yuqi1129 opened a new pull request, #12286: URL: https://github.com/apache/gravitino/pull/12286
### What changes were proposed in this pull request? - Replace the shared JCasbin role-membership graph with an immutable effective role ID set stored in `AuthorizationRequestContext`. - Resolve ALLOW and DENY decisions using the request-scoped role IDs and the per-role `Map<PolicyKey, Effect>` index. - Preserve global DENY precedence, active-role narrowing, OWNER handling, and role-version validation. - Remove the JCasbin adapter, model resources, model tests, and the JCasbin dependency from `server-common`. - Add direct Commons Codec dependency because it is no longer provided transitively by JCasbin. - Add regression tests for request role snapshots, indexed effects, role changes, and immutable policy indexes. ### Why are the changes needed? After privilege policies were moved to per-role indexes, the JCasbin enforcer only maintained a user-to-role grouping graph. This duplicated role membership already resolved by the user and group role caches while retaining unnecessary shared mutable state and dependencies. This change completes the index-based authorization implementation and removes the enforcer entirely. Fix: #12282 ### Does this PR introduce _any_ user-facing change? No. Authorization behavior, public APIs, configuration keys, and the default authorizer class name remain unchanged. ### How was this patch tested? - `./gradlew :core:test :server-common:test -PskipITs -PskipDockerTests=false --rerun-tasks` - MySQL 8.0 and PostgreSQL 13 Docker-backed tests were included. - `BUILD SUCCESSFUL in 3h 55m` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
