yuqi1129 opened a new pull request, #12573: URL: https://github.com/apache/gravitino/pull/12573
### What changes were proposed in this pull request? Add the shared Lance REST authorization framework and protect read-only namespace operations in auxiliary mode. - Register a Lance authorization interception service only when authorization is enabled and Lance REST runs as an auxiliary service. `LanceRESTServerContext` holds the metalake name and the authorization switch. - Decode zero-, one- and two-level Lance namespace IDs in `LanceMetadataAuthorizationMethodInterceptor`, and resolve them to the metalake, catalog and schema identifiers the request addresses. Because a Lance namespace ID is a single parameter whose level count decides the addressed entity, the expression is declared per level through `@LanceAuthorizationExpression`. - Reuse the Gravitino authorization expressions, active-role validation and metalake user check. - Authorize namespace list, describe and exists. A rejected request never reaches the operation and is answered with a Lance-compatible error: 403 for a denial, 400 for an unsupported namespace identifier. - Filter unauthorized catalogs and schemas before pagination. `lance-common` gains a dependency-free `LanceMetadataFilter` hook, defaulting to a no-op, which the REST server implements with `MetadataAuthzHelper.filterByExpression`. - Make `ObjectIdentifier` public so the interceptor and the namespace operations share one decoder. - Keep behavior unchanged when authorization is disabled or Lance REST runs standalone: no interceptor is registered and the listing filter stays a no-op. Table operations are not authorized yet, they are covered by #12560, #12561 and #12562. ### Why are the changes needed? Auxiliary-mode Lance REST executes metadata operations against Gravitino with the authenticated caller identity, but it does not check what the caller is allowed to see. Any authenticated user can list, describe and probe every catalog and schema of the metalake. This PR adds the authorization layer the remaining namespace and table subtasks build on. Fix: #12558 ### Does this PR introduce _any_ user-facing change? Yes. When `gravitino.authorization.enable` is true and Lance REST runs as an auxiliary service, namespace read operations now require the same privileges as the equivalent Gravitino and Iceberg REST operations, and listings only return the catalogs and schemas the caller may access. No new configuration key is added. ### How was this patch tested? - `./gradlew :lance:lance-common:build :lance:lance-rest-server:build -PskipDockerTests=false` - `TestLanceMetadataAuthorizationMethodInterceptor`: level decoding, custom delimiter, per-level expression selection, denial, unsupported identifier, unheld active roles, internal error mapping, and the disabled-authorization and standalone paths. - `TestGravitinoLanceNamespaceListFiltering`: unauthorized catalogs and schemas are removed before the page is cut. - `LanceNamespaceAuthorizationIT`: auxiliary-mode end-to-end coverage of describe, exists and list for an unprivileged user, a user with USE_CATALOG, a user with USE_SCHEMA, and the metalake owner. - Existing `LanceRESTServiceIT`, `LanceSparkRESTServiceIT` and `LanceRESTServiceAuthIT` still pass, covering the authorization-disabled path. All tests were run with proxy environment variables disabled. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
