RANGER-5634: CTAS and temporary-table queries must authorize UDF SELECT

[ramackri]

Summary

Backport of 409e8a72 / #1012 to ranger-2.9.

For CREATETABLE_AS_SELECT and CREATE_MATERIALIZED_VIEW, treat input FUNCTION privilege objects as SELECT so CTAS/temp-table queries cannot bypass UDF select authorization.

Fixes RANGER-5634.

Changes

File	Change
hive-agent/.../RangerHiveAuthorizer.java	Map input FUNCTION objects to HiveAccessType.SELECT for CTAS / create materialized view

Note: Unit tests from #1012 (TestRangerHiveAuthorizer) are not included — that test class does not exist on ranger-2.9. Production fix only.

Test plan

• Manual: user without UDF SELECT should get HiveAccessControlException on CREATE TABLE ... AS SELECT ... using that UDF
• Manual: plain SELECT with UDF still denied as before
• CI build-8 green on ranger-2.9

Made with Cursor