bharos opened a new pull request, #12044:
URL: https://github.com/apache/gravitino/pull/12044
### What changes were proposed in this pull request?
Phase 1 role-assumption **enforcement** in `JcasbinAuthorizer`. When a
request declares a subset of the caller's roles as active, allow policies are
evaluated against only that subset; deny stays global.
- `AuthorizationRequestContext`: carry an immutable `ActiveRoles` (defaults
to `ALL`, so an unset value is byte-for-byte today's behavior).
- `JcasbinAuthorizer`: only the allow enforcer narrows. When a subset is
declared, `enforceNarrowed`:
- applies deny **globally** first (over the caller's full role union) — a
deny on any held role always applies, keeping narrowing subtractive;
- then ORs allow across the active set = `(declared names) ∩ (caller's
effective roles)`.
- `NONE` activates no role; `ALL` / absent is unchanged.
- Ownership is unchanged (Option A).
This is intentionally scoped to enforcement so it can be reviewed on its
own. Carrying the value from the `X-Gravitino-Active-Roles` header onto the
request and the `400`/`403` mapping follow in later PRs.
### Why are the changes needed?
Implements the enforcement step of the approved design
[`design-docs/gravitino-role-assumption.md`](https://github.com/apache/gravitino/blob/main/design-docs/gravitino-role-assumption.md)
(discussion [#10894](https://github.com/apache/gravitino/discussions/10894)).
A caller needs authorization to be narrowed to a declared subset of its roles;
this PR is the server-side narrowing the rest of the feature builds on.
Part of #11965. Closes #11967.
### Does this PR introduce any user-facing change?
No. The narrowing path only activates when an `ActiveRoles` subset is set on
the request; nothing populates it yet, so behavior is unchanged.
### How was this patch tested?
New unit tests in `TestJcasbinAuthorizer`: allow-narrowing to a named role,
`NONE`, deny-stays-global when the allow is narrowed, group-inherited active
role, and unheld-role-activates-nothing (subtractive). Verified locally:
- `./gradlew :server-common:test --tests
"org.apache.gravitino.server.authorization.jcasbin.TestJcasbinAuthorizer"`
- `./gradlew :core:test --tests
"org.apache.gravitino.authorization.TestAuthorizationRequestContext"`
- `./gradlew :server-common:spotlessCheck :core:spotlessCheck`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
