yuqi1129 opened a new pull request, #11310:
URL: https://github.com/apache/gravitino/pull/11310

   ### What changes were proposed in this pull request?
   
   Extend `ROLE_SECURABLE_OBJECT_REVERSE_RULE` in `ReverseIndexRules` with one 
additional reverse-index entry: when a `RoleEntity` is stored as part of a 
**relation cache entry** (`key.relationType() != null`, e.g. 
`schemaIdent:SCHEMA:METADATA_OBJECT_ROLE_REL`), also register 
`reverseIndex[roleIdent:ROLE] → [schemaIdent:SCHEMA:METADATA_OBJECT_ROLE_REL]`.
   
   This lets the existing BFS in `CaffeineEntityCache.invalidateEntities` find 
and evict the stale relation cache whenever `cache.invalidate(roleIdent, ROLE)` 
is called (e.g. after `revokePrivilegesFromRole`).
   
   Add `TestCaffeineEntityCacheInvalidation` with 6 unit tests covering:
   - Core revoke scenario (issue #11297)
   - Role also separately cached before revoke
   - Multiple roles sharing the same schema
   - Role with securable objects on multiple schemas
   - Grant path when role was previously in the relation cache
   - Reverse-index cleanup / no memory leak
   
   ### Why are the changes needed?
   
   After `revokePrivilegesFromRole` removes the last privilege from a role's 
securable object, `RelationalEntityStore.update()` calls 
`cache.invalidate(roleIdent, ROLE)`. The BFS searched the reverse index by the 
role's identifier prefix (`metalake.system.role.<name>`) but 
`METADATA_OBJECT_ROLE_REL` was keyed by the schema identifier 
(`metalake.catalog.schema:SCHEMA`), so the BFS found nothing and the stale 
entry persisted. A subsequent call to `listBindingRoleNames()` served the 
cached (now-revoked) role from the stale entry.
   
   Fix: #11297
   
   ### Does this PR introduce _any_ user-facing change?
   
   No. This is an internal cache-invalidation fix; the external API and DB 
layer are unchanged.
   
   ### How was this patch tested?
   
   New unit tests in `TestCaffeineEntityCacheInvalidation` exercise the exact 
cache state described in the bug report (grant → listBindingRoleNames → revoke 
→ listBindingRoleNames must miss cache). All existing cache tests continue to 
pass:
   
   ```
   ./gradlew :core:test --tests "org.apache.gravitino.cache.*" -PskipITs
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to