1fanwang opened a new pull request, #12673: URL: https://github.com/apache/gravitino/pull/12673
### What changes were proposed in this pull request? A user who owns a catalog and one of its schemas can currently get `403 Forbidden` when granting schema privileges unless they also have an explicit `USE_CATALOG` grant. This change allows the catalog owner to perform the operation and adds a regression for that case. The authorizer now continues checking ancestors when ownership of the current object does not satisfy its parent usage requirement. ### Why are the changes needed? The schema ownership check returned its failed `USE_CATALOG` result immediately, so the authorizer never reached the catalog ownership check. A user who owned both objects received `403 Forbidden: "Current user can not grant privilege to role."`, while owning only the catalog allowed the same operation. Fix: #12269 ### Does this PR introduce _any_ user-facing change? Yes. A catalog owner who also owns a child schema can grant privileges on that schema without a redundant `USE_CATALOG` grant. ### How was this patch tested? ```shell ./gradlew :server-common:test --tests 'org.apache.gravitino.server.authorization.jcasbin.TestJcasbinAuthorizer' ``` <details> <summary>Raw logs</summary> ```text Before, on upstream main: TestJcasbinAuthorizer.testHasSetOwnerPermissionAllowsSchemaAndCatalogOwner FAILED expected: <true> but was: <false> Tests: 1, failures: 1 After: Tests: 59, skipped: 0, failures: 0, errors: 0 BUILD SUCCESSFUL ``` </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
