bharos opened a new pull request, #12096: URL: https://github.com/apache/gravitino/pull/12096
### What changes were proposed in this pull request? Parse the `X-Gravitino-Active-Roles` header and make the declared active roles available to authorization, so the enforcement from #11967 activates for well-formed headers. - `common`: `ActiveRolesContext`, a request-scoped (thread-local) holder for the parsed `ActiveRoles`; defaults to `ALL` when unset. - `AuthenticationFilter`: after authentication, parse the header once, set the holder, and clear it in a `finally`. A malformed value maps to `400 Bad Request` via `IllegalActiveRolesException` (the Lance filter maps it the same; the Iceberg filter already maps `IllegalArgumentException` → 400). - `AuthorizationRequestContext`: initialize `activeRoles` from the holder, so every context (including the list short-circuit's) picks up the request's declaration. Membership validation (`403` for a well-formed value naming a role the caller does not hold) is metalake-scoped and follows in a later PR. ### Why are the changes needed? #11967 added the narrowing enforcement, but nothing populates the active roles yet, so it never activates. This wires the header through the request path. Part of #11965. ### Does this PR introduce any user-facing change? Yes, additive and backward compatible. A request may send `X-Gravitino-Active-Roles: <role>[,<role>] | ALL | NONE` to narrow the roles used for authorization; a malformed value returns `400`. An absent header behaves exactly as before (`ALL`). ### How was this patch tested? New unit tests: - `TestActiveRolesContext`: set/get/clear, default-to-`ALL`, thread-locality. - `TestAuthenticationFilter`: header populates the holder for the downstream chain, absent header → `ALL`, malformed header → `400` (chain not invoked, no leak). Verified locally with the module `test` and `spotlessCheck` tasks for `common`, `server-common`, `core`, and `lance-rest-server`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
