nevzheng opened a new pull request, #14251:
URL: https://github.com/apache/gravitino/pull/14251
### What changes were proposed in this pull request?
- **New `RegisterTableAuthzHandler`** in
`IcebergMetadataAuthorizationMethodInterceptor`, modelled on the
Lance `OverwriteAuthzHandler`. When the request has `overwrite=true`, it
also evaluates
`MODIFY_TABLE_AUTHORIZATION_EXPRESSION` on the named table and throws
`ForbiddenException` on failure.
- The schema-level `CREATE_TABLE` check still runs, because an overwrite of
a missing name is a plain
register.
- Wiring: a `REGISTER_TABLE` value in `IcebergAuthorizationMetadata`, a case
in the interceptor, and an
annotation on the `RegisterTableRequest` parameter.
### Why are the changes needed?
**Register with overwrite replaces an existing table, but was checked like a
create.** A user with only
`CREATE_TABLE` on a schema could replace the metadata of any table in it,
while the table's owner and
grants stayed unchanged.
Fix: #14242
### Does this PR introduce _any_ user-facing change?
Yes. Register with `overwrite=true` now returns 403 unless the caller owns
the target table or has
`MODIFY_TABLE` on it. Register without overwrite is unchanged.
### How was this patch tested?
`TestIcebergRegisterOverwriteAuthorization` (5 cases, real interceptor and
endpoint annotations, a
privilege-set authorizer):
- **On `main`:** `testRegisterOverwriteDeniedWithCreateTableOnly` fails, and
the 4 guard cases pass.
- **With the fix:** all 5 pass.
`TestIcebergMetadataAuthorizationMethodInterceptor` also passes.
`./gradlew -PskipITs :iceberg:iceberg-rest-server:test --tests
'*TestIcebergRegisterOverwriteAuthorization' --tests
'*TestIcebergMetadataAuthorizationMethodInterceptor'`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
