bharos opened a new issue, #13911: URL: https://github.com/apache/gravitino/issues/13911
### Describe the subtask Implement the composition component of M3 in the tag-based access control design doc (#12757) and put the feature behind its flag. What lands: - The authorization adapter combining the match with the existing RBAC allow, deny and traversal checks, recording decision provenance. Deny wins, per OQ-2. - The tag check at the privilege leaf, with per-request caching, per OQ-1. - The server-level configuration from "Enabling the feature", defaulting to off. It lands here, or there is no way to back the feature out. - List filtering consulting tags, at unbatched cost until M5. - A diagnostic naming the tag and policy whose allow an RBAC deny suppressed. - A test asserting no tag-conferrable privilege appears in bare `TYPE::PRIVILEGE` form. - Integration tests covering RBAC allow, RBAC miss, explicit deny with a matching tag, missing traversal privileges, and the feature disabled. A skipped tag path must perform no tag-resolution reads. Blocked on M3.1 and M3.2. The flag must not be turned on before M2.1 and M2.2, or every path that confers access does so unchecked. ### Parent issue #12758 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
