yuqi1129 opened a new pull request, #11404: URL: https://github.com/apache/gravitino/pull/11404
### What changes were proposed in this pull request? Replace `resolveCurrentUserGroups(metalake, entityStore)` in `ownerMatchesUserOrGroups()` with `currentPrincipalGroupNames()` + `loadGroupInfo()`. The new path routes through `requestContext.groupInfoCache` (per-request dedup) before falling back to a lightweight `group_meta` query via `GroupMetaMapper#getGroupUpdatedAt`, and removes the need to load full `GroupEntity` objects. The now-unused `resolveCurrentUserGroups()` method and its `GroupEntity` import are removed. ### Why are the changes needed? The old path bypassed all caches and issued an `entityStore.batchGet(GROUP)` DB call on every GROUP owner check. In `hasSetOwnerPermission`, which walks the full parent chain calling `isOwner` in a loop, this could fire multiple times per request when the owner is a group. The fix ensures group identity is resolved through the same version-validated cache path as all other identity lookups in the authorizer. Fix: #11403 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? - Updated `testAuthorizeByGroupOwner` to mock `groupMetaMapper.getGroupUpdatedAt` instead of `entityStore.batchGet(GROUP)`, and added a `verify` assertion that `entityStore.batchGet(GROUP)` is never called. - Added `testGroupOwnerCheckDeduplicatesGroupInfoWithinRequest` which calls `isOwner` twice within the same `AuthorizationRequestContext` and asserts that `groupMetaMapper.getGroupUpdatedAt` is invoked exactly once (per-request cache dedup). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
