jarredhj0214 opened a new issue, #12216:
URL: https://github.com/apache/gravitino/issues/12216
### Version
main branch
### Describe what's wrong
### Describe what's wrong
Revoking privileges from a role for a child metadata object can fail with an
internal authorization error when the parent catalog no longer exists.
During authorization, `MetadataIdConverter` resolves the requested metadata
object into an internal metadata id. For child objects such as filesets,
schemas, tables, or topics, it first loads the parent catalog to apply the
catalog case-sensitivity normalization. If the parent catalog has already been
dropped, the lookup throws `NoSuchCatalogException`, which bubbles up as a
system internal error before the revoke operation reaches the business logic.
### Error message and/or stacktrace
```text
System internal error during authorization - Operation:
revokePrivilegeFromRole
Caused by: org.apache.gravitino.exceptions.NoSuchCatalogException:
Catalog <metalake>.<catalog> does not exist
at org.apache.gravitino.catalog.CatalogManager.loadCatalogInternal
at org.apache.gravitino.catalog.CapabilityHelpers.getCapability
at
org.apache.gravitino.server.authorization.MetadataIdConverter.normalizeCaseSensitive
at org.apache.gravitino.server.authorization.MetadataIdConverter.getID
at
org.apache.gravitino.server.authorization.jcasbin.JcasbinAuthorizationLookups.loadMetadataId
### How to reproduce
Use the main branch.
Create a role and grant privileges on a child metadata object, such as a
schema, table, fileset, or topic.
Drop the parent catalog.
Try to revoke the privilege from the role for that child metadata object.
The revoke operation can fail during authorization metadata id resolution
with an internal error.
### Additional context
A missing parent catalog means the requested child metadata object cannot be
resolved. MetadataIdConverter#getID should treat this as missing metadata and
return Optional.empty() instead of propagating NotFoundException.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
