LuciferYang opened a new issue, #13832: URL: https://github.com/apache/gravitino/issues/13832
### What would you like to be improved? `MetadataAuthzHelper.LIST_SHORT_CIRCUITS` lets a list request skip per-object authorization when the caller can see every object through a parent scope (an owner of the metalake, catalog or schema, or a holder of the listing privilege on one of them, with no deny that could apply). It has entries for tables, models, schemas, catalogs, job templates and principals, but none for views, functions, filesets, topics or semantic models, so listing those always filters object by object. For a caller who holds only a parent-scope privilege, each listed object then costs an owner lookup (metadata id and owner, a store read on cache miss) and a deny check; listing filesets or topics also batch-loads every listed entity first. With 1,000 functions or 1,000 filesets in one schema and a user holding only schema-level `EXECUTE_FUNCTION` / `READ_FILESET`, a warm list takes about 170-220 ms; with a short-circuit entry it takes about 20 ms. ### How should we improve? Register parent-scope short-circuit entries for `VIEW`, `FUNCTION`, `FILESET`, `TOPIC` and `SEMANTIC_MODEL`, derived from their filter expressions the same way the existing entries are: an owner path plus one path per listing privilege, each tracking its own deny privilege so a possible deny still falls back to per-object checks. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
