This is an automated email from the ASF dual-hosted git repository.
jerryshao pushed a change to branch dependabot/pip/mcp-server/fastmcp-3.4.2
in repository https://gitbox.apache.org/repos/asf/gravitino.git
from 202317b252 build(deps): bump fastmcp from 3.2.0 to 3.4.2 in /mcp-server
add 4c7358b64b [#10894] docs: Add design doc for role assumption (SET
ROLE) permission narrowing (#11790)
add 86a235bf9c [MINOR] refactor(spark-connector): Align JDBC connector
common logic (#11847)
add 7b7ec06582 [MINOR] refactor(flink-connector): Align JDBC connector
common logic (#11849)
add 0e96563519 [#10866] feat(charts): Support Gateway API HTTPRoute in
Helm charts (#11308)
add 2de6492d6f [MINOR] fix(aws): Support MinIO role ARNs in IRSA
credential vending (#11883)
add b0aa708cd0 [#11836] fix(server): Return visible service admins as list
(#11843)
add 69edf53a10 [#11748] feat(catalog-hadoop): support Tencent Cloud COS
as fileset storage backend (Java side) (#11713)
add b096dd2c42 [#11879] fix(clickhouse): fix type conversion for Decimal,
DateTime64, LowCardinality, and IPv4/IPv6 (#11884)
add c2fc58bf13 [#11839] fix(clickhouse): escape single quotes in database
and table name SQL to prevent injection (#11840)
add 15778b188f [#11893] fix(lance): Add external table guard to
deregisterTable (#11896)
add 5bcfc167a4 [#11899] fix(flink): exclude vulnerable log4j 2.x from
hive-common compile classpath (#11898)
add bcb9d2da87 [MINOR] fix(workflow): refresh docker login action SHA for
ASF allowlist (#11908)
add 90c43acca3 [#11832] feat(core): Add user external ID, enable/disable,
and delete-by-external-id APIs (#11848)
add 8fb593a47d [#11834] feat(core): Add group external ID and
delete-by-external-id APIs (#11914)
add 409f83447f [#11784] improvement(common): harden remote file fetch
against SSRF DNS-rebinding (#11785)
add ab0d52bae5 [#11835] feat: external-id user/group REST create APIs and
AccessControlIT (#11921)
add 46775b79c8 Merge branch 'main' into
dependabot/pip/mcp-server/fastmcp-3.4.2
No new revisions were added by this update.
Summary of changes:
.github/workflows/docker-image.yml | 2 +-
.../org/apache/gravitino/authorization/Group.java | 16 +
.../org/apache/gravitino/authorization/User.java | 25 +
...Credential.java => COSSecretKeyCredential.java} | 50 +-
.../org.apache.gravitino.credential.Credential | 1 +
.../s3/credential/AwsIrsaCredentialGenerator.java | 9 +-
.../webidentity/WebIdentityTokenSources.java | 5 +-
.../credential/TestAwsIrsaCredentialGenerator.java | 37 ++
.../webidentity/TestWebIdentityTokenSources.java | 11 +-
.../build.gradle.kts | 38 +-
bundles/{aliyun => tencent}/build.gradle.kts | 7 +-
.../cos/credential/COSSecretKeyProvider.java} | 23 +-
.../gravitino/cos/fs/COSCredentialsProvider.java | 91 +++
.../gravitino/cos/fs/COSFileSystemProvider.java | 128 ++++
.../org/apache/gravitino/cos/fs/COSUtils.java} | 25 +-
....gravitino.catalog.hadoop.fs.FileSystemProvider | 2 +-
....apache.gravitino.credential.CredentialProvider | 2 +-
.../cos/credential/TestCOSCredentialProvider.java | 63 ++
.../cos/fs/TestCOSCredentialsProvider.java | 154 +++++
.../cos/fs/TestCOSFileSystemProvider.java | 92 +++
.../converter/ClickHouseTypeConverter.java | 23 +-
.../catalog/clickhouse/converter/TypeUtils.java | 6 +-
.../operations/ClickHouseDatabaseOperations.java | 9 +
