markhoerth opened a new issue, #14424:
URL: https://github.com/apache/gravitino/issues/14424
### Version
main branch, commit bb634defdc5663a8124be5fca1c8d9e52ac096ac (2.0.0-SNAPSHOT)
### Describe what's wrong
A user creates a tag with `allowedValues: ["a","b"]` and associates a policy
with it using a `TAG_VALUE` selector whose value is not allowed, for example
`"zzz"`, `"A"` (case differs), or any value on a tag created with
`allowedValues: []`. The docs say allowed values are fixed at creation and
cannot be changed (`docs/manage-tags-in-gravitino.md:62-64`), and assigning
`dom=zzz` to an object is refused with "Tag dom value zzz is not in allowed
values [a, b]". So the association can never match anything. The user expects a
400. Instead it is stored (200) and the policy silently never applies.
The cause is in
`core/src/main/java/org/apache/gravitino/tag/TagManager.java:234-264`.
`addPolicyForTag` writes the `POLICY_TAG_REL` relation with the serialized
selector and does not load the tag or compare the selector value with its value
constraint. The REST handler
(`server/src/main/java/org/apache/gravitino/server/web/rest/TagOperations.java:394-420`)
only runs `PolicyTagAddRequest.validate()`, which checks the selector's shape.
### Error message and/or stacktrace
```
POST /api/metalakes/ml/tags/dom/policies/cp
{"selector":{"type":"TAG_VALUE","value":"zzz"}}
200
{"code":0,"policy":"cp","tag":"dom","selector":{"type":"TAG_VALUE","value":"zzz"}}
POST /api/metalakes/ml/objects/table/cat.s.b/tags (v2)
{"tagsToAdd":[{"name":"dom","value":"zzz"}],"tagsToRemove":[]}
400 {"code":1001,"type":"IllegalArgumentException","message":"Failed to
operate tag(s) operation [ASSOCIATE] under object [cat.s.b], reason [Tag dom
value zzz is not in allowed values [a, b]]"}
```
### How to reproduce
1. Create a metalake `ml`, a tag with allowed values and a custom policy:
```
H='-u admin:x -H Content-Type:application/json -H
Accept:application/vnd.gravitino.v1+json'
curl $H -X POST http://127.0.0.1:8090/api/metalakes -d
'{"name":"ml","comment":"","properties":{}}'
curl $H -X POST http://127.0.0.1:8090/api/metalakes/ml/tags -d
'{"name":"dom","comment":"","properties":{},"allowedValues":["a","b"]}'
curl $H -X POST http://127.0.0.1:8090/api/metalakes/ml/policies -d
'{"name":"cp","comment":"","policyType":"custom","enabled":true,"content":{"customRules":{"r":"1"},"supportedObjectTypes":["TABLE"],"properties":{}}}'
```
2. Associate the policy with a value the tag does not allow; the response is
200:
```
curl $H -X POST
http://127.0.0.1:8090/api/metalakes/ml/tags/dom/policies/cp -d
'{"selector":{"type":"TAG_VALUE","value":"zzz"}}'
```
3. `GET /api/metalakes/ml/tags/dom/policies` now lists `cp`.
### Additional context
The 2.0 OSS test suite check
`test_tag_value_selector_outside_allowed_values_rejected` found it. The defect
is in Gravitino's tag manager.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
