(gravitino) branch branch-1.3 updated: [Cherry-pick to branch-1.3] [#12269] fix(authz): Allow catalog owners to grant schema privileges (#12673) (#12701)

[jshao]

This is an automated email from the ASF dual-hosted git repository.

jerryshao pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git


The following commit(s) were added to refs/heads/branch-1.3 by this push:
     new 810777fce7 [Cherry-pick to branch-1.3] [#12269] fix(authz): Allow 
catalog owners to grant schema privileges (#12673) (#12701)
810777fce7 is described below

commit 810777fce75c9e41c6847b618a253830e988a1ca
Author: github-actions[bot] 
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Fri Aug 28 17:06:57 2026 +0800

    [Cherry-pick to branch-1.3] [#12269] fix(authz): Allow catalog owners to 
grant schema privileges (#12673) (#12701)
    
    **Cherry-pick Information:**
    - Original commit: c79996e7a882147bbe93660edc2bc771a2fb2292
    - Target branch: `branch-1.3`
    - Status: ✅ Clean cherry-pick (no conflicts)
    
    Signed-off-by: 1fanwang <1fan...@gmail.com>
    Co-authored-by: Stefan Wang <1fan...@gmail.com>
---
 .../authorization/jcasbin/JcasbinAuthorizer.java   |  7 ++++---
 .../jcasbin/TestJcasbinAuthorizer.java             | 24 ++++++++++++++++++++++
 2 files changed, 28 insertions(+), 3 deletions(-)

diff --git 
a/server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java
 
b/server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java
index 84945fc0bf..cac20f036a 100644
--- 
a/server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java
+++ 
b/server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java
@@ -539,9 +539,10 @@ public class JcasbinAuthorizer implements 
GravitinoAuthorizer {
 
     MetadataObject metadataObject = MetadataObjects.parse(fullName, 
metadataType);
     do {
-      if (isOwner(currentPrincipal, metalake, metadataObject, requestContext)) 
{
-        return hasParentUsagePermission(
-            currentPrincipal, metalake, metadataObject, metalakeObject, 
requestContext);
+      if (isOwner(currentPrincipal, metalake, metadataObject, requestContext)
+          && hasParentUsagePermission(
+              currentPrincipal, metalake, metadataObject, metalakeObject, 
requestContext)) {
+        return true;
       }
     } while ((metadataObject = MetadataObjects.parent(metadataObject)) != 
null);
     return false;
diff --git 
a/server-common/src/test/java/org/apache/gravitino/server/authorization/jcasbin/TestJcasbinAuthorizer.java
 
b/server-common/src/test/java/org/apache/gravitino/server/authorization/jcasbin/TestJcasbinAuthorizer.java
index b067751a2e..25f0f5c45e 100644
--- 
a/server-common/src/test/java/org/apache/gravitino/server/authorization/jcasbin/TestJcasbinAuthorizer.java
+++ 
b/server-common/src/test/java/org/apache/gravitino/server/authorization/jcasbin/TestJcasbinAuthorizer.java
@@ -2197,6 +2197,30 @@ public class TestJcasbinAuthorizer {
         "Owner should be able to manage privileges without checking DENY 
MANAGE_GRANTS");
   }
 
+  @Test
+  public void testHasSetOwnerPermissionAllowsSchemaAndCatalogOwner() throws 
Exception {
+    MetadataObject metalakeObject =
+        MetadataObjects.of(ImmutableList.of(METALAKE), 
MetadataObject.Type.METALAKE);
+    metadataIdConverterMockedStatic
+        .when(() -> MetadataIdConverter.getID(eq(metalakeObject), 
eq(METALAKE)))
+        .thenReturn(Optional.of(USER_METALAKE_ID));
+    when(ownerMetaMapper.selectOwnerByMetadataObjectIdAndType(eq(CATALOG_ID), 
eq("SCHEMA")))
+        .thenReturn(new OwnerInfo(USER_ID, "USER"));
+    when(ownerMetaMapper.selectOwnerByMetadataObjectIdAndType(eq(CATALOG_ID), 
eq("CATALOG")))
+        .thenReturn(new OwnerInfo(USER_ID, "USER"));
+    getOwnerRelCache(jcasbinAuthorizer).invalidateAll();
+
+    try {
+      assertTrue(
+          jcasbinAuthorizer.hasSetOwnerPermission(
+              METALAKE, "SCHEMA", "testCatalog.testSchema", new 
AuthorizationRequestContext()));
+    } finally {
+      metadataIdConverterMockedStatic
+          .when(() -> MetadataIdConverter.getID(eq(metalakeObject), 
eq(METALAKE)))
+          .thenReturn(Optional.of(CATALOG_ID));
+    }
+  }
+
   @Test
   public void testHasSetOwnerPermissionRejectsDenyUseCatalogForTableOwner() 
throws Exception {
     makeCompletableFutureUseCurrentThread(jcasbinAuthorizer);