gaborkaszab commented on code in PR #18198:
URL: https://github.com/apache/iceberg/pull/18198#discussion_r4071904729
##########
core/src/main/java/org/apache/iceberg/encryption/InputFilesDecryptor.java:
##########
@@ -18,51 +18,80 @@
*/
package org.apache.iceberg.encryption;
-import java.nio.ByteBuffer;
-import java.util.Collections;
+import java.util.Collection;
import java.util.Map;
-import java.util.stream.Stream;
import org.apache.iceberg.CombinedScanTask;
+import org.apache.iceberg.ContentFile;
+import org.apache.iceberg.DeleteFile;
import org.apache.iceberg.FileScanTask;
import org.apache.iceberg.io.FileIO;
import org.apache.iceberg.io.InputFile;
import org.apache.iceberg.relocated.com.google.common.base.Preconditions;
import org.apache.iceberg.relocated.com.google.common.collect.Maps;
+/** Resolves the files referenced by scan tasks into readable, decrypted
{@link InputFile}s. */
public class InputFilesDecryptor {
- private final Map<String, InputFile> decryptedInputFiles;
+ private final Iterable<? extends ContentFile<?>> referencedFiles;
+ private final EncryptingFileIO encryptingIO;
+ private Map<String, InputFile> lazyInputFiles = null;
+ /**
+ * @deprecated since 1.12.0, will be removed in 1.13.0; use {@link
#fromTasks(Iterable,
+ * EncryptingFileIO)} instead.
+ */
+ @Deprecated
public InputFilesDecryptor(
CombinedScanTask combinedTask, FileIO io, EncryptionManager encryption) {
- Map<String, ByteBuffer> keyMetadata = Maps.newHashMap();
- combinedTask.files().stream()
- .flatMap(
- fileScanTask ->
- Stream.concat(Stream.of(fileScanTask.file()),
fileScanTask.deletes().stream()))
- .forEach(file -> keyMetadata.put(file.location(), file.keyMetadata()));
- Stream<EncryptedInputFile> encrypted =
- keyMetadata.entrySet().stream()
- .map(
- entry ->
- EncryptedFiles.encryptedInput(
- io.newInputFile(entry.getKey()), entry.getValue()));
+ this(
+ () -> referencedFiles(combinedTask.files()).iterator(),
+ EncryptingFileIO.combine(io, encryption));
+ }
+
+ public static InputFilesDecryptor fromTasks(
+ Iterable<FileScanTask> tasks, EncryptingFileIO encryptingIO) {
+ return new InputFilesDecryptor(() -> referencedFiles(tasks).iterator(),
encryptingIO);
+ }
+
+ private InputFilesDecryptor(
+ Iterable<? extends ContentFile<?>> files, EncryptingFileIO encryptingIO)
{
+ this.referencedFiles = files;
+ this.encryptingIO = encryptingIO;
+ }
+
+ private Map<String, InputFile> inputFiles() {
+ if (lazyInputFiles == null) {
+ this.lazyInputFiles = encryptingIO.bulkDecrypt(referencedFiles);
Review Comment:
I did some reading on this, and you're right, initialization is now
happening elsewhere, and there might be concurrency.
Made adjustments in a way not to block readers once the map is populated,
and guard against the population of the map.
