yuqi1129 opened a new issue, #12591: URL: https://github.com/apache/gravitino/issues/12591
### Describe the subtask Extract the metadata authorization interception flow currently embedded in Iceberg REST into a protocol-neutral pipeline in `server-common`. - Centralize current-user validation, active-role validation, authorization request context, expression evaluation, and denial handling. - Represent a resolved authorization target with its metadata identifiers and target entity type, so expressions such as `CAN_ACCESS_METADATA` can dispatch dynamically. - Reuse the existing `AuthorizationExpression` model instead of introducing protocol-specific expression annotations. - Provide protocol-specific extension points for request-target resolution, error-response mapping, custom authorization handlers, and exception handling. - Move the schema-existence probe expression into `AuthorizationExpressionConstants` and reuse it from Iceberg and Lance. - Migrate the Iceberg REST interceptor to the shared pipeline without changing existing authorization behavior. - Preserve Iceberg custom handlers, secondary and existence-check expressions, REST-backend proxy behavior, and audit semantics. - Add complete unit tests using real expressions, including CREATE_SCHEMA probe behavior, deny precedence, user validation, active roles, and protocol error mapping. Lance endpoint registration, namespace parsing, list filtering, and user-facing authorization behavior remain in #12558. This issue blocks #12558 and the following Lance table authorization subtasks. The PR, including tests, should stay below 1000 changed lines. ### Parent issue #9087 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
