Skip to content

[#7545] feat(authz): Support fileset authorization #7581

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 18 commits into from
Jul 14, 2025
Merged

[#7545] feat(authz): Support fileset authorization #7581

merged 18 commits into from
Jul 14, 2025

Conversation

unknowntpo
Copy link
Contributor

What changes were proposed in this pull request?

Support fileset auth with annotation.

Why are the changes needed?

To support fileset auth.

Fix: #7545

Does this PR introduce any user-facing change?

Yes.

How was this patch tested?

FilesetAuthorizationIT

@unknowntpo unknowntpo changed the base branch from main to branch-metadata-authz July 6, 2025 06:33
@unknowntpo unknowntpo self-assigned this Jul 6, 2025
@unknowntpo unknowntpo requested a review from hdygxsj July 6, 2025 06:34
@unknowntpo unknowntpo marked this pull request as ready for review July 7, 2025 00:53
@unknowntpo unknowntpo marked this pull request as draft July 7, 2025 00:56
hdygxsj
hdygxsj reviewed Jul 7, 2025
View reviewed changes
server/src/main/java/org/apache/gravitino/server/web/rest/FilesetOperations.java
+ "|| SCHEMA::WRITE_FILESET || FILESET::WRITE_FILESET "
+ "|| METALAKE::OWNERSHIP || CATALOG::OWNERSHIP "
+ "|| SCHEMA::OWNERSHIP || FILESET::OWNERSHIP",
accessMetadataType = MetadataObject.Type.FILESET)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OWNER

server/src/main/java/org/apache/gravitino/server/web/rest/FilesetOperations.java Outdated
idents =
MetadataFilterHelper.filterByExpression(
metalake,
"METALAKE::READ_FILESET || CATALOG::READ_FILESET "
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

USE_CATALOG and USE_SCHEMA is required.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

hdygxsj
hdygxsj reviewed Jul 7, 2025
View reviewed changes
server/src/main/java/org/apache/gravitino/server/web/rest/FilesetOperations.java Outdated
idents =
MetadataFilterHelper.filterByExpression(
metalake,
"METALAKE::READ_FILESET || CATALOG::READ_FILESET "
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

server/src/main/java/org/apache/gravitino/server/web/rest/FilesetOperations.java Outdated
@AuthorizationExpression(
expression =
"METALAKE::READ_FILESET || CATALOG::READ_FILESET "
+ "|| SCHEMA::READ_FILESET || FILESET::READ_FILESET "
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

server/src/main/java/org/apache/gravitino/server/web/rest/FilesetOperations.java Outdated
@@ -308,6 +345,15 @@ public Response dropFileset(
@Produces("application/vnd.gravitino.v1+json")
@Timed(name = "get-file-location." + MetricNames.HTTP_PROCESS_DURATION, absolute = true)
@ResponseMetered(name = "get-file-location", absolute = true)
@AuthorizationExpression(
expression =
"METALAKE::READ_FILESET || CATALOG::READ_FILESET "
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

@unknowntpo unknowntpo force-pushed the feat-fileset-auth branch from 9150f56 to a9148fa Compare July 7, 2025 11:48
hdygxsj
hdygxsj reviewed Jul 8, 2025
View reviewed changes
.../java/org/apache/gravitino/client/integration/test/authorization/FilesetAuthorizationIT.java Outdated
Map<String, String> properties = Maps.newHashMap();
properties.put("metastore.uris", hmsUri);
properties.put("location", defaultBaseLocation());

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"fileset" is not using the Hive catalog

hdygxsj
hdygxsj reviewed Jul 10, 2025
View reviewed changes
Copy link
Collaborator

@hdygxsj hdygxsj left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pleace add ut for authorization expression refer to org.apache.gravitino.server.web.rest.authorization.TestTableAuthorizationExpression

server/src/main/java/org/apache/gravitino/server/web/rest/FilesetOperations.java Outdated
"ANY(OWNER, METALAKE, CATALOG, SCHEMA, FILESET) ||"
+ "("
+ " ANY(USE_CATALOG, METALAKE, CATALOG) && "
+ " ANY(USE_SCHEMA, METALAKE, CATALOG, SCHEMA) && "
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ANY(USE_SCHEMA, METALAKE, CATALOG, SCHEMA) replace to ANY_USE_SCHEMA
ANY(USE_CATALOG, METALAKE, CATALOG) replace to ANY_USE_CATALOG

server/src/main/java/org/apache/gravitino/server/web/rest/FilesetOperations.java Outdated
"ANY(OWNER, METALAKE, CATALOG, SCHEMA, FILESET) ||"
+ "("
+ " ANY(USE_CATALOG, METALAKE, CATALOG, SCHEMA) && "
+ " ( ANY(READ_FILESET, METALAKE, CATALOG, SCHEMA, FILESET) || ANY(WRITE_FILESET, METALAKE, CATALOG, SCHEMA, FILESET))"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please add a ANY_WRITE_FILESET in org.apache.gravitino.server.authorization.expression.AuthorizationExpressionConverter such as ANY_USE_CATALOG

