yuqi1129 opened a new issue, #12875:
URL: https://github.com/apache/gravitino/issues/12875
### What would you like to be improved?
The same table authorization expressions are written out by hand in 13
places across the core server and Iceberg REST, even though
`AuthorizationExpressionConstants` already holds two of the three shapes:
| Expression shape | Today
|
| ---------------------------------------------------- |
----------------------------------------------------------- |
| `TABLE::OWNER \|\| ANY_SELECT_TABLE \|\| ANY_MODIFY_TABLE` |
`LOAD_TABLE_AUTHORIZATION_EXPRESSION` exists, still inlined 4 times |
| `TABLE::OWNER \|\| ANY_MODIFY_TABLE` |
`MODIFY_TABLE_AUTHORIZATION_EXPRESSION` exists, still inlined 6 times |
| `TABLE::OWNER` (removal) | no constant,
inlined 3 times |
The copies live in `TableOperations`, `StatisticOperations`,
`IcebergTableOperations`, `IcebergTableRenameOperations` and
`RenameTableAuthzHandler`.
Two of the copies have already drifted in formatting (`ANY_SELECT_TABLE||
ANY_MODIFY_TABLE`, missing the space), which shows they are edited
independently. A privilege change to any of these rules has to be applied by
hand in every copy, and missing one is a silent authorization difference
between the Gravitino, Iceberg REST and Lance REST surfaces rather than a
visible failure.
### How should we improve?
Add `DROP_TABLE_AUTHORIZATION_EXPRESSION` for the third shape, and point all
13 sites at the three shared constants. This is behavior preserving and does
not change any privilege rule.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
