Skip to content

[#7542] feat(authz): Support table authorization #7554

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 41 commits into from
Jul 9, 2025
Merged

[#7542] feat(authz): Support table authorization #7554

merged 41 commits into from
Jul 9, 2025

Conversation

yunchipang
Copy link
Contributor

What changes were proposed in this pull request?

Support table authorization.

Why are the changes needed?

Fix: #7542

Does this PR introduce any user-facing change?

No.

How was this patch tested?

org.apache.gravitino.client.integration.test.authorization.TableAuthorizationIT

@yunchipang yunchipang changed the base branch from main to branch-metadata-authz July 2, 2025 22:01
@yunchipang
Copy link
Contributor Author

note: will rebase against #7536 after it's merged.

@yunchipang yunchipang force-pushed the support-table-auth branch from 5799fa3 to 12d8bdc Compare July 3, 2025 17:45
hdygxsj added 3 commits July 4, 2025 23:48
@hdygxsj
Merge remote-tracking branch 'upstream/branch-metadata-authz' into su…
fa2d5e7 
…pport-table-auth

# Conflicts:
#	core/src/main/java/org/apache/gravitino/authorization/OwnerManager.java
#	server/src/main/java/org/apache/gravitino/server/web/filter/GravitinoInterceptionService.java
#	server/src/main/java/org/apache/gravitino/server/web/rest/SchemaOperations.java
@hdygxsj
fix ci
677c7fc
@hdygxsj
alter expression
07091f9
@yunchipang yunchipang marked this pull request as ready for review July 7, 2025 04:46
@hdygxsj
Copy link
Collaborator

hdygxsj commented Jul 8, 2025

All comment fixed, PHAL @jerqi

FANNG1
FANNG1 reviewed Jul 8, 2025
View reviewed changes
server/src/main/java/org/apache/gravitino/server/web/rest/TableOperations.java Outdated
@@ -140,11 +164,21 @@ public Response createTable(
@Produces("application/vnd.gravitino.v1+json")
@Timed(name = "load-table." + MetricNames.HTTP_PROCESS_DURATION, absolute = true)
@ResponseMetered(name = "load-table", absolute = true)
@AuthorizationExpression(
expression =
"((ANY(USE_CATALOG,METALAKE,CATALOG)) && "
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's hard to review the expressions. is there any way to make it more readable? And add UT for the expression since it's complicated?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expanding the expressions inside the parentheses may make it easier to understand, but it could lead to OGNL repeatedly evaluating the same expression. I'm currently working on adding unit tests and exploring whether it's possible to implement boolean expression optimization.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's hard to review the expressions. is there any way to make it more readable? And add UT for the expression since it's complicated?

The authorization expression has been optimized. Please check if it meets the expectations.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's hard to review the expressions. is there any way to make it more readable? And add UT for the expression since it's complicated?

fixed

jerqi
jerqi reviewed Jul 8, 2025
View reviewed changes
server/src/main/java/org/apache/gravitino/server/web/rest/TableOperations.java Outdated
" ((ANY(USE_CATALOG,METALAKE,CATALOG)) && "
+ "((ANY(USE_SCHEMA,METALAKE,CATALOG,SCHEMA)) "
+ "&& (ANY(CREATE_TABLE,METALAKE,CATALOG,SCHEMA)) || SCHEMA::OWNER)) || "
+ "METALAKE::OWNER || CATALOG::OWNER",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we use ANY OWNER here?

Copy link
Collaborator

@hdygxsj hdygxsj Jul 8, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

jerqi
jerqi reviewed Jul 8, 2025
View reviewed changes
server/src/main/java/org/apache/gravitino/server/web/rest/TableOperations.java Outdated
@AuthorizationExpression(
expression =
" ((ANY(USE_CATALOG,METALAKE,CATALOG)) && "
+ "((ANY(USE_SCHEMA,METALAKE,CATALOG,SCHEMA)) "
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rebundant ()

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

@hdygxsj
Copy link
Collaborator

hdygxsj commented Jul 8, 2025

All comments fixed,PHAL @FANNG1 @jerqi

@hdygxsj hdygxsj self-assigned this Jul 9, 2025
jerqi
jerqi reviewed Jul 9, 2025
View reviewed changes
server/src/main/java/org/apache/gravitino/server/web/rest/TableOperations.java Outdated
@AuthorizationExpression(
expression =
"ANY(OWNER,METALAKE,CATALOG) ||"
+ "SCHEMA::OWNER && ANY_USE_CATALOG ||"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we use expression to replace SCHEMA::OWNER && ANY_USE_CATALOG, too?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about using SCHEMA_OWNER_WITH_USE_CATALOG to replace? But it seems not shorter than CHEMA::OWNER && ANY_USE_CATALOG😄.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK for me. It's more clear for me.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK for me. It's more clear for me.

OK, fixed, PHAL

@jerqi
Copy link
Contributor

jerqi commented Jul 9, 2025

Could use modify the schema and catalog operations according to new expression replacement?

hdygxsj added 4 commits July 9, 2025 14:29
@hdygxsj
modify catalog and schema authorization expression
6277152
@hdygxsj
Merge remote-tracking branch 'mz/support-table-auth' into support-tab…
72ea975 
…le-auth

# Conflicts:
#	server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConverter.java
@hdygxsj
modify catalog and schema authorization expression
5dd7c17
@hdygxsj
add blank
8ee8186
@hdygxsj
Copy link
Collaborator

hdygxsj commented Jul 9, 2025

Could use modify the schema and catalog operations according to new expression replacement?

