yuqi1129 opened a new pull request, #13747:
URL: https://github.com/apache/gravitino/pull/13747
### What changes were proposed in this pull request?
Store held and active role IDs in immutable request-local sets and evaluate
them through a request-aware jCasbin matcher. Remove shared user/group role
bindings. Evaluate role unions once while preserving global DENY and policy
reload locking/version checks.
### Why are the changes needed?
Interleaved requests for the same stored user with different IdP groups can
inherit another request's ALLOW or lose their own DENY, including list
filtering.
Request-local membership prevents this and removes repeated per-role scans.
Related to #13593. This is the isolation step, not removal of jCasbin or a
complete resolution of #13593/#13691.
### Does this PR introduce _any_ user-facing change?
Authorization uses only the current request's group membership. Active-role
and
global-DENY semantics remain unchanged. No REST API or configuration changes.
### How was this patch tested?
- Core: 2695 tests, no failures, 2 ignored. Server authorization: 200 tests,
no failures. New interleaving cases fail on unchanged main and pass here.
- Javadoc and spotless checks passed. Full server-common: 434 tests, one TLS
exception-shape failure outside changed authorization code; not fully
green.
- Three JVM forks per variant using real jCasbin, cached authorizer and list
filtering. Representative denied-request median: 167.5 -> 71.0 us;
1000-table
list (8 held roles): 363.8 -> 172.5 ms. These exclude HTTP/DB/cold loading.
- Equal-rate 1000/s arrival-to-completion p99: 5.92 -> 3.29 ms. At 500/s the
difference is inconclusive. Under unpaced 32-thread saturation with a 512
MiB
heap, throughput improves 5.2x but sampled p99 rises 37.8 -> 46.7 ms
(+23.4%).
This is not a claim of zero regression across all load/latency metrics.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