server/src/main/java/org/apache/gravitino/server/web/rest/FilesetOperations.java Outdated
+ "|| METALAKE::OWNER || CATALOG::OWNER "
+ "|| SCHEMA::OWNER || FILESET::OWNER",
"ANY(WRITE_FILESET, METALAKE, CATALOG, SCHEMA, FILESET) || "
+ "ANY(OWNER, METALAKE, CATALOG, SCHEMA, FILESET)",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FILESET OWNER need USE_SCHEMA and USE_CATALOG

SCHEMA OWNER need USE_CATALOG

server/src/main/java/org/apache/gravitino/server/web/rest/FilesetOperations.java Outdated
@@ -330,15 +337,16 @@ public Response alterFileset(
@Timed(name = "drop-fileset." + MetricNames.HTTP_PROCESS_DURATION, absolute = true)
@ResponseMetered(name = "drop-fileset", absolute = true)
@AuthorizationExpression(
expression = "METALAKE::OWNER || CATALOG::OWNER " + "|| SCHEMA::OWNER || FILESET::OWNER",
expression = "ANY(OWNER, METALAKE, CATALOG, SCHEMA, FILESET)",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FILESET OWNER need USE_SCHEMA and USE_CATALOG

SCHEMA OWNER need USE_CATALOG

server/src/main/java/org/apache/gravitino/server/web/rest/FilesetOperations.java Outdated
+ "|| SCHEMA::WRITE_FILESET || FILESET::WRITE_FILESET "
+ "|| METALAKE::OWNER || CATALOG::OWNER "
+ "|| SCHEMA::OWNER || FILESET::OWNER",
"ANY(OWNER, METALAKE, CATALOG, SCHEMA, FILESET) ||"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FILESET OWNER need USE_SCHEMA and USE_CATALOG

SCHEMA OWNER need USE_CATALOG

hdygxsj added 2 commits July 10, 2025 21:28
@hdygxsj
Merge remote-tracking branch 'upstream/branch-metadata-authz' into fe…
79f55b5 
…at-fileset-auth

# Conflicts:
#	server-common/src/main/java/org/apache/gravitino/server/authorization/MetadataFilterHelper.java
#	server/src/main/java/org/apache/gravitino/server/web/filter/GravitinoInterceptionService.java
@hdygxsj
modify expression
d9dc46a
@hdygxsj
Copy link
Collaborator

hdygxsj commented Jul 10, 2025

All comments fixed, PHAL @jerqi

@unknowntpo unknowntpo marked this pull request as ready for review July 10, 2025 14:42
@hdygxsj hdygxsj self-assigned this Jul 10, 2025
jerqi
jerqi approved these changes Jul 11, 2025
View reviewed changes
Copy link
Contributor

@jerqi jerqi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, wait for CI.

@hdygxsj
Merge remote-tracking branch 'upstream/branch-metadata-authz' into fe…
13bdae7 
…at-fileset-auth

# Conflicts:
#	server-common/src/main/java/org/apache/gravitino/server/authorization/MetadataFilterHelper.java
#	server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConverter.java
#	server/src/main/java/org/apache/gravitino/server/web/filter/GravitinoInterceptionService.java
xunliu
xunliu approved these changes Jul 14, 2025
View reviewed changes
Copy link
Member

@xunliu xunliu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
hi @unknowntpo Thank you for your contributions.

@xunliu xunliu merged commit e49354f into apache:branch-metadata-authz Jul 14, 2025
30 checks passed
hdygxsj added a commit to hdygxsj/gravitino that referenced this pull request Jul 15, 2025
@unknowntpo @hdygxsj
[apache#7545] feat(authz): Support fileset authorization (apache#7581)
60bb98c 
<!--
1. Title: [#<issue>] <type>(<scope>): <subject>
   Examples:
     - "[apache#123] feat(operator): support xxx"
     - "[apache#233] fix: check null before access result in xxx"
     - "[MINOR] refactor: fix typo in variable name"
     - "[MINOR] docs: fix typo in README"
     - "[apache#255] test: fix flaky test NameOfTheTest"
   Reference: https://www.conventionalcommits.org/en/v1.0.0/
2. If the PR is unfinished, please mark this PR as draft.
-->

### What changes were proposed in this pull request?

Support fileset auth with annotation.

### Why are the changes needed?

To support fileset auth.

Fix: apache#7545

### Does this PR introduce _any_ user-facing change?

Yes.

