roryqi opened a new issue, #13719:
URL: https://github.com/apache/gravitino/issues/13719
### Describe the subtask
Implement the expression-parser slice of the tag-based Iceberg
read-restriction design in #13546.
The scope includes:
- Add an ANTLR grammar for complete `filter :=` and `mask :=` rules in the
restricted Rego subset.
- Build typed unresolved row-filter and column-mask programs.
- Support ordered conditional branches with required final `else` fallbacks.
- Lower conditional row filters deterministically with first-match semantics.
- Validate operator and operand shapes, Boolean filter results, and
context-only mask conditions.
- Support only the allowlisted Iceberg mask actions through explicit
`action("name")` values.
- Enforce keyword boundaries, JSON string escaping, Unicode validity, exact
numeric literals, negative zero, and resource limits.
- Validate typed row-filter and column-mask policy content when it is
created or updated.
- Add unit tests for valid programs, invalid syntax, conditional rules,
limits, and policy-content integration.
Subject and schema binding, resolved-expression canonicalization, policy
selection, and Iceberg REST response enforcement are outside this subtask.
### Parent issue
https://github.com/apache/gravitino/issues/13545
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