.../operations/ClickHouseTableOperations.java | 4 +-
.../converter/TestClickHouseTypeConverter.java | 29 +
.../TestClickHouseDatabaseOperations.java | 18 +
.../operations/TestClickHouseTableOperations.java | 4 +-
.../TestClickHouseTableOperationsUnit.java | 87 +++
.../credential/config/COSCredentialConfig.java | 79 +++
.../apache/gravitino/storage/COSProperties.java | 21 +-
catalogs/catalog-fileset/build.gradle.kts | 2 +
...tOSSCatalogIT.java => FilesetCOSCatalogIT.java} | 100 +--
.../gravitino/catalog/hadoop/fs/Constants.java | 6 +
.../apache/gravitino/cli/commands/ListGroups.java | 5 +
.../apache/gravitino/cli/commands/ListUsers.java | 10 +
.../apache/gravitino/client/GravitinoClient.java | 32 +
.../apache/gravitino/client/GravitinoMetalake.java | 58 ++
.../org/apache/gravitino/client/TestUserGroup.java | 46 ++
.../test/authorization/AccessControlIT.java | 45 ++
.../filesystem-hadoop3-runtime/build.gradle.kts | 1 +
clients/filesystem-hadoop3/build.gradle.kts | 2 +
...T.java => GravitinoVirtualFileSystemCOSIT.java} | 80 ++-
.../gravitino/dto/authorization/GroupDTO.java | 30 +-
.../gravitino/dto/authorization/UserDTO.java | 55 +-
.../gravitino/dto/requests/GroupAddRequest.java | 22 +-
.../gravitino/dto/requests/UserAddRequest.java | 28 +-
.../apache/gravitino/dto/util/DTOConverters.java | 3 +
.../org/apache/gravitino/utils/FileFetcher.java | 60 +-
.../gravitino/utils/RemoteFileDownloader.java | 396 ++++++++++++
.../apache/gravitino/utils/RemoteUriValidator.java | 140 ++++-
.../java/org/apache/gravitino/utils/SafeUri.java | 55 ++
.../apache/gravitino/utils/TestFileFetcher.java | 89 ++-
.../gravitino/utils/TestRemoteFileDownloader.java | 686 +++++++++++++++++++++
.../gravitino/utils/TestRemoteUriValidator.java | 118 ++--
.../org/apache/gravitino/utils/TestSafeUri.java | 36 +-
.../src/main/java/org/apache/gravitino/Entity.java | 22 +
.../java/org/apache/gravitino/EntityStore.java | 10 +
.../gravitino/SupportsExternalIdOperations.java | 71 +++
.../authorization/AccessControlDispatcher.java | 113 ++++
.../authorization/AccessControlManager.java | 75 +++
.../authorization/AuthorizationUtils.java | 84 +++
.../gravitino/authorization/PermissionManager.java | 6 +
...pManager.java => UserGroupExternalManager.java} | 183 +++---
.../gravitino/authorization/UserGroupManager.java | 6 +-
.../hook/AccessControlHookDispatcher.java | 48 ++
.../listener/AccessControlEventDispatcher.java | 56 ++
.../org/apache/gravitino/meta/GroupEntity.java | 24 +-
.../java/org/apache/gravitino/meta/UserEntity.java | 46 +-
.../gravitino/storage/relational/JDBCBackend.java | 28 +
.../storage/relational/RelationalBackend.java | 29 +
.../storage/relational/RelationalEntityStore.java | 46 +-
.../storage/relational/mapper/GroupMetaMapper.java | 6 +
.../mapper/GroupMetaSQLProviderFactory.java | 5 +
.../storage/relational/mapper/UserMetaMapper.java | 10 +
.../mapper/UserMetaSQLProviderFactory.java | 10 +
.../provider/base/GroupMetaBaseSQLProvider.java | 43 +-
.../provider/base/OwnerMetaBaseSQLProvider.java | 4 +
.../provider/base/UserMetaBaseSQLProvider.java | 64 +-
.../mapper/provider/h2/GroupMetaH2Provider.java | 2 +
.../mapper/provider/h2/UserMetaH2Provider.java | 1 +
.../postgresql/GroupMetaPostgreSQLProvider.java | 8 +-
.../postgresql/UserMetaPostgreSQLProvider.java | 9 +-
