plusplusjiajia commented on code in PR #9400:
URL: https://github.com/apache/paimon/pull/9400#discussion_r3860443014
##########
paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java:
##########
@@ -880,6 +887,57 @@ public void revokePermission(PermissionResource resource,
String access, String
restAuthFunction);
}
+ /** Lists policies attached to an exact table resource. */
+ @Experimental
+ public ListPoliciesResponse listPolicies(ListPoliciesRequest request) {
+ Map<String, String> queryParams = Maps.newHashMap();
+ if (request.getType() != null) {
+ putQueryParameter(queryParams, "type", request.getType().name());
+ }
+ putQueryParameter(queryParams, "principal", request.getPrincipal());
+ putQueryParameter(queryParams, "column", request.getColumn());
+ if (request.getMaxResults() != null) {
+ queryParams.put(MAX_RESULTS, request.getMaxResults().toString());
+ }
+ putQueryParameter(queryParams, PAGE_TOKEN, request.getPageToken());
+ return client.get(
+ resourcePaths.policies(request.getResource()),
+ queryParams,
+ ListPoliciesResponse.class,
+ restAuthFunction);
+ }
+
+ /** Creates a principal policy on its attachment resource. */
+ @Experimental
+ public void createPolicy(DataPolicy policy) {
+ client.post(
+ resourcePaths.policies(policy.getResource()),
+ new PolicyRequest(policy),
+ restAuthFunction);
+ }
+
+ /** Drops a principal policy from its exact attachment resource. */
+ @Experimental
+ public void dropPolicy(
+ PermissionResource resource,
+ PolicyType type,
+ String principal,
+ @Nullable String column,
+ boolean ignoreIfNotExists) {
+ checkNotNull(resource, "resource cannot be
null").validatePolicyAttachment();
+ try {
+ client.delete(
Review Comment:
The six existing `client.delete` call sites pass a path that identifies the
object; here the path is the *collection* (`.../tables/{t}/policies`) and the
body picks one policy. A body that doesn't survive the hop leaves a
well-formed, wider request rather than a malformed one — RFC 9110 §9.3.5:
DELETE content "cannot alter the meaning or target of the request".
(Fail-closed under DLF auth, which signs the body; not under bearer.)
#9393 hit this for revoke and used `POST /permissions/revoke` — would `POST
.../policies/drop` work here too?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
