jarredhj0214 opened a new pull request, #12702: URL: https://github.com/apache/gravitino/pull/12702
### What changes were proposed in this pull request? This PR backports the authorization denial message improvement to `branch-1.3`. It updates authorization denial messages generated by `GravitinoInterceptionService` to show the full `NameIdentifier` of the denied metadata object instead of only the last segment. For example, a table authorization failure now reports metadata like `metalake.catalog.schema.table` instead of `table`. A unit test is added to cover multi-segment `NameIdentifier` rendering in the no-auth response. ### Why are the changes needed? When different catalogs or schemas contain metadata objects with the same name, showing only `NameIdentifier.name()` makes authorization failures harder to diagnose. Showing the full `NameIdentifier` helps users identify the exact denied resource directly from the 403 error message. Fixes #12670 ### Does this PR introduce _any_ user-facing change? Yes. The diagnostic text in 403 authorization denial messages changes from the last metadata name segment to the full `NameIdentifier`. This does not change authorization logic, HTTP status codes, error response structure, response fields, or user permissions. ### How was this patch tested? Added a unit test in `TestGravitinoInterceptionService` to verify that authorization denial messages include the full metadata `NameIdentifier`. Ran `JAVA_HOME=/opt/homebrew/opt/openjdk@17 ./gradlew :server:test --tests org.apache.gravitino.server.web.filter.TestGravitinoInterceptionService -PskipITs`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
