This is an automated email from the ASF dual-hosted git repository.
roryqi pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/main by this push:
new 356536d324 [#13609] fix(authz): Revert ModelVersion secrets
MetadataObject from #12983 (#13610)
356536d324 is described below
commit 356536d3248110cb90099792352780b1d1eb6ccb
Author: MaSai <[email protected]>
AuthorDate: Wed Sep 30 16:03:30 2026 +0800
[#13609] fix(authz): Revert ModelVersion secrets MetadataObject from #12983
(#13610)
### What changes were proposed in this pull request?
Revert ModelVersion-as-secrets MetadataObject wiring introduced in
#12983:
- Remove `MetadataObject.Type.MODEL_VERSION` and `MetadataObjects`
four-level naming
- Remove `ModelVersion.supportsSecrets` and Java/Python client wiring
- Drop `MODEL_VERSION` from `SECRET_SUPPORTED_TYPES`, auth expressions,
and docs
- Keep `Entity.EntityType.MODEL_VERSION` and `Model.supportsSecrets`
### Why are the changes needed?
#12983 incorrectly treated model versions as secret metadata objects /
privilege bind
targets. Secret privileges should bind like other model privileges
(Metalake…Model).
Fix: #13609
### Does this PR introduce _any_ user-facing change?
Yes:
- `getSecrets` no longer accepts `type=model_version`
- `USE_SECRETS` / `INCLUDE_CREDENTIAL_SECRETS` no longer bind to
`MODEL_VERSION`
- `MetadataObject.Type.MODEL_VERSION` removed
### How was this patch tested?
Existing unit tests updated for privilege binds, auth expressions,
NameIdentifierUtil,
jcasbin cache keys, and secret REST operations.
Made with [Cursor](https://cursor.com)
---------
Co-authored-by: Cursor <[email protected]>
---
.../java/org/apache/gravitino/MetadataObject.java | 2 --
.../java/org/apache/gravitino/MetadataObjects.java | 5 +--
.../apache/gravitino/authorization/Privileges.java | 3 +-
.../org/apache/gravitino/model/ModelVersion.java | 11 ------
.../authorization/TestSecurableObjects.java | 2 --
.../gravitino/client/GenericModelCatalog.java | 10 +++---
.../gravitino/client/GenericModelVersion.java | 33 ++----------------
.../gravitino/api/authorization/privileges.py | 1 -
.../client-python/gravitino/api/metadata_object.py | 3 --
.../gravitino/api/metadata_objects.py | 6 ++--
.../gravitino/api/model/model_version.py | 7 ----
.../gravitino/client/generic_model_catalog.py | 18 +++-------
.../gravitino/client/generic_model_version.py | 39 ++--------------------
.../tests/unittests/test_metadata_objects.py | 3 +-
.../secret/SecretPropertyOperationDispatcher.java | 36 ++------------------
.../apache/gravitino/utils/MetadataObjectUtil.java | 18 ----------
.../apache/gravitino/utils/NameIdentifierUtil.java | 8 -----
.../gravitino/utils/TestNameIdentifierUtil.java | 10 +++---
docs/open-api/openapi.yaml | 1 -
docs/open-api/secrets.yaml | 2 +-
docs/security/access-control.md | 4 +--
.../AuthorizationExpressionConverter.java | 13 +++-----
.../jcasbin/JcasbinAuthorizationCacheKeys.java | 7 ----
.../TestAuthorizationExpressionConverter.java | 11 +++---
.../jcasbin/TestJcasbinAuthorizationCacheKeys.java | 8 -----
.../web/rest/MetadataObjectSecretOperations.java | 3 +-
.../rest/TestMetadataObjectSecretOperations.java | 6 ----
27 files changed, 41 insertions(+), 229 deletions(-)
diff --git a/api/src/main/java/org/apache/gravitino/MetadataObject.java
b/api/src/main/java/org/apache/gravitino/MetadataObject.java
index 24c9e06b67..6dca45345d 100644
--- a/api/src/main/java/org/apache/gravitino/MetadataObject.java
+++ b/api/src/main/java/org/apache/gravitino/MetadataObject.java
@@ -66,8 +66,6 @@ public interface MetadataObject {
ROLE,
/** A model is mapped to the model artifact in ML. */
MODEL,
- /** A model version is a checkpoint / snapshot linked to a registered
model. */
- MODEL_VERSION,
/** A tag is used to help manage other metadata object. */
TAG,
/**
diff --git a/api/src/main/java/org/apache/gravitino/MetadataObjects.java
b/api/src/main/java/org/apache/gravitino/MetadataObjects.java
index de1a56871d..835c1636b3 100644
--- a/api/src/main/java/org/apache/gravitino/MetadataObjects.java
+++ b/api/src/main/java/org/apache/gravitino/MetadataObjects.java
@@ -64,7 +64,7 @@ public class MetadataObjects {
MetadataObject.Type.SEMANTIC_MODEL);
private static final Set<MetadataObject.Type> VALID_FOUR_LEVEL_NAME_TYPES =
- Sets.newHashSet(MetadataObject.Type.COLUMN,
MetadataObject.Type.MODEL_VERSION);
+ Sets.newHashSet(MetadataObject.Type.COLUMN);
private static final Map<Set<MetadataObject.Type>, Integer>
TYPE_TO_EXPECT_LENGTH =
ImmutableMap.of(
@@ -148,9 +148,6 @@ public class MetadataObjects {
case COLUMN:
parentType = MetadataObject.Type.TABLE;
break;
- case MODEL_VERSION:
- parentType = MetadataObject.Type.MODEL;
- break;
case TABLE:
case VIEW:
case FILESET:
diff --git
a/api/src/main/java/org/apache/gravitino/authorization/Privileges.java
b/api/src/main/java/org/apache/gravitino/authorization/Privileges.java
index 9519fe2e27..9094e18b9f 100644
--- a/api/src/main/java/org/apache/gravitino/authorization/Privileges.java
+++ b/api/src/main/java/org/apache/gravitino/authorization/Privileges.java
@@ -81,8 +81,7 @@ public class Privileges {
MetadataObject.Type.VIEW,
MetadataObject.Type.TOPIC,
MetadataObject.Type.FILESET,
- MetadataObject.Type.MODEL,
- MetadataObject.Type.MODEL_VERSION);
+ MetadataObject.Type.MODEL);
private static final Set<MetadataObject.Type> FUNCTION_SUPPORTED_TYPES =
Sets.immutableEnumSet(
diff --git a/api/src/main/java/org/apache/gravitino/model/ModelVersion.java
b/api/src/main/java/org/apache/gravitino/model/ModelVersion.java
index abe4206771..a9d3be4abb 100644
--- a/api/src/main/java/org/apache/gravitino/model/ModelVersion.java
+++ b/api/src/main/java/org/apache/gravitino/model/ModelVersion.java
@@ -22,7 +22,6 @@ import java.util.Collections;
import java.util.Map;
import org.apache.gravitino.Auditable;
import org.apache.gravitino.annotation.Evolving;
-import org.apache.gravitino.secret.SupportsSecrets;
/**
* An interface representing a single model checkpoint under a model {@link
Model}. A model version
@@ -96,14 +95,4 @@ public interface ModelVersion extends Auditable {
default Map<String, String> properties() {
return Collections.emptyMap();
}
-
- /**
- * @return the {@link SupportsSecrets} if the model version supports secret
property operations.
