bhanu8988 opened a new pull request, #14135:
URL: https://github.com/apache/gravitino/pull/14135
### What changes were proposed in this pull request?
Allow restricted Rego (`restricted-rego-v1`) column-mask rules to return
`null` as a valid branch result (in conditional branches, fallback `else`, or
unconditional `mask := null`). Returning `null` signifies that the policy
contributes no mask for the current request.
- Updated `RestrictedRegoProgram`:
- `MaskBranch`: allowed `@Nullable MaskAction action`, updated constructor
and getter `@Nullable public MaskAction action()`, and removed non-null
assertion on action in `validate()`.
- `ColumnMask`: allowed `@Nullable MaskAction fallback`, updated
constructor and getter `@Nullable public MaskAction fallback()`, and removed
non-null assertion on fallback in `validate()`.
- Updated `RestrictedRegoSourceParser`:
- Added `parseMaskResult()` allowing `null` (mapped to Java `null`) or
mask actions.
- Updated error messages when expecting action or null.
- Updated documentation in `docs/policies.md` with grammar update and an
example of a column-mask rule returning `null`.
- Updated test suites with comprehensive regression tests:
- Added test cases in `restricted-rego-v1-cases.txt` and regenerated
`restricted-rego-v1-cases.golden`.
- Added parser tests in `TestRestrictedRegoSourceParser`.
- Added AST validation and equality tests in `TestRestrictedRegoProgram`.
- Added expression parser facade tests in
`TestRestrictedRegoExpressionParserFacade`.
- Added policy management test in `TestPolicyManager`.
### Why are the changes needed?
Restricted Rego column-mask policies need to express that under certain
conditions (or by default), no masking should be applied to a column. Returning
`null` allows the policy to contribute no mask for the current request, while
strictly distinguishing from `action("replace-with-null")` which replaces
column values with SQL NULL.
Closes #14059
### Does this PR introduce _any_ user-facing change?
Yes, users can now author `restricted-rego-v1` column-mask rules that return
`null` when no masking is desired.
### How was this patch tested?
- Ran `./gradlew :core:spotlessCheck` (BUILD SUCCESSFUL).
- Ran `./gradlew :core:coreUnitTest --tests
"org.apache.gravitino.policy.rego.*"` (BUILD SUCCESSFUL, 124 tests completed, 0
failed).
- Ran `./gradlew :core:coreUnitTest --tests
"org.apache.gravitino.policy.TestPolicyManager.testCreateColumnMaskPolicyWithNullBranch"`
(BUILD SUCCESSFUL).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
