yuqi1129 opened a new pull request, #12623: URL: https://github.com/apache/gravitino/pull/12623
### What changes were proposed in this pull request? Move the parent-scope short-circuit and the `preloadToCache` / `preloadOwner` calls from `MetadataAuthzHelper.filterByExpression(..., NameIdentifier[])` into the generic `filterByExpression(..., E[], Function)`, and let the identifier overload delegate to the generic one. Every list endpoint now passes the same point regardless of the shape it holds its results in, so a caller with a parent-scope grant is filtered with one expression evaluation and one deny check instead of one evaluation per object. ### Why are the changes needed? `listCatalogs?details=true` carries `Catalog[]` and went through the generic overload, which had neither the short-circuit nor the preloads, so it ran the per-object loop over every catalog in the metalake. Catalogs are the only entity type with a `details=true` variant, which is why tables and schemas were unaffected and this went unnoticed. The list endpoints for functions, groups, jobs, policies, roles, tags and users also use the generic overload and gain the preloads. Fix: #12622 ### Does this PR introduce _any_ user-facing change? No. Filtering results are unchanged; only the work done to reach them is. No API or property is added. ### How was this patch tested? - New `testListShortCircuitAppliesToNonIdentifierResults` filters a non-identifier array through the generic overload. It fails without this change and passes with it. It asserts `hasDenyPolicy` is consulted exactly once, which only the short-circuit does; asserting on the returned elements alone would not catch the regression, because the metalake-scope grant satisfies the per-object expression as well. - `./gradlew :server-common:test :server:test -PskipITs` — `TestMetadataAuthzHelper` 10, `TestCatalogOperations` 9, `TestCatalogAuthorizationExpression` 5, no failures. - `./gradlew :server-common:spotlessCheck :server-common:javadoc :server:compileJava :iceberg:iceberg-rest-server:compileJava -PskipITs`. - `TestHttpsServerAuthentication` mutual-TLS cases fail intermittently in a full `:server-common:test` run on `main` as well, with different cases failing across runs; unrelated to this change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
