roryqi commented on PR #12964: URL: https://github.com/apache/gravitino/pull/12964#issuecomment-5698358954
Thanks for the detailed review. I have addressed all three inline issues. For the permission question, the intended rule is that VIEW and APPLY independently provide read access. `DENY_VIEW_POLICY`/`DENY_VIEW_TAG` cancels the corresponding VIEW grant, but does not revoke read access supplied by an effective APPLY grant. Likewise, `DENY_APPLY_*` does not cancel an effective VIEW grant. I updated the design document to match the implementation and the existing authorization tests. I also clarified object-policy provenance: `inherited=true` means the policy is selected only through tags inherited from ancestor metadata objects; if any matching tag is assigned directly to the requested object, it is `false`. Validation completed with focused core resolver/manager tests, `TestMetadataObjectPolicyOperations`, and `./gradlew :docs:build`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