- * @throws UnsupportedOperationException if the model version does not
support secret property
- * operations.
- */
- default SupportsSecrets supportsSecrets() {
- throw new UnsupportedOperationException(
- "Model version does not support secret property operations.");
- }
}
diff --git
a/api/src/test/java/org/apache/gravitino/authorization/TestSecurableObjects.java
b/api/src/test/java/org/apache/gravitino/authorization/TestSecurableObjects.java
index eb01e7ca1e..77d44f350a 100644
---
a/api/src/test/java/org/apache/gravitino/authorization/TestSecurableObjects.java
+++
b/api/src/test/java/org/apache/gravitino/authorization/TestSecurableObjects.java
@@ -449,7 +449,6 @@ public class TestSecurableObjects {
Assertions.assertTrue(useSecrets.canBindTo(MetadataObject.Type.TOPIC));
Assertions.assertTrue(useSecrets.canBindTo(MetadataObject.Type.FILESET));
Assertions.assertTrue(useSecrets.canBindTo(MetadataObject.Type.MODEL));
-
Assertions.assertTrue(useSecrets.canBindTo(MetadataObject.Type.MODEL_VERSION));
Assertions.assertFalse(useSecrets.canBindTo(MetadataObject.Type.ROLE));
Assertions.assertFalse(useSecrets.canBindTo(MetadataObject.Type.COLUMN));
Assertions.assertFalse(useSecrets.canBindTo(MetadataObject.Type.FUNCTION));
@@ -462,7 +461,6 @@ public class TestSecurableObjects {
Assertions.assertTrue(includeCredentialSecrets.canBindTo(MetadataObject.Type.TOPIC));
Assertions.assertTrue(includeCredentialSecrets.canBindTo(MetadataObject.Type.FILESET));
Assertions.assertTrue(includeCredentialSecrets.canBindTo(MetadataObject.Type.MODEL));
-
Assertions.assertTrue(includeCredentialSecrets.canBindTo(MetadataObject.Type.MODEL_VERSION));
Assertions.assertFalse(includeCredentialSecrets.canBindTo(MetadataObject.Type.ROLE));
Assertions.assertFalse(includeCredentialSecrets.canBindTo(MetadataObject.Type.COLUMN));
Assertions.assertFalse(includeCredentialSecrets.canBindTo(MetadataObject.Type.FUNCTION));
diff --git
a/clients/client-java/src/main/java/org/apache/gravitino/client/GenericModelCatalog.java
b/clients/client-java/src/main/java/org/apache/gravitino/client/GenericModelCatalog.java
index 2d1db0022c..7f8c20973b 100644
---
a/clients/client-java/src/main/java/org/apache/gravitino/client/GenericModelCatalog.java
+++
b/clients/client-java/src/main/java/org/apache/gravitino/client/GenericModelCatalog.java
@@ -180,7 +180,7 @@ class GenericModelCatalog extends BaseSchemaCatalog
implements ModelCatalog {
resp.validate();
return Arrays.stream(resp.getVersions())
- .map(v -> new GenericModelVersion(v, restClient, modelFullIdent))
+ .map(v -> new GenericModelVersion(v))
.toArray(ModelVersion[]::new);
}
@@ -198,7 +198,7 @@ class GenericModelCatalog extends BaseSchemaCatalog
implements ModelCatalog {
Collections.emptyMap(),
ErrorHandlers.modelErrorHandler());
resp.validate();
- return new GenericModelVersion(resp.getModelVersion(), restClient,
modelFullIdent);
+ return new GenericModelVersion(resp.getModelVersion());
}
@Override
@@ -218,7 +218,7 @@ class GenericModelCatalog extends BaseSchemaCatalog
implements ModelCatalog {
ErrorHandlers.modelErrorHandler());
resp.validate();
- return new GenericModelVersion(resp.getModelVersion(), restClient,
modelFullIdent);
+ return new GenericModelVersion(resp.getModelVersion());
}
@Override
@@ -375,7 +375,7 @@ class GenericModelCatalog extends BaseSchemaCatalog
implements ModelCatalog {
ErrorHandlers.modelErrorHandler());
resp.validate();
- return new GenericModelVersion(resp.getModelVersion(), restClient,
modelFullIdent);
+ return new GenericModelVersion(resp.getModelVersion());
}
@Override
@@ -405,7 +405,7 @@ class GenericModelCatalog extends BaseSchemaCatalog
implements ModelCatalog {
ErrorHandlers.modelErrorHandler());
resp.validate();
- return new GenericModelVersion(resp.getModelVersion(), restClient,
modelFullIdent);
+ return new GenericModelVersion(resp.getModelVersion());
}
/**
diff --git
a/clients/client-java/src/main/java/org/apache/gravitino/client/GenericModelVersion.java
b/clients/client-java/src/main/java/org/apache/gravitino/client/GenericModelVersion.java
index cb04820b6d..406237ee10 100644
---
a/clients/client-java/src/main/java/org/apache/gravitino/client/GenericModelVersion.java
+++
b/clients/client-java/src/main/java/org/apache/gravitino/client/GenericModelVersion.java
@@ -18,36 +18,17 @@
*/
package org.apache.gravitino.client;
-import java.util.Arrays;
import java.util.Map;
import org.apache.gravitino.Audit;
-import org.apache.gravitino.MetadataObject;
-import org.apache.gravitino.MetadataObjects;
