Copilot commented on code in PR #4758:
URL: https://github.com/apache/polaris/pull/4758#discussion_r3409950694
##########
runtime/service/src/test/java/org/apache/polaris/service/catalog/generic/PolarisGenericTableCatalogHandlerAuthzTest.java:
##########
@@ -126,4 +127,13 @@ Stream<DynamicNode> testDropGenericTablePrivileges() {
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
+
+ @Test
+ void dropGenericTableHonorsTableScopedGrant() {
+ assertSuccess(
+ adminService.grantPrivilegeOnTableToRole(
+ CATALOG_NAME, CATALOG_ROLE1, TABLE_NS1_1_GENERIC,
PolarisPrivilege.TABLE_DROP));
+
+ newWrapper(Set.of(PRINCIPAL_ROLE1)).dropGenericTable(TABLE_NS1_1_GENERIC);
+ }
Review Comment:
This test only exercises the success path after granting `TABLE_DROP`. To
fully lock in the intended behavior (that table-scoped grants are
required/recognized), add a negative assertion that the drop is denied before
the grant (or for a principal without the table grant), then succeeds after the
grant. Optionally also assert the returned boolean (if meaningful) to ensure
the handler result is validated.
##########
runtime/service/src/test/java/org/apache/polaris/service/catalog/generic/PolarisGenericTableCatalogHandlerAuthzTest.java:
##########
@@ -126,4 +127,13 @@ Stream<DynamicNode> testDropGenericTablePrivileges() {
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
.createTests();
}
+
+ @Test
+ void dropGenericTableHonorsTableScopedGrant() {
+ assertSuccess(
+ adminService.grantPrivilegeOnTableToRole(
+ CATALOG_NAME, CATALOG_ROLE1, TABLE_NS1_1_GENERIC,
PolarisPrivilege.TABLE_DROP));
Review Comment:
The test grants a privilege but never revokes it. If the underlying authz
state persists across tests within this class/test suite, this can create
order-dependent failures. Consider revoking the privilege in
teardown/`finally`, or using a per-test role/table fixture that is cleaned up
automatically.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
