql/parse/ExplainSemanticAnalyzer.java	EXPLAIN semantic analyzer tracks getAllInputs().
ql/src/java/org/apache/hadoop/hive/ql/parse/DeleteSemanticAnalyzer.java	DELETE metadata-update path now uses getAllInputs() for inputs.
ql/src/java/org/apache/hadoop/hive/ql/parse/HiveSemanticAnalyzerHookContextImpl.java	Hook context inputs now include materialized CTE base-table reads via getAllInputs().
ql/src/java/org/apache/hadoop/hive/ql/parse/BaseSemanticAnalyzer.java	Transaction requirement check now considers getAllInputs() (materialized CTE sources included).
ql/src/java/org/apache/hadoop/hive/ql/parse/SemanticAnalyzer.java	getAllInputs/getAllOutputs recurse into materialized CTE analyzers; column-access attachment now targets getAllInputs; results cache query info now stores getAllInputs.
ql/src/java/org/apache/hadoop/hive/ql/parse/ColumnAccessInfo.java	Add merge(ColumnAccessInfo) helper for combining direct column accesses.
ql/src/java/org/apache/hadoop/hive/ql/parse/ColumnAccessAnalyzer.java	Merge materialized CTE sub-analyzer column access into the current analyzer’s column access info.
ql/src/test/org/apache/hadoop/hive/ql/parse/TestSemanticAnalyzer.java	Add unit test asserting getInputs() hides base tables for materialized CTEs while getAllInputs() and column access include them.
ql/src/test/results/clientpositive/llap/cte_mat_type.q.out	Update expected PREHOOK/POSTHOOK inputs to include base tables.
ql/src/test/results/clientpositive/llap/cte_mat_9.q.out	Update expected PREHOOK/POSTHOOK inputs to include materialized CTE table.
ql/src/test/results/clientpositive/llap/cte_mat_5.q.out	Update expected PREHOOK/POSTHOOK inputs to include base table src.
ql/src/test/results/clientpositive/llap/cte_mat_4.q.out	Update expected PREHOOK/POSTHOOK inputs to include base table src.
ql/src/test/results/clientpositive/llap/cte_mat_3.q.out	Update expected PREHOOK/POSTHOOK inputs to include base table src.
ql/src/test/results/clientpositive/llap/cte_mat_11.q.out	Update expected PREHOOK/POSTHOOK inputs to include nested materialized CTE/base-table inputs.
ql/src/test/results/clientpositive/llap/cte_3.q.out	Update expected PREHOOK/POSTHOOK inputs to include dependent CTE/base-table inputs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[nrg4878]

@mdayakar Could you please review this?

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.2% Duplication on New Code

See analysis details on SonarQube Cloud

[soumyakanti3578]

LGTM

[mdayakar]

Do we need to handle getAllOutputs() for code consistency, please check.

[dengzhhu653]

We would create a temp table for materialized cte, the getAllOutputs will require the permission on the current database and the location the temp table wrote into, even when the original query doesn't touch them, the CTE doesn't contain outputs needed for auth check.