yuqi1129 opened a new pull request, #12593: URL: https://github.com/apache/gravitino/pull/12593
### What changes were proposed in this pull request? This pull request: - Moves the shared metadata authorization interceptor from the Iceberg REST module to `server-common`. - Introduces a protocol-neutral authorization target containing both metadata identifiers and the directly addressed entity type. - Centralizes user validation, active-role validation, custom handlers, expression evaluation, and authorization failure handling. - Adds protocol hooks for request target resolution and error response mapping. - Migrates Iceberg REST authorization to the shared pipeline without changing its authorization behavior. - Adds a shared schema-probe expression that permits `CREATE_SCHEMA` while preserving deny precedence. ### Why are the changes needed? Metadata REST protocols otherwise need to duplicate the same authorization workflow and may implement user, role, and expression checks inconsistently. The shared pipeline also provides the dynamic entity type required by `CAN_ACCESS_METADATA`, allowing later protocol implementations to reuse the existing authorization expressions. Fix: #12591 ### Does this PR introduce _any_ user-facing change? No. The Iceberg REST authorization behavior and error responses are preserved. ### How was this patch tested? - Added comprehensive unit tests for dynamic target resolution, user validation, active roles, handler short-circuiting, protocol error mapping, and operation error mapping. - Added real-expression tests for schema probes, including `CREATE_SCHEMA` and deny precedence. - Verified the shared interceptor with 100% line and branch coverage. - Ran the existing Iceberg metadata authorization interceptor tests. - Ran the remaining Iceberg REST server tests excluding local database-container-dependent tests. All test commands were run with proxy environment variables disabled. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
