Copilot commented on code in PR #4961:
URL: https://github.com/apache/polaris/pull/4961#discussion_r3562033109
##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizableOperation.java:
##########
@@ -115,6 +115,11 @@ public enum PolarisAuthorizableOperation {
GET_APPLICABLE_POLICIES_ON_TABLE,
ADD_POLICY_GRANT_TO_CATALOG_ROLE,
REVOKE_POLICY_GRANT_FROM_CATALOG_ROLE,
+ CREATE_SEMANTIC_MODEL,
+ LOAD_SEMANTIC_MODEL,
+ UPDATE_SEMANTIC_MODEL,
+ DROP_SEMANTIC_MODEL,
+ LIST_SEMANTIC_MODEL,
Review Comment:
These new semantic-model operations are not recognized by the Ranger
authorizer mapping, so deployments using `RangerPolarisAuthorizer` will
currently fail all semantic-model requests with `ForbiddenException` (because
`RangerPolarisOperationSemantics.forOperation(op)` returns null when an op is
missing from the map). Please either add Ranger semantics entries for these
operations (even if they initially map to the same underlying privileges as the
interim RBAC mapping), or explicitly document that semantic-models are
unsupported under Ranger while the feature flag is enabled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
