bharos opened a new pull request, #12175:
URL: https://github.com/apache/gravitino/pull/12175
### What changes were proposed in this pull request?
Adds `RoleAssumptionAuthorizationIT`, an end-to-end integration test for the
`X-Gravitino-Active-Roles` header on the native REST path. The test user holds
two roles, each granting `USE_CATALOG` on a different catalog, and each case
sends the header (via the client's `withHeaders(...)`) to activate a subset:
- no header / `ALL` → both catalogs visible;
- `role_catalog1` (`NAMED`) → only catalog1 visible (list narrowing);
- `NONE` → no catalogs;
- an unheld role → `403`;
- a malformed header (`ALL,role`) → `400`.
No mocks — it runs against a real Gravitino server with real HTTP requests
and a real Hive-backed catalog.
> Note: this PR is **stacked on #12167** (the `403` membership check), which
it depends on. Opened as a draft to exercise CI; it will be rebased onto `main`
(dropping #12167's commit) once #12167 merges.
### Why are the changes needed?
Verifies role assumption end-to-end (narrowing + `400` + `403`) and guards
the list-narrowing path against regression. Part of #11968 / #11965.
### Does this PR introduce any user-facing change?
No (test only).
### How was this patch tested?
This is the test. It runs in the backend integration-test CI stage
(`@Tag("gravitino-docker-test")`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