Fixed, PHAL

jerqi
jerqi approved these changes Jul 9, 2025
View reviewed changes
Copy link
Contributor

@jerqi jerqi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

xunliu
xunliu approved these changes Jul 9, 2025
View reviewed changes
Copy link
Member

@xunliu xunliu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@xunliu xunliu merged commit f79c1ae into apache:branch-metadata-authz Jul 9, 2025
32 of 34 checks passed
hdygxsj added a commit to hdygxsj/gravitino that referenced this pull request Jul 15, 2025
@yunchipang @hdygxsj
[apache#7542] feat(authz): Support table authorization (apache#7554)
f18da23 
<!--
1. Title: [#<issue>] <type>(<scope>): <subject>
   Examples:
     - "[apache#123] feat(operator): support xxx"
     - "[apache#233] fix: check null before access result in xxx"
     - "[MINOR] refactor: fix typo in variable name"
     - "[MINOR] docs: fix typo in README"
     - "[apache#255] test: fix flaky test NameOfTheTest"
   Reference: https://www.conventionalcommits.org/en/v1.0.0/
2. If the PR is unfinished, please mark this PR as draft.
-->

### What changes were proposed in this pull request?

Support table authorization.

### Why are the changes needed?

Fix: apache#7542

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?


`org.apache.gravitino.client.integration.test.authorization.TableAuthorizationIT`

---------

Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com>
Co-authored-by: 1161623489@qq.com <1161623489@qq.com>
@yunchipang yunchipang deleted the support-table-auth branch July 15, 2025 02:17
hdygxsj added a commit to hdygxsj/gravitino that referenced this pull request Jul 15, 2025
@yunchipang @hdygxsj
[apache#7542] feat(authz): Support table authorization (apache#7554)
6a5f5ed 
<!--
1. Title: [#<issue>] <type>(<scope>): <subject>
   Examples:
     - "[apache#123] feat(operator): support xxx"
     - "[apache#233] fix: check null before access result in xxx"
     - "[MINOR] refactor: fix typo in variable name"
     - "[MINOR] docs: fix typo in README"
     - "[apache#255] test: fix flaky test NameOfTheTest"
   Reference: https://www.conventionalcommits.org/en/v1.0.0/
2. If the PR is unfinished, please mark this PR as draft.
-->

### What changes were proposed in this pull request?

Support table authorization.

### Why are the changes needed?

Fix: apache#7542

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?


`org.apache.gravitino.client.integration.test.authorization.TableAuthorizationIT`

---------

Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com>
Co-authored-by: 1161623489@qq.com <1161623489@qq.com>
jerryshao pushed a commit that referenced this pull request Jul 15, 2025
@yunchipang @hdygxsj @jerryshao
[#7542] feat(authz): Support table authorization (#7554)
b21994e 
<!--
1. Title: [#<issue>] <type>(<scope>): <subject>
   Examples:
     - "[#123] feat(operator): support xxx"
     - "[#233] fix: check null before access result in xxx"
     - "[MINOR] refactor: fix typo in variable name"
     - "[MINOR] docs: fix typo in README"
     - "[#255] test: fix flaky test NameOfTheTest"
   Reference: https://www.conventionalcommits.org/en/v1.0.0/
2. If the PR is unfinished, please mark this PR as draft.
-->

### What changes were proposed in this pull request?

Support table authorization.

### Why are the changes needed?

Fix: #7542

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?


`org.apache.gravitino.client.integration.test.authorization.TableAuthorizationIT`

---------

Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com>
Co-authored-by: 1161623489@qq.com <1161623489@qq.com>
jerqi pushed a commit to qqqttt123/gravitino that referenced this pull request Jul 30, 2025
@yunchipang @hdygxsj @jerqi
[apache#7542] feat(authz): Support table authorization (apache#7554)
b0739f6 
<!--
1. Title: [#<issue>] <type>(<scope>): <subject>
   Examples:
     - "[apache#123] feat(operator): support xxx"
     - "[apache#233] fix: check null before access result in xxx"
     - "[MINOR] refactor: fix typo in variable name"
     - "[MINOR] docs: fix typo in README"
     - "[apache#255] test: fix flaky test NameOfTheTest"
   Reference: https://www.conventionalcommits.org/en/v1.0.0/
2. If the PR is unfinished, please mark this PR as draft.
-->

### What changes were proposed in this pull request?

Support table authorization.

### Why are the changes needed?

Fix: apache#7542

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?


`org.apache.gravitino.client.integration.test.authorization.TableAuthorizationIT`

---------

Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com>
Co-authored-by: 1161623489@qq.com <1161623489@qq.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@FANNG1 FANNG1 FANNG1 left review comments

@xunliu xunliu xunliu approved these changes

@jerqi jerqi jerqi approved these changes

+1 more reviewer

@hdygxsj hdygxsj hdygxsj left review comments

Reviewers whose approvals may not affect merge requirements
Assignees

@hdygxsj hdygxsj

@yunchipang yunchipang

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Subtask] Support Table Authorization
5 participants
@yunchipang @hdygxsj @jerqi @xunliu @FANNG1