nevzheng opened a new issue, #14248:
URL: https://github.com/apache/gravitino/issues/14248
### Version
main branch
### Describe what's wrong
`JcasbinAuthorizationCacheKeys` builds the name-to-id cache key by splitting
the full name on `.` only.
A hierarchical schema name such as `A:B` becomes one key part:
```
evict prefix for schema A: ml1|CATALOG|cat1|SCHEMA|A|
SCHEMA cat1.A:B key=ml1|CATALOG|cat1|SCHEMA|A:B| not evicted
SCHEMA cat1.A:B:C key=ml1|CATALOG|cat1|SCHEMA|A:B:C| not evicted
TABLE cat1.A:B.t key=ml1|CATALOG|cat1|SCHEMA|A:B|TABLE|t| not evicted
TABLE cat1.A.t key=ml1|CATALOG|cat1|SCHEMA|A|TABLE|t| evicted
```
Both eviction paths use that prefix:
`JcasbinAuthorizer.handleEntityNameIdMappingChange` (local) and
`JcasbinChangeListener.onEntityChange` (change log from other nodes). A
cascade drop of `A` writes one
change-log row, for `A` only. So after dropping `A`, entries for `A:B`,
`A:B:C` and the tables and views
under them stay cached. If those names are recreated, the authorizer
resolves them to the old ids until
the cache entry expires (default TTL 3600 s), and new grants, denies and
owners on the recreated objects
are not seen.
The code comment in `handleEntityNameIdMappingChange` says prefix
invalidation removes "all nested
objects under the same name path", which does not hold for hierarchical
schemas. The entity cache
(`CaffeineEntityCache#invalidateHierarchy`) already handles this case.
### Error message and/or stacktrace
None.
### How to reproduce
1. Enable authorization (JCasbin) and create schema `A:B` with table `t` in
catalog `c`.
2. As a user with `SELECT_TABLE` on `c`, load `c.A:B.t` (fills the cache).
3. Drop schema `A` with cascade, recreate `A:B` and `A:B.t`, and add a DENY
`SELECT_TABLE` on `A:B`
to the user's role.
4. Load `c.A:B.t` again as the user (on another node, after one poll
interval, for the change-log path).
Expected: denied.
Actual: allowed until the stale `A:B` entry expires.
### Additional context
Proposed fix: for a schema, also invalidate the prefix ending with the
hierarchical schema separator
(`...|SCHEMA|A:`), in both eviction paths. Siblings such as `AB` must stay
cached.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
