yuqi1129 opened a new pull request, #12873: URL: https://github.com/apache/gravitino/pull/12873
### What changes were proposed in this pull request? - Invoke the authorization removal hook after successfully dropping a function. - Invalidate the local JCasbin name-to-ID mapping when metadata privileges are removed. - Write a Function DROP record to `entity_change_log` in the same transaction as the metadata deletion, allowing peer nodes to invalidate stale authorization mappings. - Add tests for successful/no-op function drops, local invalidation, transactional change-log emission and rollback, and peer-side Function cache-key invalidation. ### Why are the changes needed? Dropping and recreating a function with the same name may reuse a stale JCasbin name-to-ID mapping. The old in-memory `EXECUTE_FUNCTION` policy can consequently authorize access to the newly created function. Functions bypass the Entity Store cache, so their drops currently do not emit an `entity_change_log` record. The normal polling interval therefore does not bound the stale window on peer nodes. Fix: #12871 ### Does this PR introduce _any_ user-facing change? Yes. A function recreated with the same name no longer inherits authorization grants associated with the previously dropped function. ### How was this patch tested? - `./gradlew spotlessApply` - Targeted tests for `TestAuthorizationUtils`, `TestFunctionHookDispatcher`, `TestEntityChangeLogService`, and `TestJcasbinChangePoller` - `./gradlew :core:test :server-common:test -PskipITs -PskipDockerTests` - `./gradlew :core:spotlessCheck :server-common:spotlessCheck` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
