{
  "serviceName": "hivedev",
  "serviceDef": {
    "name": "hive",
    "id": 3,
    "resources": [
      {
        "name": "database",
        "level": 1,
        "mandatory": true,
        "lookupSupported": true,
        "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
        "matcherOptions": {
          "wildCard": true,
          "ignoreCase": true
        },
        "label": "Hive Database",
        "description": "Hive Database"
      },
      {
        "name": "table",
        "level": 2,
        "parent": "database",
        "mandatory": true,
        "lookupSupported": true,
        "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
        "matcherOptions": {
          "wildCard": true,
          "ignoreCase": true
        },
        "label": "Hive Table",
        "description": "Hive Table"
      },
      {
        "name": "udf",
        "level": 2,
        "parent": "database",
        "mandatory": true,
        "lookupSupported": true,
        "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
        "matcherOptions": {
          "wildCard": true,
          "ignoreCase": true
        },
        "label": "Hive UDF",
        "description": "Hive UDF"
      },
      {
        "name": "column",
        "level": 3,
        "parent": "table",
        "mandatory": true,
        "lookupSupported": true,
        "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
        "matcherOptions": {
          "wildCard": true,
          "ignoreCase": true
        },
        "label": "Hive Column",
        "description": "Hive Column"
      }
    ],
    "accessTypes": [
      {
        "name": "select",
        "label": "Select"
      },
      {
        "name": "update",
        "label": "Update"
      },
      {
        "name": "create",
        "label": "Create"
      },
      {
        "name": "grant",
        "label": "Grant"
      },
      {
        "name": "drop",
        "label": "Drop"
      },
      {
        "name": "alter",
        "label": "Alter"
      },
      {
        "name": "index",
        "label": "Index"
      },
      {
        "name": "lock",
        "label": "Lock"
      },
      {
        "name": "all",
        "label": "All",
        "impliedGrants": [
          "select",
          "update",
          "create",
          "grant",
          "drop",
          "alter",
          "index",
          "lock"
        ]
      }
    ],
    "dataMaskDef": {
      "maskTypes": [
        {
          "itemId": 1,
          "name": "MASK",
          "label": "Mask",
          "description": "Replace lowercase with 'x', uppercase with 'X', digits with '0'"
        },
        {
          "itemId": 2,
          "name": "SHUFFLE",
          "label": "Shuffle",
          "description": "Randomly shuffle the contents"
        },
        {
          "itemId": 10,
          "name": "NULL",
          "label": "NULL",
          "description": "Replace with NULL"
        }

      ],
      "accessTypes":[
        {"name":"select","label":"Select"}
      ],
      "resources":[
        {"name":"database","matcherOptions":{"wildCard":false}},
        {"name":"table","matcherOptions":{"wildCard":false}},
        {"name":"column","matcherOptions":{"wildCard":false}}
      ]
    },
    "rowFilterDef": {
      "accessTypes":[
        {"name":"select","label":"Select"}
      ],
      "resources":[
        {"name":"database","matcherOptions":{"wildCard":false}},
        {"name":"table","matcherOptions":{"wildCard":false}}
      ]
    }
  },
  "policies": [
    {
      "id": 101,
      "name": "db=*: audit-all-access",
      "isEnabled": true,
      "isAuditEnabled": true,
      "resources": {
        "database": {
          "values": [
            "*"
          ]
        },
        "table": {
          "values": [
            "*"
          ]
        },
        "column": {
          "values": [
            "*"
          ]
        }
      },
      "policyItems": [
        {
          "accesses": [
            {
              "type": "all",
              "isAllowed": true
            }
          ],
          "users": [
            "hive",
            "user1",
            "user2"
          ],
          "groups": [
            "public"
          ],
          "delegateAdmin": false
        }
      ]
    },
    {
      "id": 102,
      "name": "db=*, udf=*: audit-all-access",
      "isEnabled": true,
      "isAuditEnabled": true,
      "resources": {
        "database": {
          "values": [
            "*"
          ]
        },
        "udf": {
          "values": [
            "*"
          ]
        }
      },
      "policyItems": [
        {
          "accesses": [
            {
              "type": "all",
              "isAllowed": true
            }
          ],
          "users": [
            "hive",
            "user1",
            "user2"
          ],
          "groups": [
            "public"
          ],
          "delegateAdmin": false
        }
      ]
    }
  ],
  "tagPolicyInfo": {
    "serviceName": "tagdev",
    "serviceDef": {
      "name": "tag",
      "id": 100,
      "resources": [
        {
          "itemId": 1,
          "name": "tag",
          "type": "string",
          "level": 1,
          "parent": "",
          "mandatory": true,
          "lookupSupported": true,
          "recursiveSupported": false,
          "excludesSupported": false,
          "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
          "matcherOptions": {
            "wildCard": false,
            "ignoreCase": false
          },
          "validationRegEx": "",
          "validationMessage": "",
          "uiHint": "",
          "label": "TAG",
          "description": "TAG"
        }
      ],
      "accessTypes": [
        {
          "itemId": 1,
          "name": "hive:select",
          "label": "hive:select"
        },
        {
          "itemId": 2,
          "name": "hive:update",
          "label": "hive:update"
        },
