laserninja opened a new issue, #13839: URL: https://github.com/apache/gravitino/issues/13839
### Version main and branch-1.3 ### Describe what's wrong A user with access to a metadata object but no permission to read its associated tag can retrieve that tag. `CAN_ACCESS_METADATA` expands to an ungrouped OR expression, so later metadata-type branches bypass the preceding tag-permission condition. The ungrouped expansion and affected tag-read route are present on both main and branch-1.3. The live failure was reproduced on main; branch-1.3 was checked by source inspection. ### Error message and/or stacktrace PythonIT on #13794 fails in `test_tag_authorization` with: ```text AssertionError: ForbiddenException not raised ``` [Failing CI run](https://github.com/apache/gravitino/actions/runs/38433441339/job/115633562270) ### How to reproduce 1. Enable authorization and associate a tag with a table as an administrator. 2. Give another user the catalog/schema usage privileges and table read access, but no tag privileges or ownership. 3. As that user, retrieve the associated tag through the metadata-object tag REST API. 4. Expected: access is forbidden. Actual: the tag is returned. The same issue is exercised for Semantic Models by #13794 on main. Semantic Models are not required to reproduce the underlying bug on branch-1.3. ### Additional context Track this as a sub-issue of #12209, linked to #13794. #13794 includes the server fix and regression tests at the maintainer's request: group the complete `CAN_ACCESS_METADATA` expansion in outer parentheses. Keep the Python denied-read assertion intact. After #13794 merges, backport the server fix and applicable regression coverage to branch-1.3, adapting to that branch's supported metadata types and privileges. Track the branch-1.3 backport here; do not close this issue solely when the main fix merges. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
