yuqi1129 opened a new pull request, #12693: URL: https://github.com/apache/gravitino/pull/12693
### What changes were proposed in this pull request? Authorizes the Lance REST create-namespace and drop-namespace operations. - A one-level namespace identifier addresses a Gravitino catalog and a two-level identifier a schema, so both expressions select the required privileges with an `entityType` guard. Creating a catalog requires `CREATE_CATALOG` on the metalake; creating a schema requires `USE_CATALOG` together with `CREATE_SCHEMA`. - Dropping a namespace requires ownership of it or of one of its ancestors, matching the Gravitino and Iceberg REST surfaces. - `mode=overwrite` replaces an existing namespace, so it is authorized against the ownership expression through an `AuthorizationHandler` rather than the create expression on the method. The mode travels in the request body, so it cannot be expressed by the method annotation alone. - The namespace expressions move into a new `LanceAuthorizationExpressions` holder now that there is more than one of them. Assigning the caller as owner after a successful create needs no new code: in auxiliary mode Lance runs its writes through the Gravitino catalog and schema dispatchers, whose hooks already set the owner. The integration test verifies this end to end. ### Why are the changes needed? Namespace writes were the last unauthorized part of the Lance REST namespace surface after #12558 added the framework and the read paths. Fix: #12559 ### Does this PR introduce _any_ user-facing change? Yes. When `gravitino.authorization.enable` is true and Lance REST runs as an auxiliary service with a metalake configured, create-namespace and drop-namespace are now authorized and denied requests return 403 instead of succeeding. One behavior is worth calling out: `mode=overwrite` always requires ownership, whether or not the namespace already exists. Deciding this from the mode alone avoids an existence probe at authorization time, which would race with the create that follows it and make the required privilege depend on that race. A caller holding only `CREATE_SCHEMA` should use `create` or `exist_ok`. ### How was this patch tested? - `TestLanceMetadataAuthorizationMethodInterceptor`: four new tests covering create at each level, the overwrite escalation guard, owner-authorized overwrite and drop, and drop denial for a non-owner. - `LanceNamespaceAuthorizationIT`: three new tests covering create denial and success, ownership after create, a denied overwrite leaving the stored properties untouched, and drop concealing a namespace the caller may not see. - `./gradlew :lance:lance-rest-server:build :lance:lance-common:build` — 171 tests, all passing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
