nevzheng opened a new pull request, #14246:
URL: https://github.com/apache/gravitino/pull/14246
### What changes were proposed in this pull request?
- **New `UpdateTableAuthzHandler`** in
`IcebergMetadataAuthorizationMethodInterceptor`. A commit that
carries `AssertTableDoesNotExist` (the same check the hook dispatcher
uses) is authorized with the
create-table expression on the schema, and failure throws
`ForbiddenException`. Every other commit
keeps the `MODIFY_TABLE` check.
- **New `ICEBERG_CREATE_TABLE_AUTHORIZATION_EXPRESSION`** in
`AuthorizationExpressionConstants`. It
replaces the copies written out in `createTable`, `registerTable` and the
rename destination check.
- Wiring: an `UPDATE_TABLE` value in `IcebergAuthorizationMetadata`, and an
annotation on the
`updateTable` request parameter.
### Why are the changes needed?
**A staged-create commit creates a table, but was checked as a modify.**
- **CTAS and RTAS fail for CREATE-only users:** the commit is checked as
`MODIFY_TABLE` on a table that
does not exist yet, so it gets 403.
- **MODIFY could create and own tables:** a user with schema-level
`MODIFY_TABLE` and no `CREATE_TABLE`
could create a table in one commit and become its owner.
Fix: #14243
### Does this PR introduce _any_ user-facing change?
Yes. An update-table call that carries `assert-create` now needs
`CREATE_TABLE` on the schema instead of
`MODIFY_TABLE`.
### How was this patch tested?
`TestIcebergStagedCreateCommitAuthorization` (4 cases):
- **On `main`:** `testStagedCreateCommitDeniedWithModifyTableOnly` and
`testStagedCreateCommitAllowedWithCreateTable` fail, and both
regular-commit guards pass.
- **With the fix:** all 4 pass.
`TestIcebergMetadataAuthorizationMethodInterceptor` also passes.
`./gradlew -PskipITs :iceberg:iceberg-rest-server:test --tests
'*TestIcebergStagedCreateCommitAuthorization' --tests
'*TestIcebergMetadataAuthorizationMethodInterceptor'`
A follow-up can add a CTAS case to `IcebergTableAuthorizationIT`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