.../gravitino/storage/relational/po/GroupPO.java | 12 +
.../gravitino/storage/relational/po/UserPO.java | 27 +
.../relational/service/GroupMetaService.java | 28 +
.../relational/service/UserMetaService.java | 67 ++
.../storage/relational/utils/POConverters.java | 12 +
.../authorization/TestAccessControlManager.java | 147 +++++
.../authorization/TestAuthorizationUtils.java | 51 ++
.../listener/api/event/TestOwnerEvent.java | 3 +-
.../storage/memory/TestMemoryEntityStore.java | 82 ++-
.../mapper/provider/base/TestAuthMappers.java | 1 +
.../provider/base/TestUserRoleRelMapper.java | 1 +
.../provider/h2/TestGroupMetaH2Provider.java | 7 +-
.../relational/service/TestGroupMetaService.java | 60 ++
.../relational/service/TestUserMetaService.java | 147 +++++
design-docs/gravitino-role-assumption.md | 366 +++++++++++
.../templates/httproute.yaml | 67 ++
.../templates/ingress.yaml | 2 +-
.../tests/httproute_test.yaml | 205 ++++++
.../tests/ingress_test.yaml | 9 +
.../gravitino-iceberg-rest-server/values.yaml | 19 +
.../templates/httproute.yaml | 67 ++
.../templates/ingress.yaml | 2 +-
.../tests/httproute_test.yaml | 154 +++++
.../tests/ingress_test.yaml | 9 +
dev/charts/gravitino-lance-rest-server/values.yaml | 19 +
dev/charts/gravitino/templates/httproute.yaml | 67 ++
dev/charts/gravitino/templates/ingress.yaml | 4 +-
dev/charts/gravitino/tests/httproute_test.yaml | 154 +++++
dev/charts/gravitino/tests/ingress_test.yaml | 9 +
dev/charts/gravitino/values.yaml | 19 +
docs/fileset-catalog-with-cos.md | 544 ++++++++++++++++
docs/fileset-catalog.md | 12 +-
docs/open-api/groups.yaml | 9 +-
docs/open-api/users.yaml | 18 +-
docs/security/access-control.md | 42 +-
docs/security/credential-vending.md | 16 +-
.../flink/connector/jdbc/GravitinoJdbcCatalog.java | 12 +-
.../connector/jdbc/JdbcPropertiesConstants.java | 1 +
.../connector/integration/test/FlinkCommonIT.java | 21 +-
.../store/TestGravitinoSessionCatalogStore.java | 10 +
flink-connector/v1.18/flink/build.gradle.kts | 1 +
flink-connector/v1.19/flink/build.gradle.kts | 1 +
flink-connector/v1.20/flink/build.gradle.kts | 1 +
gradle/libs.versions.toml | 2 +
.../gravitino/GravitinoLanceTableOperations.java | 16 +-
.../rest/TestGravitinoLanceTableOperations.java | 34 +
.../apache/gravitino/server/web/ConfigServlet.java | 38 +-
.../gravitino/server/web/rest/GroupOperations.java | 12 +-
.../gravitino/server/web/rest/UserOperations.java | 15 +-
.../gravitino/server/web/TestConfigServlet.java | 39 ++
.../server/web/rest/TestGroupOperations.java | 32 +
.../server/web/rest/TestUserOperations.java | 34 +
settings.gradle.kts | 1 +
.../spark/connector/jdbc/GravitinoJdbcCatalog.java | 5 +
.../connector/jdbc/JdbcPropertiesConverter.java | 8 +-
.../connector/version/CatalogNameAdaptor.java | 8 +-
.../jdbc/TestJdbcPropertiesConverter.java | 23 +
.../GravitinoPostgreSqlCatalogSpark33.java | 2 +-
.../connector/version/TestCatalogNameAdaptor.java | 8 +
.../GravitinoPostgreSqlCatalogSpark34.java | 2 +-
.../connector/version/TestCatalogNameAdaptor.java | 8 +
.../GravitinoPostgreSqlCatalogSpark35.java | 2 +-
.../connector/version/TestCatalogNameAdaptor.java | 8 +
145 files changed, 6517 insertions(+), 460 deletions(-)
copy
api/src/main/java/org/apache/gravitino/credential/{OSSSecretKeyCredential.java
