Add support for Metadata Restriction in Presto

[imjalpreet]

Description

Add authorization support for SHOW CREATE TABLE/VIEW, SHOW COLUMNS and DESCRIBE queries

Motivation and Context

Enhance metadata authorization support in Presto

Part of #20851

Impact

Newly introduced access control callbacks:

• checkCanShowCreateTable
• checkCanShowColummsMetadata
• filterColumns

By default, the newly introduced access control callback methods enforce a deny policy.
To achieve the intended behavior, all custom implementations of SystemAccessControl or ConnectorAccessControl must explicitly implement these new callbacks.

Contributor checklist

• Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Security Changes
* Add authorization support for `SHOW CREATE TABLE`, `SHOW CREATE VIEW`, `SHOW COLUMNS`, and `DESCRIBE` queries

[prestodb-ci]

@imjalpreet imported this issue as lakehouse/presto #25364

[steveburnett]

Should the documentation be updated for these, such as https://prestodb.io/docs/current/sql/show-create-table.html? Maybe an example? What do you think?

[agrawalreetika]

Thanks for the PR. Apart from one comment, Overall LGTM.

[agrawalreetika]

Let's reduce the redundant code and create a new method for creating MetastoreContext and reuse it across

[imjalpreet]

Refactored this in a different commit to keep it separate from actual feature commits.

[agrawalreetika]

LGTM

[imjalpreet]

Should the documentation be updated for these, such as https://prestodb.io/docs/current/sql/show-create-table.html? Maybe an example? What do you think?

@steveburnett Sorry, I missed your comment earlier. This PR only adds access control checks for a few specific types of SQL statements. I’ll review whether any existing doc already covers the access control checks that were already implemented. If not, we can see if it is helpful to create a more detailed document outlining the various access control checks that Presto supports for different types of authorization.

[hantangwangd]

Thanks for the work, looks good to me overall! Just a few little things.

[steveburnett]

Should the documentation be updated for these, such as https://prestodb.io/docs/current/sql/show-create-table.html? Maybe an example? What do you think?

@steveburnett Sorry, I missed your comment earlier. This PR only adds access control checks for a few specific types of SQL statements. I’ll review whether any existing doc already covers the access control checks that were already implemented. If not, we can see if it is helpful to create a more detailed document outlining the various access control checks that Presto supports for different types of authorization.

Sounds good! I appreciate your explanation.

If you think we need a more detailed document, please open a issue with a docs label so we don't lose track of the need.

[imjalpreet]

If you think we need a more detailed document, please open a issue with a docs label so we don't lose track of the need.

@steveburnett I verified the current docs, we haven't documented SQL statement to required access control mapping for different types of authorization. I will think about what's the best way to document it and create an issue to track that.

[hantangwangd]

Thanks for the fix, looks good to me!

[rschlussel]

This needs a much clearer "impact" description in the PR and a more descriptive release note to make clear that these new methods need to be implemented by any access control plugins or else all show/describe queries will start to fail with access denied.

I also wonder if this should have defaulted to allow for Connector/System access control to keep backwards compatibility.

[imjalpreet]

@rschlussel I have updated the PR description to highlight the impact.