sunyuhan1998 opened a new pull request, #11702:
URL: https://github.com/apache/gravitino/pull/11702
### What changes were proposed in this pull request?
After writing a `RoleEntity`, `RelationalEntityStore.update()` and `put()`
now explicitly invalidate the `METADATA_OBJECT_ROLE_REL` cache entry keyed by
each of the role's securable objects (new private method
`invalidateMetadataObjectRoleRelationCache`; no-op for non-ROLE entities or
empty securable objects). Covers grant / override-add / createRole.
### Why are the changes needed?
Fixes #11701: for a metadata object that was already queried,
`listBindingRoleNames()` returns stale data (missing the newly granted role)
after `grantPrivilegesToRole` (or `overridePrivilegesInRole` adding an object,
or `createRole` with objects), until the relation cache TTL (default 1h)
elapses.
Root cause: the write path only calls `cache.invalidate(roleIdent, ROLE)` (a
role-side BFS). Reaching the object-keyed `METADATA_OBJECT_ROLE_REL` entry
requires the reverse index to already map `roleIdent -> objectKey`, which is
only established when the role has previously been cached as a binding role of
that object (the #11297 patch). A newly granted role was never cached there, so
the invalidation never reaches the entry. The subtraction side (revoke /
override-remove / deleteRole) is already covered by the same role-side
invalidation via the reverse index (the removed role was previously cached), so
this PR does not touch it.
Fix: #11701
### Does this PR introduce _any_ user-facing change?
No API or configuration change. Behavioral fix: "list binding roles by
object" reflects grant/override/create immediately instead of being delayed
until the cache entry expires.
### How was this patch tested?
Added 4 parameterized tests in `TestEntityStorageRelationCache`
(h2/mysql/postgresql × enableCache true/false):
- `testGrantPrivilegeInvalidatesMetadataObjectRoleRelCache` — reproduces the
bug (red before / green after);
- `testRevokeAllPrivileges...` / `testOverrideRemoveObject...` /
`testDeleteRole...` — three subtraction guards (no stale residue; pin coverage
so a future reverse-index rule change cannot silently regress).
Ran: `./gradlew :core:test --tests
'*TestEntityStorageRelationCache.test{Grant,Revoke,RevokeAll,OverrideRemove,Delete}Role*'
-PskipDockerTests=false -PskipITs` → BUILD SUCCESSFUL, `tests=30 skipped=0
failures=0 errors=0` (mysql ~10s/case, postgresql ~3s, h2 ~0.1–2s; all three
backends actually executed). `:core:spotlessCheck` passes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