-import org.apache.gravitino.NameIdentifier;
import org.apache.gravitino.dto.model.ModelVersionDTO;
import org.apache.gravitino.model.ModelVersion;
-import org.apache.gravitino.secret.SupportsSecrets;
-class GenericModelVersion implements ModelVersion, SupportsSecrets {
+class GenericModelVersion implements ModelVersion {
private final ModelVersionDTO modelVersionDTO;
- private final MetadataObjectSecretOperations objectSecretOperations;
-
- GenericModelVersion(
- ModelVersionDTO modelVersionDTO, RESTClient restClient, NameIdentifier
modelFullIdent) {
+ GenericModelVersion(ModelVersionDTO modelVersionDTO) {
this.modelVersionDTO = modelVersionDTO;
- MetadataObject modelVersionObject =
- MetadataObjects.of(
- Arrays.asList(
- modelFullIdent.namespace().level(1),
- modelFullIdent.namespace().level(2),
- modelFullIdent.name(),
- String.valueOf(modelVersionDTO.version())),
- MetadataObject.Type.MODEL_VERSION);
- this.objectSecretOperations =
- new MetadataObjectSecretOperations(
- modelFullIdent.namespace().level(0), modelVersionObject,
restClient);
}
@Override
@@ -80,16 +61,6 @@ class GenericModelVersion implements ModelVersion,
SupportsSecrets {
return modelVersionDTO.auditInfo();
}
- @Override
- public SupportsSecrets supportsSecrets() {
- return this;
- }
-
- @Override
- public Map<String, String> getSecrets() {
- return objectSecretOperations.getSecrets();
- }
-
@Override
public boolean equals(Object o) {
if (this == o) {
diff --git a/clients/client-python/gravitino/api/authorization/privileges.py
b/clients/client-python/gravitino/api/authorization/privileges.py
index fe14715d9a..d76be10510 100644
--- a/clients/client-python/gravitino/api/authorization/privileges.py
+++ b/clients/client-python/gravitino/api/authorization/privileges.py
@@ -1821,7 +1821,6 @@ class Privileges:
MetadataObject.Type.TOPIC,
MetadataObject.Type.FILESET,
MetadataObject.Type.MODEL,
- MetadataObject.Type.MODEL_VERSION,
}
MANAGE_GRANTS_SUPPORTED_TYPES = {
MetadataObject.Type.METALAKE,
diff --git a/clients/client-python/gravitino/api/metadata_object.py
b/clients/client-python/gravitino/api/metadata_object.py
index 7cd8fd4313..a46a9ba44a 100644
--- a/clients/client-python/gravitino/api/metadata_object.py
+++ b/clients/client-python/gravitino/api/metadata_object.py
@@ -75,9 +75,6 @@ class MetadataObject(ABC):
MODEL = "model"
"""A model is mapped to the model artifact in ML."""
- MODEL_VERSION = "model_version"
- """A model version is a checkpoint / snapshot linked to a registered
model."""
-
TAG = "tag"
"""A tag is used to help manage other metadata object."""
diff --git a/clients/client-python/gravitino/api/metadata_objects.py
b/clients/client-python/gravitino/api/metadata_objects.py
index c60d45a873..c84aacc1b6 100644
--- a/clients/client-python/gravitino/api/metadata_objects.py
+++ b/clients/client-python/gravitino/api/metadata_objects.py
@@ -50,7 +50,7 @@ class MetadataObjects:
MetadataObject.Type.VIEW,
MetadataObject.Type.FUNCTION,
},
- 4: {MetadataObject.Type.COLUMN, MetadataObject.Type.MODEL_VERSION},
+ 4: {MetadataObject.Type.COLUMN},
}
@staticmethod
@@ -98,7 +98,7 @@ class MetadataObjects:
)
Precondition.check_argument(
names_len != 4 or type_ in MetadataObjects._NAMES_LEN_CONDS[4],
- "If the length of names is 4, it must be COLUMN or MODEL_VERSION",
+ "If the length of names is 4, it must be the COLUMN type",
)
names = name_or_names
for name in names:
@@ -135,8 +135,6 @@ class MetadataObjects:
parent_type = None
if object_type is MetadataObject.Type.COLUMN:
parent_type = MetadataObject.Type.TABLE
- elif object_type is MetadataObject.Type.MODEL_VERSION:
- parent_type = MetadataObject.Type.MODEL
elif object_type in {
MetadataObject.Type.TABLE,
MetadataObject.Type.FILESET,
diff --git a/clients/client-python/gravitino/api/model/model_version.py
b/clients/client-python/gravitino/api/model/model_version.py
index fc51100a03..f1737cd2e9 100644
--- a/clients/client-python/gravitino/api/model/model_version.py
+++ b/clients/client-python/gravitino/api/model/model_version.py
@@ -19,8 +19,6 @@
from abc import abstractmethod
from typing import Optional, Dict, List
from gravitino.api.auditable import Auditable
-from gravitino.api.secret.supports_secrets import SupportsSecrets
-from gravitino.exceptions.base import UnsupportedOperationException
class ModelVersion(Auditable):
@@ -104,8 +102,3 @@ class ModelVersion(Auditable):
The properties of the model version. An empty dictionary is
returned if no properties are set.
