LuciferYang opened a new pull request, #13683: URL: https://github.com/apache/gravitino/pull/13683
### What changes were proposed in this pull request? Add VIEW and FUNCTION to `MetadataIdConverter.METADATA_SCOPE_MAPPING`, so the jcasbin authorizer applies the catalog's case rules to view and function identifiers when it resolves their ids, as it already does for tables. On Hive this lowercases the schema segment and leaves the view or function name unchanged, which is what `ViewNormalizeDispatcher` and `FunctionNormalizeDispatcher` do on the data path. ### Why are the changes needed? Without a mapping entry the id lookup used the schema name as the request spelled it. On Hive, where schema names are stored in lower case, a request for `catalog.SALES.f1` found no entity, so the caller's ownership or object-level privilege on the function or view was ignored and the request got 403, while the same request with authorization off, or for a table in the same schema, succeeded. Fix: #13682 ### Does this PR introduce _any_ user-facing change? No API or configuration change. With authorization enabled, a view or function request whose schema is spelled in a different case than it is stored is now authorized the same way as a request using the stored spelling. ### How was this patch tested? `testViewAndFunctionLookupNormalizesSchemaCase` uses a capability shaped like Hive's (schema, table and column names case-insensitive) and checks that `catalog.SCHEMA.Sales_View` and `catalog.SCHEMA.Sales_Fun` resolve to the entities stored under schema `schema` with their names unchanged. `testCatalogScopedTypesAreAllCaseNormalized` walks `MetadataObject.Type` and fails for any catalog-scoped type that has no capability scope. Both fail against the code before this change. The issue's reproduction was also run against a Hive container: the owner's `getFunction` with an upper-case schema returned 403 before the change and succeeds after it. That test is not included. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
