sunyuhan1998 opened a new pull request, #11202: URL: https://github.com/apache/gravitino/pull/11202
### What changes were proposed in this pull request? Add Role management and permission operations (grant/revoke) to the Gravitino Python SDK, including: **New DTOs:** - `PrivilegeDTO` — JSON serialization with lowercase enum encoding matching Java server - `SecurableObjectDTO` — with fullName parsing and MetadataObject.Type codec - `RoleDTO` — with Builder pattern and audit validation **New Request/Response DTOs:** - `RoleCreateRequest`, `RoleGrantRequest`, `RoleRevokeRequest` - `PrivilegeGrantRequest`, `PrivilegeRevokeRequest` - `RoleResponse`, `RoleNamesListResponse` **New Error Handler:** - `PermissionErrorHandler` — handles grant/revoke error codes (IllegalPrivilege, NoSuchUser/Group/Role/MetadataObject, etc.) **Client Methods (10 new methods on GravitinoMetalake + GravitinoClient delegates):** - Role CRUD: `create_role`, `get_role`, `delete_role`, `list_role_names` - Grant/Revoke roles: `grant_roles_to_user`, `revoke_roles_from_user`, `grant_roles_to_group`, `revoke_roles_from_group` - Grant/Revoke privileges: `grant_privileges_to_role`, `revoke_privileges_from_role` **Bug fix:** - `GenericPrivilege.__eq__` changed from `isinstance(value, GenericPrivilege)` to `isinstance(value, Privilege)` for symmetric equality with `PrivilegeDTO` ### Why are the changes needed? The Java SDK already supports full authorization management via `GravitinoMetalake`. The Python SDK should provide equivalent functionality so users can manage roles and permissions without falling back to raw REST API calls. This is part of the authorization management split for issue #10782: - PR1 User (#11058) — Merged - PR2 Group (#11094 / #11109) — Merged - **PR3 Role (#11095) + Privilege/Grant/Revoke (#11096) — This PR** - Integration tests (#11097) are included in each PR Fix: #11095 #11096 ### Does this PR introduce _any_ user-facing change? Yes, adds new public APIs to `GravitinoClient` and `GravitinoMetalake`: - `create_role`, `get_role`, `delete_role`, `list_role_names` - `grant_roles_to_user`, `revoke_roles_from_user` - `grant_roles_to_group`, `revoke_roles_from_group` - `grant_privileges_to_role`, `revoke_privileges_from_role` ### How was this patch tested? - **Unit tests**: 906 passed (64 new tests covering DTOs, requests, responses, error handlers, and client operations with mocks) - **Integration tests**: 7 passed (end-to-end tests against Gravitino server with authorization enabled) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
