yuqi1129 commented on issue #10978: URL: https://github.com/apache/gravitino/issues/10978#issuecomment-4572163938
I looked into this, and the most likely root cause is a race in the JCasbin authorization cache rather than token expiration itself. From the logs, the first failure shows USE_CATALOG evaluating to false with Hit Policy: [], but the same query succeeds again shortly after. That suggests the permission data is not actually gone, but the in-memory enforcer state is temporarily inconsistent. The suspicious path is the role-policy cache reload and eviction flow: when cache entries are replaced or expired, the removal listener can delete the corresponding JCasbin policies, which may race with a concurrent reload and briefly leave the enforcer without the expected policies. I’m not able to reproduce this reliably on my local setup right now. @danhua, could you try reproducing it again on the latest main branch with the same permissions and idle window? If you can confirm it still happens there, that would help narrow down whether this is still the same cache-race path or something newer. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