"""
pass
-
- def support_secrets(self) -> SupportsSecrets:
- raise UnsupportedOperationException(
- "Model version does not support secret property operations."
- )
diff --git a/clients/client-python/gravitino/client/generic_model_catalog.py
b/clients/client-python/gravitino/client/generic_model_catalog.py
index e66a4678c2..cad07595cf 100644
--- a/clients/client-python/gravitino/client/generic_model_catalog.py
+++ b/clients/client-python/gravitino/client/generic_model_catalog.py
@@ -252,7 +252,7 @@ class GenericModelCatalog(BaseSchemaCatalog): # pylint:
disable=R0901
model_version_info_list_resp.validate()
return [
- GenericModelVersion(version, self.rest_client, model_full_ident)
+ GenericModelVersion(version)
for version in model_version_info_list_resp.versions()
]
@@ -283,9 +283,7 @@ class GenericModelCatalog(BaseSchemaCatalog): # pylint:
disable=R0901
)
model_version_resp.validate()
- return GenericModelVersion(
- model_version_resp.model_version(), self.rest_client,
model_full_ident
- )
+ return GenericModelVersion(model_version_resp.model_version())
def get_model_version_by_alias(
self, model_ident: NameIdentifier, alias: str
@@ -316,9 +314,7 @@ class GenericModelCatalog(BaseSchemaCatalog): # pylint:
disable=R0901
)
model_version_resp.validate()
- return GenericModelVersion(
- model_version_resp.model_version(), self.rest_client,
model_full_ident
- )
+ return GenericModelVersion(model_version_resp.model_version())
def alter_model(self, model_ident: NameIdentifier, *changes: ModelChange)
-> Model:
"""Alter the schema by applying the changes.
@@ -387,9 +383,7 @@ class GenericModelCatalog(BaseSchemaCatalog): # pylint:
disable=R0901
resp.body, infer_missing=True
)
model_version_response.validate()
- return GenericModelVersion(
- model_version_response.model_version(), self.rest_client,
model_full_ident
- )
+ return GenericModelVersion(model_version_response.model_version())
def alter_model_version_by_alias(
self, model_ident: NameIdentifier, alias: str, *changes:
ModelVersionChange
@@ -429,9 +423,7 @@ class GenericModelCatalog(BaseSchemaCatalog): # pylint:
disable=R0901
resp.body, infer_missing=True
)
model_version_response.validate()
- return GenericModelVersion(
- model_version_response.model_version(), self.rest_client,
model_full_ident
- )
+ return GenericModelVersion(model_version_response.model_version())
def link_model_version(
self,
diff --git a/clients/client-python/gravitino/client/generic_model_version.py
b/clients/client-python/gravitino/client/generic_model_version.py
index e435540eca..9c0cc977a1 100644
--- a/clients/client-python/gravitino/client/generic_model_version.py
+++ b/clients/client-python/gravitino/client/generic_model_version.py
@@ -14,46 +14,19 @@
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
-from typing import Dict, List, Optional
+from typing import Optional, Dict, List
-from gravitino.api.metadata_object import MetadataObject
-from gravitino.api.metadata_objects import MetadataObjects
from gravitino.api.model.model_version import ModelVersion
-from gravitino.api.secret.supports_secrets import SupportsSecrets
-from gravitino.client.metadata_object_secret_operations import (
- MetadataObjectSecretOperations,
-)
from gravitino.dto.audit_dto import AuditDTO
from gravitino.dto.model_version_dto import ModelVersionDTO
-from gravitino.name_identifier import NameIdentifier
-from gravitino.utils import HTTPClient
-class GenericModelVersion(ModelVersion, SupportsSecrets):
+class GenericModelVersion(ModelVersion):
_model_version_dto: ModelVersionDTO
"""The model version DTO object."""
