roryqi opened a new issue, #14059:
URL: https://github.com/apache/gravitino/issues/14059
### Describe the feature
Allow a restricted Rego column-mask rule to return `null`, meaning that this
rule applies no mask for the current user:
```rego
mask := action("show-last-4") if session_user() == "A"
else := null
```
Currently, every branch must return `action(...)`, so the parser rejects
this expression. `action("replace-with-null")` replaces the column value with
null; it does not leave the value visible.
### Motivation
Some policies need to mask a column for one user while leaving it visible to
others. The current restricted Rego syntax cannot express that case. The
[Iceberg REST
specification](https://github.com/apache/iceberg/blob/main/open-api/rest-catalog-open-api.yaml)
permits a column to be omitted from `column-masks` when no mask applies; it
also requires servers to omit actions that are inapplicable to the column type.
This proposal adds the corresponding policy result to Gravitino's Rego profile.
### Describe the solution
- Accept `null` as a column-mask branch result.
- Treat it as "this policy contributes no mask" for the request; other
applicable mask policies still apply.
- Omit the column from Iceberg `column-masks` only when no applicable policy
selects a mask.
- Update documentation and tests for parsing, evaluation, policy conflicts,
and REST responses.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
