roryqi commented on code in PR #10996:
URL: https://github.com/apache/gravitino/pull/10996#discussion_r3245739255
##########
core/src/main/java/org/apache/gravitino/authorization/GravitinoAuthorizer.java:
##########
@@ -166,4 +166,18 @@ default void handleRolePrivilegeChange(String metalake,
String roleName) {
*/
void handleMetadataOwnerChange(
String metalake, Long oldOwnerId, NameIdentifier nameIdentifier,
Entity.EntityType type);
+
+ /**
+ * Called when an entity undergoes a structural change (rename or drop) that
invalidates cached
+ * name-to-id mappings in the metadataIdCache. The authorizer evicts the
cache key for the given
+ * entity and all of its descendants (cascade invalidation).
+ *
+ * @param metalake the metalake name
+ * @param nameIdentifier the entity name identifier
+ * @param type the entity type
+ */
+ default void handleEntityStructuralChange(
Review Comment:
How about `handleEntityNameIdMappingChange`?
##########
server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java:
##########
@@ -87,15 +136,43 @@ public class JcasbinAuthorizer implements
GravitinoAuthorizer {
/** deny internal authorizer */
private InternalAuthorizer denyInternalAuthorizer;
+ // ---- Version-validated caches (strong consistency) ----
+
+ /**
+ * userRoleCache: metalake::userName -> CachedUserRoles. Version-validated
per request via
+ * user_meta.updated_at.
+ */
+ private GravitinoCache<String, CachedUserRoles> userRoleCache;
+
+ /**
+ * groupRoleCache: metalake::groupName -> CachedGroupRoles.
Version-validated per request via
+ * group_meta.updated_at.
+ */
+ private GravitinoCache<String, CachedGroupRoles> groupRoleCache;
+
+ /**
+ * loadedRoles: roleId -> updated_at. If the DB updated_at is newer, evict
and reload policies.
+ */
+ private GravitinoCache<Long, Long> loadedRoles;
+
+ // ---- Eventual consistency caches (poller-driven) ----
+
/**
- * loadedRoles is used to cache roles that have loaded permissions. When the
permissions of a role
- * are updated, they should be removed from it.
+ * metadataIdCache: hierarchical key
(metalake::catalog::schema::table::TYPE) -> entity id.
+ * Evicted by entity change poller.
*/
- private Cache<Long, Boolean> loadedRoles;
+ private GravitinoCache<String, Long> metadataIdCache;
Review Comment:
I have some concern about this point.
1. You add a concept a hierarchical key. It will make developers confused.
What's the relationship with hierarchical schema.
2. You can use a object as the key. It will better than using a flat string.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
