yuqi1129 opened a new pull request, #12694: URL: https://github.com/apache/gravitino/pull/12694
> **Draft: depends on #12693 (#12559).** This branch is stacked on it, so the diff shown here includes that PR's commit until it merges. Rebase onto `main` after #12693 lands. ### What changes were proposed in this pull request? Authorizes the read-only Lance REST table operations. - `describe-table` requires the standard load-table privileges. `table-exists` additionally accepts `CREATE_TABLE`, because clients probe for a table immediately before creating it; `describe-table` deliberately does not, so a probe privilege never exposes a table's schema, properties, or storage options. - `list-tables` is authorized on the addressed schema, and the tables the caller may not see are removed **before** the page is cut, so pagination stays consistent with what the caller is allowed to see. This adds a `filterTables` hook to `LanceMetadataFilter`, implemented against `FILTER_TABLE_AUTHORIZATION_EXPRESSION` — which carries the parent-scope short-circuit and deny precedence used by the rest of Gravitino. - A Lance identifier carries its depth rather than its kind, so the interceptor now resolves a three-level identifier to a table, and every table expression is guarded on the addressed entity type. An identifier of the wrong depth for an operation matches no branch and is denied, rather than being silently authorized against another entity. Credential vending stays out of scope. Fix: #12560 ### Why are the changes needed? The Lance REST table surface was still unauthorized after #12558 and #12559 covered the namespace surface. ### Does this PR introduce _any_ user-facing change? Yes. With authorization enabled, `describe-table` and `table-exists` are now authorized and return 403 when denied, and `list-tables` returns only the tables the caller may see. A table the caller may not read is reported as forbidden whether or not it exists, so the endpoints cannot be used to probe for existence. ### How was this patch tested? - `TestLanceMetadataAuthorizationMethodInterceptor`: new tests for `SELECT_TABLE`/`MODIFY_TABLE` reads, the `CREATE_TABLE` probe that must not read, deny precedence, and identifiers of the wrong depth. - `TestGravitinoLanceNamespaceListFiltering`: a new test proving tables are filtered before pagination, using a hidden table that sorts first. - New `LanceTableAuthorizationIT`: four tests covering table read privileges, the probe-but-not-read distinction, indistinguishable inaccessible and missing tables, and filtered pagination. - `./gradlew :lance:lance-rest-server:build :lance:lance-common:build` — 180 tests, all passing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