        {
          "itemId": 3,
          "name": "hive:create",
          "label": "hive:create"
        },
        {
          "itemId": 4,
          "name": "hive:grant",
          "label": "hive:grant"
        },
        {
          "itemId": 5,
          "name": "hive:drop",
          "label": "hive:drop"
        },
        {
          "itemId": 6,
          "name": "hive:alter",
          "label": "hive:alter"
        },
        {
          "itemId": 7,
          "name": "hive:index",
          "label": "hive:index"
        },
        {
          "itemId": 8,
          "name": "hive:lock",
          "label": "hive:lock"
        },
        {
          "itemId": 9,
          "name": "hive:all",
          "label": "hive:all",
          "impliedGrants": [
            "hive:select",
            "hive:update",
            "hive:create",
            "hive:grant",
            "hive:drop",
            "hive:alter",
            "hive:index",
            "hive:lock"
          ]
        }
      ],
      "dataMaskDef": {
        "maskTypes": [
          {
            "itemId": 1,
            "name": "MASK",
            "label": "Mask",
            "description": "Replace lowercase with 'x', uppercase with 'X', digits with '0'"
          },
          {
            "itemId": 2,
            "name": "SHUFFLE",
            "label": "Shuffle",
            "description": "Randomly shuffle the contents"
          },
          {
            "itemId": 10,
            "name": "NULL",
            "label": "NULL",
            "description": "Replace with NULL"
          }

        ],
        "accessTypes":[
          {"name":"hive:select","label":"hive:Select"}
        ],
        "resources":[
          {"name":"tag","matcherOptions":{"wildCard":false}}
        ]
      },
      "rowFilterDef": {
        "accessTypes":[
          {"name":"hive:select","label":"hive:Select"}
        ],
        "resources":[
          {"name":"tag","matcherOptions":{"wildCard":false}}
        ]
      },
      "contextEnrichers": [
      ],
      "policyConditions": [
        {
          "itemId": 1,
          "name": "expression",
          "evaluator": "org.apache.ranger.plugin.conditionevaluator.RangerScriptConditionEvaluator",
          "evaluatorOptions": {
            "engineName": "JavaScript",
            "ui.isMultiline": "true"
          },
          "label": "Enter boolean expression",
          "description": "Boolean expression"
        },
        {
          "itemId": 2,
          "name": "enforce-expiry",
          "evaluator": "org.apache.ranger.plugin.conditionevaluator.RangerScriptTemplateConditionEvaluator",
          "evaluatorOptions": {
            "scriptTemplate": "ctx.isAccessedAfter('expiry_date');"
          },
          "label": "Deny access after expiry_date?",
          "description": "Deny access after expiry_date? (yes/no)"
        }
      ]
    },
    "tagPolicies": [
      {
        "id": 1,
        "name": "RESTRICTED_TAG_POLICY",
        "isEnabled": true,
        "isAuditEnabled": true,
        "policyType": 1,
        "resources": {
          "tag": {
            "values": [
              "RESTRICTED"
            ],
            "isRecursive": false
          }
        },
        "dataMaskPolicyItems": [
          {
            "accesses": [
              {
                "type": "select",
                "isAllowed": true
              }
            ],
            "users": [
              "user1"
            ],
            "groups": [],
            "delegateAdmin": false,
            "dataMaskInfo": {
              "dataMaskType": "MASK"
            }
          },
          {
            "accesses": [
              {
                "type": "select",
                "isAllowed": true
              }
            ],
            "users": [
              "user2"
            ],
            "groups": [],
            "delegateAdmin": false,
            "dataMaskInfo": {
              "dataMaskType": "SHUFFLE"
            }
          }
        ]
      }
    ]
  },
  "tests": [
    {
      "name": "'select ssn from employee.personal;' for user1 - maskType=MASK",
      "request": {
        "resource": {
          "elements": {
            "database": "employee",
            "table": "personal",
            "column": "ssn"
          }
        },
        "accessType": "select",
        "user": "user1",
        "userGroups": [],
        "requestData": "select ssn from employee.personal;' for user1",
        "context": {
          "TAGS": "[{\"type\":\"RESTRICTED\"}]"
        }
      },
      "dataMaskResult":{"additionalInfo":{"maskType":"MASK","maskCondition":null,"maskValue":null},"policyId":1}
    },
    {
      "name": "'select ssn from employee.personal;' for user2 - maskType=SHUFFLE",
      "request": {
        "resource": {
          "elements": {
            "database": "employee",
            "table": "personal",
            "column": "ssn"
          }
        },
        "accessType": "select",
        "user": "user2",
        "userGroups": [],
        "requestData": "select ssn from employee.personal;' for user2",
        "context": {
          "TAGS": "[{\"type\":\"RESTRICTED\"}]"
        }
      },
      "dataMaskResult":{"additionalInfo":{"maskType":"SHUFFLE","maskCondition":null,"maskValue":null},"policyId":1}
    },
    {
      "name": "'select ssn from employee.personal;' for hive - maskType=NONE",
      "request": {
        "resource": {
          "elements": {
            "database": "employee",
            "table": "personal",
            "column": "ssn"
          }
        },
        "accessType": "select",
        "user": "hive",
        "userGroups": [],
        "requestData": "select ssn from employee.personal;' for hive",
        "context": {
          "TAGS": "[{\"type\":\"RESTRICTED\"}]"
        }
      },
      "dataMaskResult":{"additionalInfo":{"maskType":null,"maskCondition":null,"maskValue":null},"policyId":-1}
    }
  ]
}