- def __init__(
- self,
- model_version_dto: ModelVersionDTO,
- rest_client: HTTPClient,
- model_full_ident: NameIdentifier,
- ):
+ def __init__(self, model_version_dto: ModelVersionDTO):
self._model_version_dto = model_version_dto
- model_version_object: MetadataObject = MetadataObjects.of(
- [
- model_full_ident.namespace().level(1),
- model_full_ident.namespace().level(2),
- model_full_ident.name(),
- str(model_version_dto.version()),
- ],
- MetadataObject.Type.MODEL_VERSION,
- )
- self._object_secret_operations = MetadataObjectSecretOperations(
- model_full_ident.namespace().level(0),
- model_version_object,
- rest_client,
- )
def version(self) -> int:
return self._model_version_dto.version()
@@ -72,9 +45,3 @@ class GenericModelVersion(ModelVersion, SupportsSecrets):
def audit_info(self) -> AuditDTO:
return self._model_version_dto.audit_info()
-
- def support_secrets(self) -> SupportsSecrets:
- return self
-
- def get_secrets(self) -> Dict[str, str]:
- return self._object_secret_operations.get_secrets()
diff --git a/clients/client-python/tests/unittests/test_metadata_objects.py
b/clients/client-python/tests/unittests/test_metadata_objects.py
index 2e47aa480f..7e1a8c97d3 100644
--- a/clients/client-python/tests/unittests/test_metadata_objects.py
+++ b/clients/client-python/tests/unittests/test_metadata_objects.py
@@ -124,7 +124,8 @@ class TestMetadataObjects(unittest.TestCase):
)
with self.assertRaisesRegex(
- IllegalArgumentException, "If the length of names is 4, it must be
COLUMN"
+ IllegalArgumentException,
+ "If the length of names is 4, it must be the COLUMN type",
):
MetadataObjects.of(
["catalog1", "schema1", "table1", "column1"],
MetadataObject.Type.TABLE
diff --git
a/core/src/main/java/org/apache/gravitino/secret/SecretPropertyOperationDispatcher.java
b/core/src/main/java/org/apache/gravitino/secret/SecretPropertyOperationDispatcher.java
index 8b22dc8516..2cb1fd0544 100644
---
a/core/src/main/java/org/apache/gravitino/secret/SecretPropertyOperationDispatcher.java
+++
b/core/src/main/java/org/apache/gravitino/secret/SecretPropertyOperationDispatcher.java
@@ -34,7 +34,6 @@ import org.apache.gravitino.exceptions.NoSuchEntityException;
import org.apache.gravitino.exceptions.NoSuchFilesetException;
import org.apache.gravitino.exceptions.NoSuchMetalakeException;
import org.apache.gravitino.exceptions.NoSuchModelException;
-import org.apache.gravitino.exceptions.NoSuchModelVersionException;
import org.apache.gravitino.exceptions.NoSuchSchemaException;
import org.apache.gravitino.exceptions.NoSuchTableException;
import org.apache.gravitino.exceptions.NoSuchTopicException;
@@ -45,7 +44,6 @@ import org.apache.gravitino.meta.FilesetEntity;
import org.apache.gravitino.meta.SchemaEntity;
import org.apache.gravitino.metalake.MetalakePropertiesMetadata;
import org.apache.gravitino.model.Model;
-import org.apache.gravitino.model.ModelVersion;
import org.apache.gravitino.rel.Table;
import org.apache.gravitino.rel.View;
import org.apache.gravitino.storage.IdGenerator;
@@ -53,8 +51,8 @@ import org.apache.gravitino.utils.NameIdentifierUtil;
import org.apache.gravitino.utils.ThrowableFunction;
/**
- * Dispatches secrets requests for metalake, catalog, schema, fileset, table,
topic, view, model,
- * and model version metadata objects.
+ * Dispatches secrets requests for metalake, catalog, schema, fileset, table,
topic, view, and model
+ * metadata objects.
*
* <p>Loads raw entity properties from the entity store / catalog connector,
then builds plaintext
* secrets via {@link SecretPropertyUtils#buildSecrets} (secret-manager URNs
plus sensitive-named
@@ -128,8 +126,6 @@ public class SecretPropertyOperationDispatcher extends
OperationDispatcher {
return loadViewRawPropertiesAndMetadata(identifier);
case MODEL:
return loadModelRawPropertiesAndMetadata(identifier);
- case MODEL_VERSION:
- return loadModelVersionRawPropertiesAndMetadata(identifier);
default:
throw new NotSupportedException(
"Doesn't support secret property operations for entity type: " +
entityType);
@@ -247,34 +243,6 @@ public class SecretPropertyOperationDispatcher extends
OperationDispatcher {
NoSuchModelException.class);
}
- private RawPropertiesAndMetadata loadModelVersionRawPropertiesAndMetadata(
- NameIdentifier identifier) {
- NameIdentifier catalogIdent =
NameIdentifierUtil.getCatalogIdentifier(identifier);
- NameIdentifier modelIdent =
NameIdentifier.of(identifier.namespace().levels());
- String versionName = identifier.name();
- return doWithCatalog(
- catalogIdent,
- wrapper -> {
- wrapper.catalog().checkMetalakeInUse();
- ModelVersion modelVersion;
- try {
- int version = Integer.parseInt(versionName);
- modelVersion = wrapper.doWithModelOps(ops ->
ops.getModelVersion(modelIdent, version));
- } catch (NumberFormatException e) {
- modelVersion =
- wrapper.doWithModelOps(ops -> ops.getModelVersion(modelIdent,
versionName));
- }
- Map<String, String> raw =
- modelVersion.properties() == null ? Map.of() :
modelVersion.properties();
- return new RawPropertiesAndMetadata(
- raw,
- resolvePropertiesMetadata(
- wrapper,
