roryqi opened a new pull request, #13693:
URL: https://github.com/apache/gravitino/pull/13693
### What changes were proposed in this pull request?
Add the first policy-model implementation slice for tag-based Iceberg read
restrictions:
- Add the built-in `system_row_filter` and `system_column_mask` policy types.
- Define distinct typed content for row filters and column masks.
- Store exactly one restricted Rego `expression` in each policy, aligned
with #13546.
- Share non-blank and 16 KiB UTF-8 source validation.
- Support create, update, REST serialization, DTO conversion, and
persisted-content round trips.
- Reject legacy `rules` content and content that does not match its built-in
policy type.
Expression parsing, subject and schema binding, policy resolution, and
Iceberg REST enforcement remain follow-up work.
### Why are the changes needed?
The tag-based read-restriction design needs typed policy content before
expressions can be parsed, resolved, and returned through Iceberg REST.
Fix: #13692
### Does this PR introduce _any_ user-facing change?
Yes. It adds the `system_row_filter` and `system_column_mask` built-in
policy types and their Java and REST content shape:
```json
{
"expression": "..."
}
```
### How was this patch tested?
- `./gradlew :api:spotlessApply :common:spotlessApply :core:spotlessApply`
- `./gradlew :api:javadoc :api:test --tests
org.apache.gravitino.policy.TestReadRestrictionContent --tests
org.apache.gravitino.policy.TestPolicyBuiltInType`
- `./gradlew :common:test --tests
org.apache.gravitino.dto.policy.TestReadRestrictionPolicyDTO`
- `./gradlew :core:test --tests org.apache.gravitino.meta.TestPolicyEntity`
- `git diff upstream/main...HEAD --check`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