##########
core/src/test/java/org/apache/iceberg/encryption/TestInputFilesDecryptor.java:
##########
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.iceberg.encryption;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
+
+import org.apache.iceberg.ContentFile;
+import org.apache.iceberg.DataFile;
+import org.apache.iceberg.DataFiles;
+import org.apache.iceberg.DeleteFile;
+import org.apache.iceberg.FileFormat;
+import org.apache.iceberg.FileMetadata;
+import org.apache.iceberg.MockFileScanTask;
+import org.apache.iceberg.PartitionSpec;
+import org.apache.iceberg.io.InputFile;
+import org.apache.iceberg.relocated.com.google.common.collect.ImmutableList;
+import org.apache.iceberg.relocated.com.google.common.collect.ImmutableMap;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mockito;
+
+class TestInputFilesDecryptor {
+
+ private static final PartitionSpec SPEC = PartitionSpec.unpartitioned();
+
+ private static final DataFile DATA_FILE =
+ DataFiles.builder(SPEC)
+ .withPath("/path/to/data.parquet")
+ .withFileSizeInBytes(123L)
+ .withRecordCount(10L)
+ .withFormat(FileFormat.PARQUET)
+ .build();
+
+ private static final DataFile OTHER_DATA_FILE =
+ DataFiles.builder(SPEC)
+ .withPath("/path/to/other-data.parquet")
+ .withFileSizeInBytes(321L)
+ .withRecordCount(10L)
+ .withFormat(FileFormat.PARQUET)
+ .build();
+
+ private static final DeleteFile DELETE_FILE =
+ FileMetadata.deleteFileBuilder(SPEC)
+ .ofPositionDeletes()
+ .withPath("/path/to/deletes.parquet")
+ .withFileSizeInBytes(45L)
+ .withRecordCount(2L)
+ .withFormat(FileFormat.PARQUET)
+ .build();
+
+ private EncryptingFileIO encryptingIO;
+ private InputFile dataInputFile;
+ private InputFile deleteInputFile;
+
+ @BeforeEach
+ void before() {
+ this.dataInputFile = Mockito.mock(InputFile.class);
+ this.deleteInputFile = Mockito.mock(InputFile.class);
+ this.encryptingIO = Mockito.mock(EncryptingFileIO.class);
Review Comment:
I saw in recent reviews that we tend to mock the classes that are not
directly related to the class we test. Here, we exercise InputFilesDecryptor,
but not EncryptingFileIO itself. I think it's cleaner to mock EncryptingFileIO
here because what matters is if and how many time `bulkDecrypt()` is called.
##########
core/src/main/java/org/apache/iceberg/encryption/InputFilesDecryptor.java:
##########
@@ -18,51 +18,80 @@
*/
package org.apache.iceberg.encryption;
-import java.nio.ByteBuffer;
-import java.util.Collections;
+import java.util.Collection;
import java.util.Map;
-import java.util.stream.Stream;
import org.apache.iceberg.CombinedScanTask;
+import org.apache.iceberg.ContentFile;
+import org.apache.iceberg.DeleteFile;
import org.apache.iceberg.FileScanTask;
import org.apache.iceberg.io.FileIO;
import org.apache.iceberg.io.InputFile;
import org.apache.iceberg.relocated.com.google.common.base.Preconditions;
import org.apache.iceberg.relocated.com.google.common.collect.Maps;
+/** Resolves the files referenced by scan tasks into readable, decrypted
{@link InputFile}s. */
public class InputFilesDecryptor {
- private final Map<String, InputFile> decryptedInputFiles;
+ private final Iterable<? extends ContentFile<?>> referencedFiles;
+ private final EncryptingFileIO encryptingIO;
+ private Map<String, InputFile> lazyInputFiles = null;
+ /**
+ * @deprecated since 1.12.0, will be removed in 1.13.0; use {@link
#fromTasks(Iterable,
+ * EncryptingFileIO)} instead.
+ */
+ @Deprecated
public InputFilesDecryptor(
CombinedScanTask combinedTask, FileIO io, EncryptionManager encryption) {
- Map<String, ByteBuffer> keyMetadata = Maps.newHashMap();
- combinedTask.files().stream()
- .flatMap(
- fileScanTask ->
- Stream.concat(Stream.of(fileScanTask.file()),
fileScanTask.deletes().stream()))
- .forEach(file -> keyMetadata.put(file.location(), file.keyMetadata()));
- Stream<EncryptedInputFile> encrypted =
- keyMetadata.entrySet().stream()
- .map(
- entry ->
- EncryptedFiles.encryptedInput(
- io.newInputFile(entry.getKey()), entry.getValue()));
+ this(
+ () -> referencedFiles(combinedTask.files()).iterator(),
+ EncryptingFileIO.combine(io, encryption));
+ }
+
+ public static InputFilesDecryptor fromTasks(
+ Iterable<FileScanTask> tasks, EncryptingFileIO encryptingIO) {
+ return new InputFilesDecryptor(() -> referencedFiles(tasks).iterator(),
encryptingIO);
+ }
+
+ private InputFilesDecryptor(
+ Iterable<? extends ContentFile<?>> files, EncryptingFileIO encryptingIO)
{
+ this.referencedFiles = files;
+ this.encryptingIO = encryptingIO;
+ }
+
+ private Map<String, InputFile> inputFiles() {
+ if (lazyInputFiles == null) {
+ this.lazyInputFiles = encryptingIO.bulkDecrypt(referencedFiles);
+ }
+
+ return lazyInputFiles;
+ }
- // decrypt with the batch call to avoid multiple RPCs to a key server, if
possible
- @SuppressWarnings("StreamToIterable")
- Iterable<InputFile> decryptedFiles =
encryption.decrypt(encrypted::iterator);
+ private static Collection<ContentFile<?>>
referencedFiles(Iterable<FileScanTask> tasks) {
+ Map<String, ContentFile<?>> files = Maps.newHashMap();
+ for (FileScanTask task : tasks) {
+ files.put(task.file().location(), task.file());
+ for (DeleteFile delete : task.deletes()) {
+ files.put(delete.location(), delete);
+ }
+ }
- Map<String, InputFile> files =
Maps.newHashMapWithExpectedSize(keyMetadata.size());
- decryptedFiles.forEach(decrypted ->
files.putIfAbsent(decrypted.location(), decrypted));
- this.decryptedInputFiles = Collections.unmodifiableMap(files);
+ return files.values();
}
+ /**
+ * @deprecated since 1.12.0, will be removed in 1.13.0; use {@link
#getInputFile(String)} instead.
