yuqi1129 opened a new pull request, #12973:
URL: https://github.com/apache/gravitino/pull/12973
### What changes were proposed in this pull request?
Move the user and group listing authorization expressions from private
literals in `UserOperations` and `GroupOperations` into
`AuthorizationExpressionConstants`, and reference them from both resources.
```java
// AuthorizationExpressionConstants
public static final String LOAD_USER_AUTHORIZATION_EXPRESSION =
"METALAKE::OWNER || METALAKE::MANAGE_USERS || USER::SELF";
public static final String LOAD_GROUP_AUTHORIZATION_EXPRESSION =
"METALAKE::OWNER || METALAKE::MANAGE_GROUPS || GROUP::SELF";
```
### Why are the changes needed?
Every other entity type that has a load or filter expression already
publishes it from `AuthorizationExpressionConstants` — role, tag, policy,
table, schema and the rest. Users and groups are the two exceptions: each
resource keeps its own private string literal, so any component that must
authorize identities the same way has to copy the literal, and nothing signals
it when the endpoint later tightens its expression. A copy that keeps the
looser expression would disclose users or groups the listing endpoint refuses.
This follows the same direction as #12875, which reused the shared table
expressions.
### Does this PR introduce _any_ user-facing change?
No. The expressions are byte-identical, so authorization behavior is
unchanged. Two new public constants are added to
`AuthorizationExpressionConstants`.
### How was this patch tested?
Existing `TestUserOperations` and `TestGroupOperations` pass (15 tests), and
`:server`/`:server-common` compile with Spotless applied.
```bash
./gradlew :server:test --tests "*TestUserOperations*" --tests
"*TestGroupOperations*" \
:server-common:compileJava :server:compileJava -PskipITs -PskipWeb=true
```
https://claude.ai/code/session_013xVSteM2ZUjXRHFbHtayVK
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
