yuqi1129 opened a new issue, #12282: URL: https://github.com/apache/gravitino/issues/12282
### What would you like to be improved? After #12174 moves privilege policies from JCasbin `p` rules to a per-role policy index, the remaining enforcer only stores the user/group-to-role grouping graph. This duplicates role membership already resolved from the version-validated user/group role caches. It also retains unnecessary shared mutable state, JCasbin model initialization, adapter code, resources, tests, and the JCasbin dependency in `server-common`. ### How should we improve? Remove the enforcer from `JcasbinAuthorizer`: - Compute the union of direct and group-inherited role IDs in `loadRolePrivilege`. - Store the immutable effective role ID set in `AuthorizationRequestContext`. - Resolve privilege effects and deny-policy checks against this request-scoped role set and the existing per-role `Map<PolicyKey, Effect>` index. - Preserve global DENY precedence, active-role narrowing for ALLOW, OWNER handling, and role-version validation. - Remove enforcer grouping-row binding and pruning. - Remove the unused JCasbin adapter, model resources, model tests, and the JCasbin dependency from `server-common`. - Add regression tests covering direct/group roles, role changes between requests, active roles, and DENY precedence. The JCasbin dependency used independently by the Iceberg REST server is outside this change. Related: #12173, #12174, #10908. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
