nevzheng opened a new pull request, #12678: URL: https://github.com/apache/gravitino/pull/12678
### What changes were proposed in this pull request? This PR proposes a context-aware security contract for Gravitino entity properties and records it in `design-docs/secure-properties/context-aware-property-security.md`. The draft separates three responsibilities: - canonical property definitions declare reviewed security profiles and optional semantic descriptors; - property consumers bind explicitly selected definitions and supply a structured use context; and - a core engine produces terminal safe projections or narrowly materializes selected values for an already-authorized runtime operation. The design preserves ordinary undeclared properties, maps existing `hidden=true` declarations through a legacy compatibility profile, and keeps classification independent of Entity Secrets storage. It proposes Fileset cloud-provider properties as the first complete vertical slice. The main review questions are whether the cooperative definition-owner/consumer contract is sufficient, whether the purpose/surface contexts and projection actions are appropriately small, and whether the boundary with Entity Secrets and `getSecrets()` remains correct. ### Why are the changes needed? Entity properties are commonly represented as `Map<String, String>`. The current `hidden` mechanism protects a property only when every consumer selects matching metadata and applies filtering at the relevant boundary. Fileset catalog metadata currently omits shared cloud-provider definitions, so an inline `s3-secret-access-key` can follow ordinary-property behavior through REST and listener boundaries. Entity Secrets provides complementary opt-in storage and resolution, but it does not classify legacy inline values or define handling across every property consumer. The proposal establishes that missing runtime contract without replacing Entity Secrets or adding per-property authorization. Related to #12677. Related to #11642. ### Does this PR introduce _any_ user-facing change? No immediate runtime or API behavior changes. This draft adds only a design document. If adopted, follow-up implementation will introduce the proposed server-side property projection and selected runtime materialization contracts incrementally. ### How was this patch tested? - `npm exec --yes [email protected] -- --check design-docs/secure-properties/context-aware-property-security.md` - `npm exec --yes [email protected] -- design-docs/secure-properties/context-aware-property-security.md -q` - `./gradlew rat` - `git diff upstream/main...HEAD --check` All listed checks passed. The five Mermaid blocks were structurally reviewed; GitHub rendering will be checked on the draft PR. Runtime tests were not run because the change is documentation-only. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
