bharos commented on code in PR #12001:
URL: https://github.com/apache/gravitino/pull/12001#discussion_r3580758177
##########
server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java:
##########
@@ -470,70 +469,109 @@ public boolean isSelf(
public boolean hasSetOwnerPermission(
String metalake, String type, String fullName,
AuthorizationRequestContext requestContext) {
Principal currentPrincipal = PrincipalUtils.getCurrentPrincipal();
+ MetadataObject.Type metadataType =
MetadataObject.Type.valueOf(type.toUpperCase(Locale.ROOT));
+ MetadataObject targetObject = MetadataObjects.parse(fullName,
metadataType);
MetadataObject metalakeObject =
MetadataObjects.of(ImmutableList.of(metalake),
MetadataObject.Type.METALAKE);
+
// metalake owner can set owner in metalake.
if (isOwner(currentPrincipal, metalake, metalakeObject, requestContext)) {
return true;
}
- MetadataObject.Type metadataType =
MetadataObject.Type.valueOf(type.toUpperCase(Locale.ROOT));
- MetadataObject metadataObject =
- MetadataObjects.of(Arrays.asList(fullName.split("\\.")), metadataType);
+
+ MetadataObject metadataObject = targetObject;
Review Comment:
nit: targetObject is only used to seed the loop here, can inline
##########
server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java:
##########
@@ -470,70 +469,109 @@ public boolean isSelf(
public boolean hasSetOwnerPermission(
String metalake, String type, String fullName,
AuthorizationRequestContext requestContext) {
Principal currentPrincipal = PrincipalUtils.getCurrentPrincipal();
+ MetadataObject.Type metadataType =
MetadataObject.Type.valueOf(type.toUpperCase(Locale.ROOT));
+ MetadataObject targetObject = MetadataObjects.parse(fullName,
metadataType);
MetadataObject metalakeObject =
MetadataObjects.of(ImmutableList.of(metalake),
MetadataObject.Type.METALAKE);
+
// metalake owner can set owner in metalake.
if (isOwner(currentPrincipal, metalake, metalakeObject, requestContext)) {
return true;
}
- MetadataObject.Type metadataType =
MetadataObject.Type.valueOf(type.toUpperCase(Locale.ROOT));
- MetadataObject metadataObject =
- MetadataObjects.of(Arrays.asList(fullName.split("\\.")), metadataType);
+
+ MetadataObject metadataObject = targetObject;
do {
if (isOwner(currentPrincipal, metalake, metadataObject, requestContext))
{
- MetadataObject.Type tempType = metadataObject.type();
- if (tempType == MetadataObject.Type.SCHEMA) {
- boolean hasCatalogUseCatalog =
- authorize(
- currentPrincipal,
- metalake,
- MetadataObjects.parent(metadataObject),
- Privilege.Name.USE_CATALOG,
- requestContext);
- boolean hasMetalakeUseCatalog =
- authorize(
- currentPrincipal,
- metalake,
- metalakeObject,
- Privilege.Name.USE_CATALOG,
- requestContext);
- return hasCatalogUseCatalog || hasMetalakeUseCatalog;
- }
- if (tempType == MetadataObject.Type.TABLE
- || tempType == MetadataObject.Type.VIEW
- || tempType == MetadataObject.Type.TOPIC
- || tempType == MetadataObject.Type.FILESET
- || tempType == MetadataObject.Type.MODEL) {
- boolean hasMetalakeUseSchema =
- authorize(
- currentPrincipal,
- metalake,
- metalakeObject,
- Privilege.Name.USE_SCHEMA,
- requestContext);
- MetadataObject schemaObject = MetadataObjects.parent(metadataObject);
- boolean hasCatalogUseSchema =
- authorize(
- currentPrincipal,
- metalake,
- MetadataObjects.parent(schemaObject),
- Privilege.Name.USE_SCHEMA,
- requestContext);
- boolean hasSchemaUseSchema =
- authorize(
- currentPrincipal,
- metalake,
- schemaObject,
- Privilege.Name.USE_SCHEMA,
- requestContext);
- return hasMetalakeUseSchema || hasCatalogUseSchema ||
hasSchemaUseSchema;
- }
- return true;
+ return hasParentUsagePermission(
+ currentPrincipal, metalake, metadataObject, metalakeObject,
requestContext);
}
} while ((metadataObject = MetadataObjects.parent(metadataObject)) !=
null);
return false;
}
+ private boolean hasAuthorizeWithoutDeny(
+ Principal principal,
+ String metalake,
+ List<MetadataObject> authorizeObjects,
+ List<MetadataObject> denyObjects,
+ Privilege.Name privilege,
+ AuthorizationRequestContext requestContext) {
+ return hasAuthorizeOnAny(principal, metalake, authorizeObjects, privilege,
requestContext)
+ && !hasDenyOnAny(principal, metalake, denyObjects, privilege,
requestContext);
+ }
+
+ private boolean hasAuthorizeOnAny(
+ Principal principal,
+ String metalake,
+ List<MetadataObject> metadataObjects,
+ Privilege.Name privilege,
+ AuthorizationRequestContext requestContext) {
+ for (MetadataObject metadataObject : metadataObjects) {
+ if (authorize(principal, metalake, metadataObject, privilege,
requestContext)) {
+ return true;
Review Comment:
Just want to confirm the intent here: hasMetadataPrivilegePermission now
requires parent USE_SCHEMA/USE_CATALOG in addition to MANAGE_GRANTS. That's a
backward-incompatible tightening — a role with only MANAGE_GRANTS (no USE_*)
can no longer grant on schema/table targets. Is my understanding correct here,
and if so, is this behavioral change intentional?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
