yuqi1129 opened a new issue, #13691: URL: https://github.com/apache/gravitino/issues/13691
### Version main branch ### Describe what's wrong `JcasbinAuthorizer.hasDenyPolicy` scans the installed deny policies to decide whether list authorization can use the parent-scope short-circuit. A partially loaded role can omit a DENY row when its securable object cannot be resolved. The scan can then return `false` even though the role's policies are incomplete, allowing list authorization to skip per-object checks. For this existence query, missing rows cannot prove the absence of a DENY. Incomplete role policies should conservatively disable the list short-circuit. Preserve the existing per-object behavior for privileges whose objects resolve successfully. ### Error message and/or stacktrace No exception is required. An incomplete resolution can install partial policies and make `hasDenyPolicy` return `false`. ### How to reproduce 1. Give a user an applicable parent-scope ALLOW and a role with a DENY relevant to the listed objects. 2. Cause resolution of the DENY's securable object to return empty during role loading, for example through a transient metadata-resolution miss. 3. Let the role load partially, omitting the DENY row from the deny enforcer. 4. Call `hasDenyPolicy` for the denied privilege. With no other matching installed DENY, it returns `false`; list authorization can take the parent-scope short-circuit and skip per-object checks. This sequence is derived from code review; add a deterministic regression test in the follow-up PR. ### Additional context Raised in https://github.com/apache/gravitino/pull/13606#discussion_r4215594650. This is a pre-existing issue, separate from #13606's handling of unreadable role entities and #13612's per-role single-flight work. Track policy completeness reliably for bound roles and make `hasDenyPolicy` return `true` when relevant deny policies may be missing. Checking only `partialRoleLoadBackoff` is insufficient because that marker expires independently of the partial policies. Cover initial partial loads, partial reloads, backoff expiry, concurrent complete/partial replacements, and recovery after a complete load. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