HasPropertyMetadata::modelVersionPropertiesMetadata));
- },
- NoSuchCatalogException.class,
- NoSuchModelVersionException.class);
- }
-
private Map<String, String> loadMetalakeRawProperties(NameIdentifier
identifier) {
try {
BaseMetalake entity = store.get(identifier, Entity.EntityType.METALAKE,
BaseMetalake.class);
diff --git
a/core/src/main/java/org/apache/gravitino/utils/MetadataObjectUtil.java
b/core/src/main/java/org/apache/gravitino/utils/MetadataObjectUtil.java
index 445e3d640b..8af724480e 100644
--- a/core/src/main/java/org/apache/gravitino/utils/MetadataObjectUtil.java
+++ b/core/src/main/java/org/apache/gravitino/utils/MetadataObjectUtil.java
@@ -58,7 +58,6 @@ public class MetadataObjectUtil {
.put(MetadataObject.Type.COLUMN, Entity.EntityType.COLUMN)
.put(MetadataObject.Type.ROLE, Entity.EntityType.ROLE)
.put(MetadataObject.Type.MODEL, Entity.EntityType.MODEL)
- .put(MetadataObject.Type.MODEL_VERSION,
Entity.EntityType.MODEL_VERSION)
.put(MetadataObject.Type.TAG, Entity.EntityType.TAG)
.put(MetadataObject.Type.POLICY, Entity.EntityType.POLICY)
.put(MetadataObject.Type.JOB_TEMPLATE,
Entity.EntityType.JOB_TEMPLATE)
@@ -135,7 +134,6 @@ public class MetadataObjectUtil {
case TOPIC:
case FILESET:
case COLUMN:
- case MODEL_VERSION:
case MODEL:
case FUNCTION:
String fullName = DOT.join(metalakeName, metadataObject.fullName());
@@ -265,22 +263,6 @@ public class MetadataObjectUtil {
check(env.internalTableDispatcher().tableExists(tableIdent),
exceptionToThrowSupplier);
break;
- case MODEL_VERSION:
- NameIdentifierUtil.checkModelVersion(identifier);
- NameIdentifier modelIdent =
NameIdentifier.of(identifier.namespace().levels());
- check(env.internalModelDispatcher().modelExists(modelIdent),
exceptionToThrowSupplier);
- try {
- int version = Integer.parseInt(object.name());
- check(
- env.internalModelDispatcher().modelVersionExists(modelIdent,
version),
- exceptionToThrowSupplier);
- } catch (NumberFormatException e) {
- check(
- env.internalModelDispatcher().modelVersionExists(modelIdent,
object.name()),
- exceptionToThrowSupplier);
- }
- break;
-
case TOPIC:
NameIdentifierUtil.checkTopic(identifier);
check(env.internalTopicDispatcher().topicExists(identifier),
exceptionToThrowSupplier);
diff --git
a/core/src/main/java/org/apache/gravitino/utils/NameIdentifierUtil.java
b/core/src/main/java/org/apache/gravitino/utils/NameIdentifierUtil.java
index a80ccaa447..8efb9aab7b 100644
--- a/core/src/main/java/org/apache/gravitino/utils/NameIdentifierUtil.java
+++ b/core/src/main/java/org/apache/gravitino/utils/NameIdentifierUtil.java
@@ -705,14 +705,6 @@ public class NameIdentifierUtil {
String modelParent = dot.join(ident.namespace().level(1),
ident.namespace().level(2));
return MetadataObjects.of(modelParent, ident.name(),
MetadataObject.Type.MODEL);
- case MODEL_VERSION:
- checkModelVersion(ident);
- Namespace modelVersionNs = ident.namespace();
- String modelVersionParent =
- dot.join(modelVersionNs.level(1), modelVersionNs.level(2),
modelVersionNs.level(3));
- return MetadataObjects.of(
- modelVersionParent, ident.name(),
MetadataObject.Type.MODEL_VERSION);
-
case FUNCTION:
checkFunction(ident);
String functionParent = dot.join(ident.namespace().level(1),
ident.namespace().level(2));
diff --git
a/core/src/test/java/org/apache/gravitino/utils/TestNameIdentifierUtil.java
b/core/src/test/java/org/apache/gravitino/utils/TestNameIdentifierUtil.java
index d5b8d6f4c9..4a68158c75 100644
--- a/core/src/test/java/org/apache/gravitino/utils/TestNameIdentifierUtil.java
+++ b/core/src/test/java/org/apache/gravitino/utils/TestNameIdentifierUtil.java
@@ -165,14 +165,12 @@ public class TestNameIdentifierUtil {
NameIdentifierUtil.ofTag("metalake1", "tag1"),
Entity.EntityType.TAG);
assertEquals(expectedTagObject, tagObject);
- // test model version
+ // test model version is not convertible to MetadataObject
NameIdentifier modelVersion =
NameIdentifier.of("metalake1", "catalog1", "schema1", "model1", "0");
- MetadataObject modelVersionObject =
- MetadataObjects.parse("catalog1.schema1.model1.0",
MetadataObject.Type.MODEL_VERSION);
- assertEquals(
- modelVersionObject,
- NameIdentifierUtil.toMetadataObject(modelVersion,
Entity.EntityType.MODEL_VERSION));
+ assertThrows(
+ IllegalArgumentException.class,
+ () -> NameIdentifierUtil.toMetadataObject(modelVersion,
Entity.EntityType.MODEL_VERSION));
}
@Test
diff --git a/docs/open-api/openapi.yaml b/docs/open-api/openapi.yaml
index 70a05abe55..37109e3f89 100644
--- a/docs/open-api/openapi.yaml
+++ b/docs/open-api/openapi.yaml
@@ -641,7 +641,6 @@ components:
- "FILESET"
- "TOPIC"
- "MODEL"
- - "MODEL_VERSION"
- "FUNCTION"
- "ROLE"
metadataObjectFullName:
diff --git a/docs/open-api/secrets.yaml b/docs/open-api/secrets.yaml
index 11d1e32cb0..7adbffecde 100644
--- a/docs/open-api/secrets.yaml
+++ b/docs/open-api/secrets.yaml
@@ -90,7 +90,7 @@ paths:
are not returned by this API. Clients must not treat a remaining
****** value
as a usable credential for those keys.
- Supported types: metalake, catalog, schema, fileset, table, topic,
view, model, model_version.
