laserninja opened a new pull request, #13793: URL: https://github.com/apache/gravitino/pull/13793
### What changes were proposed in this pull request? Add `SEMANTIC_MODEL` metadata parsing, schema parent mapping, and securable-object construction to the Python SDK. Add `CREATE_SEMANTIC_MODEL`, `USE_SEMANTIC_MODEL`, and `MODIFY_SEMANTIC_MODEL` with Java-compatible bit values and binding rules, including `MANAGE_GRANTS` on Semantic Models. The existing DTO converters and grant/revoke paths now round-trip Semantic Model types and privileges. Align SDK privilege hashing with equal response DTOs so round-tripped privileges deduplicate correctly. Add unit coverage and live-server integration tests for public SDK grant/revoke, role creation/retrieval and bindings, list filtering, create/load/alter access, parent access prerequisites, revocation, and explicit deny precedence. Assert that modify permission does not authorize drop. ### Why are the changes needed? The Python SDK rejects Semantic Model types and privileges before it can call the existing server authorization APIs. Part of #12209. Based directly on upstream/main at `b837e07a9`. #12860 is already merged, including its REST-envelope changes. There is no dependency on the closed, unmerged #13768 or on the separate tag/owner and Ossie work. ### Does this PR introduce _any_ user-facing change? Yes. Python callers can construct `MetadataObject.Type.SEMANTIC_MODEL`, use `SecurableObjects.of_semantic_model`, and parse/grant/revoke the three Semantic Model privileges. Server authorization behavior is unchanged. Production changes are confined to four Python SDK files. ### How was this patch tested? - Before the fix, all four new integration tests reached the live server fixture and failed because the SDK rejected `CREATE_SEMANTIC_MODEL`, `USE_SEMANTIC_MODEL`, or `MODIFY_SEMANTIC_MODEL`. - Python 3.11 unit suite: **1,218 passed** (`python -m unittest discover -s clients/client-python/tests/unittests`, with `PYTHONPATH=clients/client-python`). - Current-main Java server with authorization enabled and a local Iceberg memory catalog: **11 passed**, comprising all four new Semantic Model tests and seven existing role-management tests (`python -m unittest tests.integration.test_semantic_model_authorization tests.integration.test_role_management`, with `GRAVITINO_HOME` set to the test server, `START_EXTERNAL_GRAVITINO=true`, and `PYTHONPATH=clients/client-python`). - Changed-file Pylint: **10.00/10**. Black check and `git diff --check`: passed. - `./gradlew spotlessApply -PskipWeb`: passed. Server and Iceberg catalog built from current main using Java 17. All newly added integration tests ran. The full repository test suite, Docker/cloud integration suites, and Python 3.10/3.12 matrix were not run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
