paultanay opened a new issue, #12654:
URL: https://github.com/apache/gravitino/issues/12654
### Version
main branch
### Describe what's wrong
In `AuthorizationUtils.getMetadataObjectLocation()`, resolving the storage
location for a Fileset schema fails when the schema does not explicitly define
a `location` property and inherits the catalog's default location.
The fallback logic `else if
(catalogObj.properties().containsKey(FILESET_CATALOG_LOCATION))` is nested
inside `if (schema.properties().containsKey(FILESET_SCHEMA_LOCATION))`. Because
a schema created without a custom location does not have the `"location"` key
in `schema.properties()`, the outer condition evaluates to `false`, causing
`getMetadataObjectLocation` to return an empty list `[]`.
Consequently, authorization plugins (such as Apache Ranger) fail to generate
or remove the corresponding storage path policies
(`/catalogLocation/schemaName/*`) for inherited schemas.
### Error message and/or stacktrace
```text
org.opentest4j.AssertionFailedError: expected: <1> but was: <0>
```
### How to reproduce
1. Create a fileset catalog with property `location = "/warehouse/catalog"`.
2. Create a schema in this catalog without setting an explicit `location`
property in `schema.properties()`.
3. Call `AuthorizationUtils.getMetadataObjectLocation(schemaIdent,
Entity.EntityType.SCHEMA)`.
4. The method returns `[]` instead of `["/warehouse/catalog/<schemaName>"]`.
In unit test
`TestAuthorizationUtils.testGetSchemaTypeMetadataObjectLocation`:
```java
Mockito.when(schema.properties()).thenReturn(Collections.emptyMap());
Mockito.when(schema.name()).thenReturn("testSchema");
Mockito.when(catalog.properties()).thenReturn(ImmutableMap.of("location",
"catalogLocation"));
Mockito.when(catalog.provider()).thenReturn("fileset");
Mockito.when(catalog.type()).thenReturn(FILESET);
List<String> locations = AuthorizationUtils.getMetadataObjectLocation(
NameIdentifier.of("catalog", "schema", "fileset"),
Entity.EntityType.SCHEMA);
Assertions.assertEquals(1, locations.size()); // Fails: expected <1> but was
<0>
```
### Additional context
Located in
[`core/src/main/java/org/apache/gravitino/authorization/AuthorizationUtils.java`](https://github.com/apache/gravitino/blob/main/core/src/main/java/org/apache/gravitino/authorization/AuthorizationUtils.java#L737-L753):
```java
case FILESET:
if ("fileset".equals(catalogObj.provider())) {
if (schema.properties().containsKey(FILESET_SCHEMA_LOCATION)) {
String schemaLocation =
schema.properties().get(FILESET_SCHEMA_LOCATION);
if (StringUtils.isNotBlank(schemaLocation)) {
locations.add(schemaLocation);
} else if
(catalogObj.properties().containsKey(FILESET_CATALOG_LOCATION)) {
String catalogLocation =
catalogObj.properties().get(FILESET_CATALOG_LOCATION);
if (StringUtils.isNotBlank(catalogLocation)) {
schemaLocation = catalogLocation + "/" + schema.name();
locations.add(schemaLocation);
}
} else {
LOG.warn("Schema {} location is not found", ident);
}
}
}
break;
```
The catalog fallback should be evaluated whenever the schema's explicit
location is absent or blank, rather than being gated by
`schema.properties().containsKey(FILESET_SCHEMA_LOCATION)`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