+ Supported types: metalake, catalog, schema, fileset, table, topic,
view, model.
responses:
"200":
description: Returns the secrets map for the specified metadata
object.
diff --git a/docs/security/access-control.md b/docs/security/access-control.md
index 24e05dd454..58b3d41974 100755
--- a/docs/security/access-control.md
+++ b/docs/security/access-control.md
@@ -202,8 +202,8 @@ sets the scope of the grant. Binding a privilege to a type
not listed for it is
| `REGISTER_MODEL` | Metalake, Catalog, Schema
| Register models in any schema in scope
|
| `LINK_MODEL_VERSION` | Metalake, Catalog, Schema, Model
| Link versions to any model in scope
|
| `USE_MODEL` | Metalake, Catalog, Schema, Model
| Read the metadata of, and download versions of, any
model in scope |
-| `USE_SECRETS` | Metalake, Catalog, Schema, Table, View,
Topic, Fileset, Model, ModelVersion | Call `getSecrets` (cloud access-key pairs
omitted unless also granted `INCLUDE_CREDENTIAL_SECRETS`) |
-| `INCLUDE_CREDENTIAL_SECRETS` | Metalake, Catalog, Schema, Table, View,
Topic, Fileset, Model, ModelVersion | With `USE_SECRETS`, include cloud
access-key pairs in the `getSecrets` result |
+| `USE_SECRETS` | Metalake, Catalog, Schema, Table, View,
Topic, Fileset, Model | Call `getSecrets` (cloud access-key pairs omitted
unless also granted `INCLUDE_CREDENTIAL_SECRETS`) |
+| `INCLUDE_CREDENTIAL_SECRETS` | Metalake, Catalog, Schema, Table, View,
Topic, Fileset, Model | With `USE_SECRETS`, include cloud access-key pairs in
the `getSecrets` result |
| `REGISTER_FUNCTION` | Metalake, Catalog, Schema
| Register functions in any schema in scope
|
| `EXECUTE_FUNCTION` | Metalake, Catalog, Schema, Function
| Read the metadata of, and execute, any function in
scope |
| `MODIFY_FUNCTION` | Metalake, Catalog, Schema, Function
| Alter or drop any function in scope
|
diff --git
a/server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConverter.java
b/server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConverter.java
index 6732b44fbb..556bf75b9f 100644
---
a/server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConverter.java
+++
b/server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConverter.java
@@ -185,7 +185,6 @@ public class AuthorizationExpressionConverter {
( entityType == 'JOB' && (%s)) ||
( entityType == 'JOB_TEMPLATE' && (%s)) ||
( entityType == 'COLUMN' && (%s)) ||
- ( entityType == 'MODEL_VERSION' && (%s)) ||
( entityType == 'FUNCTION' && (%s))
"""
.formatted(
@@ -203,7 +202,6 @@ public class AuthorizationExpressionConverter {
LOAD_JOB_AUTHORIZATION_EXPRESSION,
LOAD_JOB_TEMPLATE_AUTHORIZATION_EXPRESSION,
LOAD_TABLE_AUTHORIZATION_EXPRESSION,
- LOAD_MODEL_AUTHORIZATION_EXPRESSION,
LOAD_FUNCTION_AUTHORIZATION_EXPRESSION));
}
@@ -297,16 +295,15 @@ public class AuthorizationExpressionConverter {
expression =
expression.replaceAll(
"ANY_USE_SECRETS",
- "((ANY(USE_SECRETS, METALAKE, CATALOG, SCHEMA, TABLE, VIEW, TOPIC,
FILESET, MODEL,"
- + " MODEL_VERSION)) && !(ANY(DENY_USE_SECRETS, METALAKE,
CATALOG, SCHEMA, TABLE,"
- + " VIEW, TOPIC, FILESET, MODEL, MODEL_VERSION)))");
+ "((ANY(USE_SECRETS, METALAKE, CATALOG, SCHEMA, TABLE, VIEW, TOPIC,
FILESET, MODEL))"
+ + " && !(ANY(DENY_USE_SECRETS, METALAKE, CATALOG, SCHEMA,
TABLE, VIEW, TOPIC,"
+ + " FILESET, MODEL)))");
expression =
expression.replaceAll(
"ANY_INCLUDE_CREDENTIAL_SECRETS",
"((ANY(INCLUDE_CREDENTIAL_SECRETS, METALAKE, CATALOG, SCHEMA,
TABLE, VIEW, TOPIC,"
- + " FILESET, MODEL, MODEL_VERSION)) &&
!(ANY(DENY_INCLUDE_CREDENTIAL_SECRETS,"
- + " METALAKE, CATALOG, SCHEMA, TABLE, VIEW, TOPIC, FILESET,
MODEL,"
- + " MODEL_VERSION)))");
+ + " FILESET, MODEL)) && !(ANY(DENY_INCLUDE_CREDENTIAL_SECRETS,
METALAKE, CATALOG,"
+ + " SCHEMA, TABLE, VIEW, TOPIC, FILESET, MODEL)))");
expression =
expression.replaceAll(
"ANY_LINK_MODEL_VERSION",
diff --git
a/server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizationCacheKeys.java
b/server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizationCacheKeys.java
index 875756e73a..c6d0228186 100644
---
a/server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizationCacheKeys.java
+++
b/server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizationCacheKeys.java
@@ -58,13 +58,6 @@ final class JcasbinAuthorizationCacheKeys {
parts.add(MetadataObject.Type.COLUMN.name());
parts.add(names[names.length - 1]);
break;
- case MODEL_VERSION:
- appendCatalogAndSchemas(parts, names, names.length - 2);
- parts.add(MetadataObject.Type.MODEL.name());
- parts.add(names[names.length - 2]);
- parts.add(MetadataObject.Type.MODEL_VERSION.name());
- parts.add(names[names.length - 1]);
- break;
case VIEW:
case TOPIC:
case FILESET:
diff --git
