markhoerth opened a new pull request, #14470: URL: https://github.com/apache/gravitino/pull/14470
Backport to branch-1.3 of the fix for #14468. Same change as the PR to main, except that branch-1.3 has no view registration, so that hook is unchanged. ### What changes were proposed in this pull request? - **Creator:** the namespace, table and view hooks record the authenticated IRC user and the create time on the imported entity when the catalog reports no creator (`IcebergEntityAuditUtils.recordCreator`). A creator the catalog reports is kept. Every namespace a nested create makes gets its creator. Registration does the same. The object already exists at that point, so a failure to record the audit is logged rather than failing the request. - **Modifier:** a commit that adds or selects a schema brings the stored columns up to date before the request returns, while it runs as the committing user. A later background sync or read then finds nothing to change. Commits that only add snapshots do no extra load. - **Denials:** `BaseMetadataAuthorizationMethodInterceptor` dispatches an `AuthorizationDenialFailureEvent` for each `ForbiddenException` when the protocol returns an event source from the new `authorizationDenialEventSource()` hook. The event carries the target object, or the metalake for a failed user check. The IRC interceptor returns `GRAVITINO_ICEBERG_REST_SERVER`. Lance keeps the default and records no event. Dispatch failures are logged and never change the response. - **Metrics:** a new default method `IcebergTableOperationDispatcher.checkTableMetricsReport` holds the existence and table-name checks. `IcebergTableEventDispatcher` wraps it in the new `IcebergReportTableMetricsPreEvent`, `IcebergReportTableMetricsEvent` and `IcebergReportTableMetricsFailureEvent`, with the new `OperationType.REPORT_TABLE_METRICS`, mapped to audit `Operation.REPORT_TABLE_METRICS`. The check no longer fires a table-exists event. ### Why are the changes needed? Audit reviews could not see who created or changed IRC objects, could not find IRC denials by operation or object, and saw table-existence checks that no client made. Fixes #14468 ### Does this PR introduce _any_ user-facing change? Yes. IRC-created objects show `creator` and `createTime`; schema changes are attributed to the committing user; IRC denials are audited as `AUTHORIZATION_DENIAL`; metrics reports are audited as `REPORT_TABLE_METRICS`. ### How was this patch tested? - `TestIcebergTableHookDispatcher`: the creator is recorded on create; a schema-change commit loads the table to sync columns, other commits do not. - `TestIcebergNamespaceHookDispatcher`, `TestIcebergViewHookDispatcher`: the creator is recorded for each created namespace and for a created view. - `TestIcebergEntityAuditUtils`: a reported creator is kept. - `TestBaseMetadataAuthorizationMethodInterceptor`: expression and user-validation denials dispatch the event with the right object, expression and source; no event without a source or for internal failures. - `TestIcebergTableOperations#testReportTableMetrics`: a report fires only `REPORT_TABLE_METRICS` events, and a missing table fires the failure event. `./gradlew :core:test --tests 'org.apache.gravitino.audit.*' :server-common:test :iceberg:iceberg-rest-server:test -PskipITs` 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Eu6fb9pLfmrSJzGQDVLi1g -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