### How was this patch tested?

FilesetAuthorizationIT

---------

Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com>
Co-authored-by: 1161623489@qq.com <1161623489@qq.com>
hdygxsj added a commit to hdygxsj/gravitino that referenced this pull request Jul 15, 2025
@unknowntpo @hdygxsj
[apache#7545] feat(authz): Support fileset authorization (apache#7581)
52573c5 
<!--
1. Title: [#<issue>] <type>(<scope>): <subject>
   Examples:
     - "[apache#123] feat(operator): support xxx"
     - "[apache#233] fix: check null before access result in xxx"
     - "[MINOR] refactor: fix typo in variable name"
     - "[MINOR] docs: fix typo in README"
     - "[apache#255] test: fix flaky test NameOfTheTest"
   Reference: https://www.conventionalcommits.org/en/v1.0.0/
2. If the PR is unfinished, please mark this PR as draft.
-->

### What changes were proposed in this pull request?

Support fileset auth with annotation.

### Why are the changes needed?

To support fileset auth.

Fix: apache#7545

### Does this PR introduce _any_ user-facing change?

Yes.

### How was this patch tested?

FilesetAuthorizationIT

---------

Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com>
Co-authored-by: 1161623489@qq.com <1161623489@qq.com>
hdygxsj added a commit to hdygxsj/gravitino that referenced this pull request Jul 15, 2025
@unknowntpo @hdygxsj
[apache#7545] feat(authz): Support fileset authorization (apache#7581)
b056e4b 
<!--
1. Title: [#<issue>] <type>(<scope>): <subject>
   Examples:
     - "[apache#123] feat(operator): support xxx"
     - "[apache#233] fix: check null before access result in xxx"
     - "[MINOR] refactor: fix typo in variable name"
     - "[MINOR] docs: fix typo in README"
     - "[apache#255] test: fix flaky test NameOfTheTest"
   Reference: https://www.conventionalcommits.org/en/v1.0.0/
2. If the PR is unfinished, please mark this PR as draft.
-->

### What changes were proposed in this pull request?

Support fileset auth with annotation.

### Why are the changes needed?

To support fileset auth.

Fix: apache#7545

### Does this PR introduce _any_ user-facing change?

Yes.

### How was this patch tested?

FilesetAuthorizationIT

---------

Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com>
Co-authored-by: 1161623489@qq.com <1161623489@qq.com>
jerryshao pushed a commit that referenced this pull request Jul 15, 2025
@unknowntpo @hdygxsj @jerryshao
[#7545] feat(authz): Support fileset authorization (#7581)
add62dd 
<!--
1. Title: [#<issue>] <type>(<scope>): <subject>
   Examples:
     - "[#123] feat(operator): support xxx"
     - "[#233] fix: check null before access result in xxx"
     - "[MINOR] refactor: fix typo in variable name"
     - "[MINOR] docs: fix typo in README"
     - "[#255] test: fix flaky test NameOfTheTest"
   Reference: https://www.conventionalcommits.org/en/v1.0.0/
2. If the PR is unfinished, please mark this PR as draft.
-->

### What changes were proposed in this pull request?

Support fileset auth with annotation.

### Why are the changes needed?

To support fileset auth.

Fix: #7545

### Does this PR introduce _any_ user-facing change?

Yes.

### How was this patch tested?

FilesetAuthorizationIT

---------

Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com>
Co-authored-by: 1161623489@qq.com <1161623489@qq.com>
jerqi pushed a commit to qqqttt123/gravitino that referenced this pull request Jul 30, 2025
@unknowntpo @hdygxsj @jerqi
[apache#7545] feat(authz): Support fileset authorization (apache#7581)
adc061b 
<!--
1. Title: [#<issue>] <type>(<scope>): <subject>
   Examples:
     - "[apache#123] feat(operator): support xxx"
     - "[apache#233] fix: check null before access result in xxx"
     - "[MINOR] refactor: fix typo in variable name"
     - "[MINOR] docs: fix typo in README"
     - "[apache#255] test: fix flaky test NameOfTheTest"
   Reference: https://www.conventionalcommits.org/en/v1.0.0/
2. If the PR is unfinished, please mark this PR as draft.
-->

### What changes were proposed in this pull request?

Support fileset auth with annotation.

### Why are the changes needed?

To support fileset auth.

Fix: apache#7545

### Does this PR introduce _any_ user-facing change?

Yes.

### How was this patch tested?

FilesetAuthorizationIT

---------

Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com>
Co-authored-by: 1161623489@qq.com <1161623489@qq.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@xunliu xunliu xunliu approved these changes

@jerqi jerqi jerqi approved these changes

+1 more reviewer

@hdygxsj hdygxsj hdygxsj left review comments

Reviewers whose approvals may not affect merge requirements
Assignees

@unknowntpo unknowntpo

@hdygxsj hdygxsj

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Subtask] Supporta Fileset Authorization
4 participants
@unknowntpo @hdygxsj @xunliu @jerqi