=> COSSecretKeyCredential.java} (62%)
copy bundles/{aws-bundle => tencent-bundle}/build.gradle.kts (63%)
copy bundles/{aliyun => tencent}/build.gradle.kts (88%)
copy
bundles/{aliyun/src/main/java/org/apache/gravitino/oss/credential/OSSSecretKeyProvider.java
=>
tencent/src/main/java/org/apache/gravitino/cos/credential/COSSecretKeyProvider.java}
(65%)
create mode 100644
bundles/tencent/src/main/java/org/apache/gravitino/cos/fs/COSCredentialsProvider.java
create mode 100644
bundles/tencent/src/main/java/org/apache/gravitino/cos/fs/COSFileSystemProvider.java
copy bundles/{aliyun/src/main/java/org/apache/gravitino/oss/fs/OSSUtils.java
=> tencent/src/main/java/org/apache/gravitino/cos/fs/COSUtils.java} (65%)
copy bundles/{gcp =>
tencent}/src/main/resources/META-INF/services/org.apache.gravitino.catalog.hadoop.fs.FileSystemProvider
(94%)
copy bundles/{gcp =>
tencent}/src/main/resources/META-INF/services/org.apache.gravitino.credential.CredentialProvider
(93%)
create mode 100644
bundles/tencent/src/test/java/org/apache/gravitino/cos/credential/TestCOSCredentialProvider.java
create mode 100644
bundles/tencent/src/test/java/org/apache/gravitino/cos/fs/TestCOSCredentialsProvider.java
create mode 100644
bundles/tencent/src/test/java/org/apache/gravitino/cos/fs/TestCOSFileSystemProvider.java
create mode 100644
catalogs-contrib/catalog-jdbc-clickhouse/src/test/java/org/apache/gravitino/catalog/clickhouse/operations/TestClickHouseTableOperationsUnit.java
create mode 100644
catalogs/catalog-common/src/main/java/org/apache/gravitino/credential/config/COSCredentialConfig.java
copy core/src/main/java/org/apache/gravitino/storage/IdGenerator.java =>
catalogs/catalog-common/src/main/java/org/apache/gravitino/storage/COSProperties.java
(54%)
copy
catalogs/catalog-fileset/src/test/java/org/apache/gravitino/catalog/fileset/integration/test/{FilesetOSSCatalogIT.java
=> FilesetCOSCatalogIT.java} (65%)
copy
clients/filesystem-hadoop3/src/test/java/org/apache/gravitino/filesystem/hadoop/integration/test/{GravitinoVirtualFileSystemOSSIT.java
=> GravitinoVirtualFileSystemCOSIT.java} (63%)
create mode 100644
common/src/main/java/org/apache/gravitino/utils/RemoteFileDownloader.java
create mode 100644 common/src/main/java/org/apache/gravitino/utils/SafeUri.java
create mode 100644
common/src/test/java/org/apache/gravitino/utils/TestRemoteFileDownloader.java
copy core/src/test/java/org/apache/gravitino/utils/TestByteUtils.java =>
common/src/test/java/org/apache/gravitino/utils/TestSafeUri.java (51%)
create mode 100644
core/src/main/java/org/apache/gravitino/SupportsExternalIdOperations.java
copy
core/src/main/java/org/apache/gravitino/authorization/{UserGroupManager.java =>
UserGroupExternalManager.java} (50%)
create mode 100644 design-docs/gravitino-role-assumption.md
create mode 100644
dev/charts/gravitino-iceberg-rest-server/templates/httproute.yaml
create mode 100644
dev/charts/gravitino-iceberg-rest-server/tests/httproute_test.yaml
create mode 100644
dev/charts/gravitino-lance-rest-server/templates/httproute.yaml
create mode 100644
dev/charts/gravitino-lance-rest-server/tests/httproute_test.yaml
create mode 100644 dev/charts/gravitino/templates/httproute.yaml
create mode 100644 dev/charts/gravitino/tests/httproute_test.yaml
create mode 100644 docs/fileset-catalog-with-cos.md
