This is an automated email from the ASF dual-hosted git repository.
roryqi pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/main by this push:
new 9c9ad50e72 [#13510][followup] fix(api): permit USE_SEMANTIC_MODEL in
AccessControlContent (#13905)
9c9ad50e72 is described below
commit 9c9ad50e727dbde6a70e99b645e79a1d636ab6ba
Author: Bharath Krishna <[email protected]>
AuthorDate: Sat Oct 17 20:31:35 2026 -0700
[#13510][followup] fix(api): permit USE_SEMANTIC_MODEL in
AccessControlContent (#13905)
### What changes were proposed in this pull request?
Adds `USE_SEMANTIC_MODEL` to `AccessControlContent.PERMITTED_PRIVILEGES`
and `SEMANTIC_MODEL` to its supported object types, and mirrors the
privilege in the `AccessControlContent` enum in
`docs/open-api/policies.yaml`.
### Why are the changes needed?
The allowlist was written before the semantic model privileges existed
(#12867) and before semantic models became taggable (#12870), so the
omission is a rebase gap rather than a deliberate exclusion.
`USE_SEMANTIC_MODEL` is "discover a semantic model and load its
definition". That is strictly narrower than the already permitted
`USE_MODEL`, and it acts only on the tagged object. Reading data through
a referenced table still requires `SELECT_TABLE`, the same indirection
the permitted `SELECT_VIEW` already has. `CREATE_SEMANTIC_MODEL` and
`MODIFY_SEMANTIC_MODEL` stay excluded, since one creates an entity and
the other changes what other principals execute.
The allowlist fails closed, so nothing is broken today. A tag simply
cannot confer the privilege.
Adding `SEMANTIC_MODEL` also makes the comment above
`SUPPORTED_OBJECT_TYPES` accurate again: the set is now exactly the
types a tag can be applied to, minus `COLUMN`.
Part of #13510
### Does this PR introduce _any_ user-facing change?
Yes. `USE_SEMANTIC_MODEL` is now accepted in the `privileges` list of an
access control policy, and `SEMANTIC_MODEL` is reported by
`supportedObjectTypes()`. The OpenAPI schema enum is updated to match.
No property keys are added or removed.
### How was this patch tested?
`TestPolicyContents.testAccessControlContentSupportedObjectTypes` is
updated for the new object type. The existing
`testAccessControlContentAcceptsEveryPermittedPrivilege`,
`testAccessControlContentRejectsPrivilegesOutsideAllowlist` and
`testAccessControlContentSupportedObjectTypesTrackPermittedPrivileges`
iterate the enums or recompute the union through `canBindTo`, so they
cover the addition without needing a change.
```
./gradlew :api:spotlessJavaCheck :api:javadoc :api:test
```
---
.../main/java/org/apache/gravitino/policy/AccessControlContent.java | 6 ++++--
.../test/java/org/apache/gravitino/policy/TestPolicyContents.java | 3 ++-
docs/open-api/policies.yaml | 1 +
3 files changed, 7 insertions(+), 3 deletions(-)
diff --git
a/api/src/main/java/org/apache/gravitino/policy/AccessControlContent.java
b/api/src/main/java/org/apache/gravitino/policy/AccessControlContent.java
index 8ee5f75762..3dd05cb2fa 100644
--- a/api/src/main/java/org/apache/gravitino/policy/AccessControlContent.java
+++ b/api/src/main/java/org/apache/gravitino/policy/AccessControlContent.java
@@ -71,7 +71,8 @@ public final class AccessControlContent implements
PolicyContent {
Privilege.Name.CONSUME_TOPIC,
Privilege.Name.PRODUCE_TOPIC,
Privilege.Name.USE_MODEL,
- Privilege.Name.EXECUTE_FUNCTION);
+ Privilege.Name.EXECUTE_FUNCTION,
+ Privilege.Name.USE_SEMANTIC_MODEL);
// The object types a tag can be applied to, minus COLUMN, which no
permitted privilege can be
// scoped to. METALAKE is absent because a tag cannot be applied to a
metalake.
@@ -84,7 +85,8 @@ public final class AccessControlContent implements
PolicyContent {
MetadataObject.Type.FILESET,
MetadataObject.Type.TOPIC,
MetadataObject.Type.MODEL,
- MetadataObject.Type.FUNCTION);
+ MetadataObject.Type.FUNCTION,
+ MetadataObject.Type.SEMANTIC_MODEL);
private final List<Privilege.Name> privileges;
private final List<String> applicableRoles;
diff --git
a/api/src/test/java/org/apache/gravitino/policy/TestPolicyContents.java
b/api/src/test/java/org/apache/gravitino/policy/TestPolicyContents.java
index 2e13103d2a..ca456c2c05 100644
--- a/api/src/test/java/org/apache/gravitino/policy/TestPolicyContents.java
+++ b/api/src/test/java/org/apache/gravitino/policy/TestPolicyContents.java
@@ -212,7 +212,8 @@ public class TestPolicyContents {
MetadataObject.Type.FILESET,
MetadataObject.Type.TOPIC,
MetadataObject.Type.MODEL,
- MetadataObject.Type.FUNCTION),
+ MetadataObject.Type.FUNCTION,
+ MetadataObject.Type.SEMANTIC_MODEL),
PolicyContents.accessControl(
Collections.singletonList(Privilege.Name.SELECT_TABLE),
Collections.singletonList("analyst"))
diff --git a/docs/open-api/policies.yaml b/docs/open-api/policies.yaml
index c576a2ba7b..ad0cbdc5b4 100644
--- a/docs/open-api/policies.yaml
+++ b/docs/open-api/policies.yaml
@@ -567,6 +567,7 @@ components:
- PRODUCE_TOPIC
- USE_MODEL
- EXECUTE_FUNCTION
+ - USE_SEMANTIC_MODEL
applicableRoles:
type: array
minItems: 1
