hdygxsj commented on code in PR #7086: URL: https://github.com/apache/gravitino/pull/7086#discussion_r2095595502
########## server-common/src/main/resources/jcasbin_model.conf: ########## @@ -0,0 +1,56 @@ +; Licensed to the Apache Software Foundation (ASF) under one +; or more contributor license agreements. See the NOTICE file +; distributed with this work for additional information +; regarding copyright ownership. The ASF licenses this file +; to you under the Apache License, Version 2.0 (the +; "License"); you may not use this file except in compliance +; with the License. You may obtain a copy of the License at +; +; http://www.apache.org/licenses/LICENSE-2.0 +; +; Unless required by applicable law or agreed to in writing, +; software distributed under the License is distributed on an +; "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +; KIND, either express or implied. See the License for the +; specific language governing permissions and limitations +; under the License. + +; The model file of jcasbin defines a permission model used to describe the permissions +; of users, groups, and roles for a single metadata type. + +; "r" represents the parameters passed when making a request to jCasbin. +; "sub" represents a role, user, or groupCode. +; "metalakeId" represents the metalake to which a role, user, or group belongs. +; The combination of `sub` and `metalakeId` uniquely identifies a user, role, or group. +; "metadataType" represents the type of metadata. +; "metadataId" represents the id of metadata +; "act" represents the privilege that needs to be authorized or whether it is an OWNER. +[request_definition] +r = sub, metalakeId, metadataType, metadataId, act + +; "p" represents a permission policy. +; "eft" stands for "effect" which can be either "allow" or "deny". +[policy_definition] +p = sub, metalakeId, metadataType, metadataId, act, eft + +; "g" represents the membership or ownership relationship of users, groups, or roles. +[role_definition] +g = _, _, _ + +; "e" represents the effect of the "eft",eft performs a logical combination judgment on the matching results +; of Matchers. +; e = some(where(p.eft == allow)): This statement means that if the matching strategy result p.eft has the result +; of (some) allow +; e = some(where (p.eft == allow)) && !some(where (p.eft == deny)): The logical meaning of this example combination +; is: if there is a strategy that matches the result of allow and no strategy that matches the result of deny, +; the result is true. In other words, it is true when the matching strategies are all allow. If there is any deny, +; both are false (more simply, when allow and deny exist at the same time, deny takes precedence). +; +; see more in https://casbin.org/zh/docs/how-it-works/#effect +[policy_effect] +e = some(where (p.eft == allow)) && !some(where (p.eft == deny)) + +; "m" represents the matching rules of the model +[matchers] +m = g(r.sub, p.sub, r.metalakeId) && r.metalakeId == p.metalakeId && r.metadataId == p.metadataId && r.metadataType == p.metadataType && ( p.act == "OWNER" || r.act == p.act ) + Review Comment: > My two cents: > > Loading all the privileges at once during the initialization is not so ideal, which will increase the boot time and load in many unused privileges. Instead, can we load the privileges into jcasbin on demand, only when the request is coming and there's no related policies stored in the jcasbin, then we load the privileges and store into jcasbin? > > This is unrelated to this PR, but I want to make sure how you think and handle such problems, to make sure that the deliverable is qualified. After discussion, the subsequent implementation approach is to not pre-load the strategies, but instead dynamically load them from the database when they are needed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
