roryqi opened a new pull request, #12001: URL: https://github.com/apache/gravitino/pull/12001
### What changes were proposed in this pull request? This PR updates JCasbin authorization checks to apply deny precedence before allowing composite metadata permission decisions. Changes: - Check matching deny policies before allowing owner-setting decisions. - Check matching `MANAGE_GRANTS` deny policies across the metadata object hierarchy before allowing privilege-management decisions. - Add regression coverage for deny precedence in these JCasbin paths. ### Why are the changes needed? Some composite permission checks could return success from owner or allow-side checks without first applying matching deny policies. This PR makes those checks consistent with deny-precedence behavior used by other authorization expressions. Fix: N/A ### Does this PR introduce _any_ user-facing change? No API or configuration changes. ### How was this patch tested? Ran: `./gradlew :server-common:test` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
