bharos opened a new pull request, #13957:
URL: https://github.com/apache/gravitino/pull/13957
### What changes were proposed in this pull request?
Adds the `policy_role_relation_meta` table and keeps it in step with policy
content.
1. Add the table and upgrade scripts for H2, MySQL, and PostgreSQL.
2. Write one row per role named in an `ACCESS_CONTROL` policy's
`applicableRoles`, on create, update, and overwrite, in the same transaction as
the policy row.
3. Write only the difference, so a policy edit that leaves the roles alone
writes no rows.
4. Clean the rows up when the policy, the metalake, or the legacy record is
deleted.
The record is derived. No endpoint writes it, and `content` stays
authoritative. Unlike `policy_tag_relation_meta`, no type is exposed on
`SupportsRelationOperations`, since that would make the record user-writable
and give the evaluator two answers to choose between.
Role deletion, the only production caller of the role-anchored query, is
excluded and lands with M6.
### Why are the changes needed?
Role names live inside `content`, a JSON column. Answering "which policies
reference `analyst`" by scanning and parsing every policy in a metalake does
not scale, and role deletion needs that answer.
Fix: #13906
Part of #12758.
### Does this PR introduce _any_ user-facing change?
No. The table is internal, and there are no REST or client API changes.
### How was this patch tested?
- `./gradlew :core:spotlessApply`
- `./gradlew :core:coreH2Test :core:coreMySQLTest :core:corePostgreSQLTest
--tests
"org.apache.gravitino.storage.relational.service.TestPolicyRoleRelService"
-PskipDockerTests=false`
- Covers H2, MySQL, and PostgreSQL.
- Covers create, update, overwrite, rollback of a failed write, duplicate
role names, content that names no roles, policy and metalake cascades, and
legacy cleanup.
- The policy, policy-tag relation, metalake, and SQL script suites on all
three backends, plus the full `:core:coreMySQLTest` lane.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
