yuqi1129 opened a new issue, #13605: URL: https://github.com/apache/gravitino/issues/13605
### Version main branch ### Describe what's wrong A request loads the caller's JCasbin role policies once (`AuthorizationRequestContext.loadRole()`), then evaluates several checks. The read lock only covers each single `enforce()`. Between two checks, a role's `p` rows can be cleared while its `g(user, role)` row stays: - `loadedRoles` TTL (`expireAfterWrite`) or size eviction → removal listener → `clearRolePoliciesOnCacheRemoval()` - `handleRolePrivilegeChange()` on the role (any grant/revoke on this node) Later checks of the same request then evaluate without the role and never reload it: - **Wrong deny:** `loadTable` checks `ANY_SELECT_TABLE` on METALAKE → CATALOG → SCHEMA → TABLE. In production we saw the role hold 1631 policies at the CATALOG check and 0 at the SCHEMA check 144 ms later, with the `g` row still present, so a granted SCHEMA privilege was denied. The next request reloaded the role and succeeded. - **Wrong allow:** if a deny role is cleared after the allow check, a later `DENY` check (or the allow check's deny effect) no longer sees it, and the request can be allowed. #12169 fixed eviction removing `g` rows, and #13363 made a single reload atomic for one `enforce()`. This issue is about consistency across the checks of one request. ### Error message and/or stacktrace `ForbiddenException` on `loadTable` for a user whose role grants `SELECT_TABLE` on the schema. ### How to reproduce In one `AuthorizationRequestContext`: authorize a check that loads the role, call `loadedRoles.invalidate(roleId)` (or `handleRolePrivilegeChange(roleId)`), then authorize a check the role grants. It is denied. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
