yuqi1129 opened a new pull request, #12101: URL: https://github.com/apache/gravitino/pull/12101
### What changes were proposed in this pull request? Adds `DEBUG`-level logging around the list-authorization parent-scope short-circuit (`MetadataAuthzHelper.filterByExpression` / `allVisibleViaParentScope`, introduced in #11778) so it is possible to tell, per request and per principal, whether the short-circuit fired and — when it did not — exactly which condition disqualified it: - **HIT**: every listed object is returned via a parent-scope grant and the per-object authorization loop is skipped. - **MISS / skipped**, with the reason: no short-circuit spec registered / filter-expression mismatch, listed objects span multiple parent namespaces, the principal has no parent-scope grant, or a deny policy exists on the relevant privileges. Every log line now includes the current principal, the entity type, and the metalake. This is purely diagnostic — no behavior change. ### Why are the changes needed? When a `list` call (e.g. `list catalogs`) is slow, there is currently no way to observe whether the #11778 short-circuit applied. The `verbose` (`details=true`) path and finer-grained or denied grants fall back to per-object authorization; these logs make that visible and greatly speed up diagnosing slow-list reports. Fix: N/A (minor diagnostic improvement) ### Does this PR introduce _any_ user-facing change? No. Debug logging only. ### How was this patch tested? No behavior change (only added `LOG.debug` calls and an extracted `hasDeny` local; control flow is unchanged). Existing tests cover the short-circuit logic. Verified `:server-common:compileJava` succeeds. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