a/server-common/src/test/java/org/apache/gravitino/server/authorization/expression/TestAuthorizationExpressionConverter.java
b/server-common/src/test/java/org/apache/gravitino/server/authorization/expression/TestAuthorizationExpressionConverter.java
index c14fb8e421..410ceb1b3b 100644
---
a/server-common/src/test/java/org/apache/gravitino/server/authorization/expression/TestAuthorizationExpressionConverter.java
+++
b/server-common/src/test/java/org/apache/gravitino/server/authorization/expression/TestAuthorizationExpressionConverter.java
@@ -134,9 +134,9 @@ public class TestAuthorizationExpressionConverter {
public void testReplaceAnyPrivilegeForAnyUseSecretss() {
String replaced =
AuthorizationExpressionConverter.replaceAnyPrivilege("ANY_USE_SECRETS");
Assertions.assertEquals(
- "((ANY(USE_SECRETS, METALAKE, CATALOG, SCHEMA, TABLE, VIEW, TOPIC,
FILESET, MODEL,"
- + " MODEL_VERSION)) && !(ANY(DENY_USE_SECRETS, METALAKE, CATALOG,
SCHEMA, TABLE,"
- + " VIEW, TOPIC, FILESET, MODEL, MODEL_VERSION)))",
+ "((ANY(USE_SECRETS, METALAKE, CATALOG, SCHEMA, TABLE, VIEW, TOPIC,
FILESET, MODEL))"
+ + " && !(ANY(DENY_USE_SECRETS, METALAKE, CATALOG, SCHEMA, TABLE,
VIEW, TOPIC,"
+ + " FILESET, MODEL)))",
replaced);
}
@@ -146,9 +146,8 @@ public class TestAuthorizationExpressionConverter {
AuthorizationExpressionConverter.replaceAnyPrivilege("ANY_INCLUDE_CREDENTIAL_SECRETS");
Assertions.assertEquals(
"((ANY(INCLUDE_CREDENTIAL_SECRETS, METALAKE, CATALOG, SCHEMA, TABLE,
VIEW, TOPIC,"
- + " FILESET, MODEL, MODEL_VERSION)) &&
!(ANY(DENY_INCLUDE_CREDENTIAL_SECRETS,"
- + " METALAKE, CATALOG, SCHEMA, TABLE, VIEW, TOPIC, FILESET, MODEL,"
- + " MODEL_VERSION)))",
+ + " FILESET, MODEL)) && !(ANY(DENY_INCLUDE_CREDENTIAL_SECRETS,
METALAKE, CATALOG,"
+ + " SCHEMA, TABLE, VIEW, TOPIC, FILESET, MODEL)))",
replaced);
}
diff --git
a/server-common/src/test/java/org/apache/gravitino/server/authorization/jcasbin/TestJcasbinAuthorizationCacheKeys.java
b/server-common/src/test/java/org/apache/gravitino/server/authorization/jcasbin/TestJcasbinAuthorizationCacheKeys.java
index 794f9b691e..1bc0afc38d 100644
---
a/server-common/src/test/java/org/apache/gravitino/server/authorization/jcasbin/TestJcasbinAuthorizationCacheKeys.java
+++
b/server-common/src/test/java/org/apache/gravitino/server/authorization/jcasbin/TestJcasbinAuthorizationCacheKeys.java
@@ -60,14 +60,6 @@ public class TestJcasbinAuthorizationCacheKeys {
key("ml1", "CATALOG", "cat1", "SCHEMA", "sch1", "TABLE", "tbl1",
"COLUMN", "col1"),
columnKey);
- MetadataObject modelVersion =
- MetadataObjects.of(
- Arrays.asList("cat1", "sch1", "model1", "0"),
MetadataObject.Type.MODEL_VERSION);
- String modelVersionKey =
JcasbinAuthorizationCacheKeys.metadataIdCacheKey("ml1", modelVersion);
- Assertions.assertEquals(
- key("ml1", "CATALOG", "cat1", "SCHEMA", "sch1", "MODEL", "model1",
"MODEL_VERSION", "0"),
- modelVersionKey);
-
MetadataObject view =
MetadataObjects.of(Arrays.asList("cat1", "sch1", "tbl1"),
MetadataObject.Type.VIEW);
String viewKey = JcasbinAuthorizationCacheKeys.metadataIdCacheKey("ml1",
view);
diff --git
a/server/src/main/java/org/apache/gravitino/server/web/rest/MetadataObjectSecretOperations.java
b/server/src/main/java/org/apache/gravitino/server/web/rest/MetadataObjectSecretOperations.java
index 58c778623c..c294123a8d 100644
---
a/server/src/main/java/org/apache/gravitino/server/web/rest/MetadataObjectSecretOperations.java
+++
b/server/src/main/java/org/apache/gravitino/server/web/rest/MetadataObjectSecretOperations.java
@@ -68,8 +68,7 @@ public class MetadataObjectSecretOperations {
MetadataObject.Type.TABLE,
MetadataObject.Type.TOPIC,
MetadataObject.Type.VIEW,
- MetadataObject.Type.MODEL,
- MetadataObject.Type.MODEL_VERSION);
+ MetadataObject.Type.MODEL);
private final SecretPropertyOperationDispatcher
secretPropertyOperationDispatcher;
diff --git
a/server/src/test/java/org/apache/gravitino/server/web/rest/TestMetadataObjectSecretOperations.java
b/server/src/test/java/org/apache/gravitino/server/web/rest/TestMetadataObjectSecretOperations.java
index 2efe6e0d3b..abfbece364 100644
---
a/server/src/test/java/org/apache/gravitino/server/web/rest/TestMetadataObjectSecretOperations.java
+++
b/server/src/test/java/org/apache/gravitino/server/web/rest/TestMetadataObjectSecretOperations.java
@@ -129,12 +129,6 @@ public class TestMetadataObjectSecretOperations extends
JerseyTest {
MetadataObjects.parse("catalog.schema.model",
MetadataObject.Type.MODEL));
}
- @Test
- public void testGetSecretsForModelVersion() {
- testGetSecretsForObject(
- MetadataObjects.parse("catalog.schema.model.0",
MetadataObject.Type.MODEL_VERSION));
- }
-
@Test
public void testGetSecretsReturnsEmptyWithoutUseSecretss() throws Exception {
MetadataObject metadataObject =
