roryqi opened a new pull request, #12536: URL: https://github.com/apache/gravitino/pull/12536
### What changes were proposed in this pull request? Implement the policy-on-tag model described in #12177. The main changes include: 1. Add policy-to-tag relation storage and database migrations. 2. Add tag-presence and `TAG_VALUE` selectors. 3. Add bidirectional policy-to-tag REST and Java client APIs. 4. Resolve object policies from effective tags and inherited tag assignments. 5. Make object policy lookup derived and read-only. 6. Add `VIEW_TAG` and `VIEW_POLICY` privileges while retaining `APPLY_*` for mutations. 7. Add policy-to-tag relation lifecycle events. 8. Update OpenAPI specifications and user documentation. The Python policy client is not included because there is currently no corresponding Python policy API surface. Python privilege definitions are kept in sync. ### Why are the changes needed? The direct object-policy model requires users to manage tags and policies independently on the same metadata objects. Policy-on-tag establishes `Policy -> Tag -> Metadata Object` as the governance model, allowing policies to be selected through effective tags, inherited tag assignments, and optional tag-value selectors. Fix: #12176 ### Does this PR introduce _any_ user-facing change? Yes. 1. Adds APIs for associating policies with tags and listing associations from either direction. 2. Adds policy-to-tag selector payloads. 3. Object policy listings are derived from effective tags. 4. Direct object-policy mutation and single-policy lookup REST endpoints are removed. 5. Adds `VIEW_TAG` and `VIEW_POLICY` privileges. 6. Adds a policy-to-tag relation table and upgrade migrations. 7. Adds corresponding Java client methods. ### How was this patch tested? Completed: - `./gradlew spotlessApply` - `./gradlew :docs:lintOpenAPI` - Policy tag selector unit tests - Object policy resolver unit tests - Policy-to-tag storage unit tests - Policy-to-tag event unit tests - Privilege binding and authorization expression tests Pending while this PR is draft: - Re-run the expanded effective-tag and cascade-delete test suite - Java client endpoint tests - REST endpoint tests - `./gradlew :docs:build` - Full regression test pass -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