+ */
+ @Deprecated
public InputFile getInputFile(FileScanTask task) {
Preconditions.checkArgument(!task.isDataTask(), "Invalid task type");
- return decryptedInputFiles.get(task.file().location());
+ return getInputFile(task.file().location());
}
public InputFile getInputFile(String location) {
- return decryptedInputFiles.get(location);
+ InputFile inputFile = inputFiles().get(location);
+ Preconditions.checkArgument(
Review Comment:
Before this change I checked where this is used. For me a Precondition here
seems to make sense, because if returning null it is passed to
`FormatModelRegistry` and sooner or later throws an NPE when trying to access
its members.
Not sure about external users of this class. I wouldn't expect to have any,
and anyway signaling that some invariant went wrong (missing file in the map)
is beneficial for all users.
WDYT?
##########
core/src/main/java/org/apache/iceberg/encryption/InputFilesDecryptor.java:
##########
@@ -18,51 +18,80 @@
*/
package org.apache.iceberg.encryption;
-import java.nio.ByteBuffer;
-import java.util.Collections;
+import java.util.Collection;
import java.util.Map;
-import java.util.stream.Stream;
import org.apache.iceberg.CombinedScanTask;
+import org.apache.iceberg.ContentFile;
+import org.apache.iceberg.DeleteFile;
import org.apache.iceberg.FileScanTask;
import org.apache.iceberg.io.FileIO;
import org.apache.iceberg.io.InputFile;
import org.apache.iceberg.relocated.com.google.common.base.Preconditions;
import org.apache.iceberg.relocated.com.google.common.collect.Maps;
+/** Resolves the files referenced by scan tasks into readable, decrypted
{@link InputFile}s. */
public class InputFilesDecryptor {
- private final Map<String, InputFile> decryptedInputFiles;
+ private final Iterable<? extends ContentFile<?>> referencedFiles;
+ private final EncryptingFileIO encryptingIO;
+ private Map<String, InputFile> lazyInputFiles = null;
+ /**
+ * @deprecated since 1.12.0, will be removed in 1.13.0; use {@link
#fromTasks(Iterable,
+ * EncryptingFileIO)} instead.
+ */
+ @Deprecated
public InputFilesDecryptor(
CombinedScanTask combinedTask, FileIO io, EncryptionManager encryption) {
- Map<String, ByteBuffer> keyMetadata = Maps.newHashMap();
- combinedTask.files().stream()
- .flatMap(
- fileScanTask ->
- Stream.concat(Stream.of(fileScanTask.file()),
fileScanTask.deletes().stream()))
- .forEach(file -> keyMetadata.put(file.location(), file.keyMetadata()));
- Stream<EncryptedInputFile> encrypted =
- keyMetadata.entrySet().stream()
- .map(
- entry ->
- EncryptedFiles.encryptedInput(
- io.newInputFile(entry.getKey()), entry.getValue()));
+ this(
+ () -> referencedFiles(combinedTask.files()).iterator(),
Review Comment:
With that approach we need to keep a `FileScanTask` list internally that we
can pass later to `referencedFiles`. I preferred an internal
Iterable<ContentFile> that is more generic, and might come handy if we want to
allow users to pass exactly that as a param.
WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
