yuqi1129 opened a new pull request, #12695: URL: https://github.com/apache/gravitino/pull/12695
> **Draft: depends on #12560.** This branch is stacked on it, so the diff shown here includes the earlier PRs' commits until they merge. ### What changes were proposed in this pull request? Authorizes the Lance REST table creation operations. - `create-table`, `declare-table`, and `register-table` all require `USE_CATALOG`, `USE_SCHEMA`, and `CREATE_TABLE` on the target schema, so the three ways of introducing a table cannot diverge. - A create whose mode overwrites an existing table is a modification, so it is authorized against `MODIFY_TABLE` or ownership instead. The overwrite handler introduced for namespaces in #12559 now covers tables as well and picks the expression from the addressed entity, which keeps `CREATE_TABLE` from escalating into permission to replace a table the caller does not own. The mode travels in a query parameter for `create-table` and in the request body for `register-table`, so neither can be expressed by the method annotation alone. Assigning the caller as owner after a successful create needs no new code: Lance runs its writes through the Gravitino table dispatcher, whose hook already sets the owner. The integration test verifies this by having the creator read back a table it holds no `SELECT_TABLE` on. Credential vending stays out of scope. Fix: #12561 ### Does this PR introduce _any_ user-facing change? Yes. With authorization enabled, create, declare, and register are authorized and denied requests return 403 without creating metadata. As for namespaces, `mode=overwrite` always requires ownership or `MODIFY_TABLE`, whether or not the table exists: deciding this from the mode alone avoids an existence probe that would race with the write that follows it. ### How was this patch tested? - `TestLanceMetadataAuthorizationMethodInterceptor`: new tests covering the `CREATE_TABLE` requirement across all three entry points, the overwrite escalation guard, and overwrite authorized by `MODIFY_TABLE` or ownership. - `LanceTableAuthorizationIT`: two new tests covering creation denial and success with ownership assigned, and a denied overwrite leaving the registered location untouched. - `./gradlew :lance:lance-rest-server:build :lance:lance-common:build` — 185 tests, all passing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
