jerryshao opened a new pull request, #13086: URL: https://github.com/apache/gravitino/pull/13086
### What changes were proposed in this pull request? - Authorize `testExistingConnection` with the load-catalog expression. - When the request carries non-empty `updates`, additionally require metalake or catalog ownership (`TEST_CATALOG_CONNECTION_WITH_CHANGES_AUTHORIZATION_EXPRESSION`). - Map `ForbiddenException` in the test-connection exception handler to HTTP 403 instead of 500. - Document the rule in `docs/security/access-control.md` and `docs/open-api/catalogs.yaml`. ### Why are the changes needed? A user who can load a catalog already reaches the backing system with its stored configuration. Owner-only for that test adds no protection. Proposed changes still require ownership because the caller chooses what the server connects to. Fix: #13085 ### Does this PR introduce _any_ user-facing change? Yes. - Users with `USE_CATALOG` can now test an existing catalog with its stored configuration. - Testing with proposed changes still requires ownership. A denied request now returns HTTP 403 instead of 500. ### How was this patch tested? - New cases in `TestCatalogAuthorizationExpression` and `TestCatalogOperations`. - New `CatalogAuthorizationIT#testTestExistingCatalogConnection` covering a user with `USE_CATALOG` and the owner end to end. - `./gradlew :server:test --tests '*TestCatalogOperations' --tests '*TestCatalogAuthorizationExpression' :docs:build -PskipITs` 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
