lasdf1234 commented on code in PR #12732:
URL: https://github.com/apache/gravitino/pull/12732#discussion_r3901320923
##########
docs/security/access-control.md:
##########
@@ -271,16 +271,19 @@ object: the owner of the table or view, plus
`CREATE_TABLE` or `CREATE_VIEW` on
| Job template | `REGISTER_JOB_TEMPLATE` | `USE_JOB_TEMPLATE`
| Owner | Run a job: `RUN_JOB` and `USE_JOB_TEMPLATE` |
| Job | | Owner
| Owner | |
-Bulk access-control APIs use the same privileges as the matching single-entity
operations. These
-bulk operations are authorized once before processing the request. Bulk
requests report item-level
-failures in `errors`.
+Bulk access-control APIs use the same privileges as the matching single-entity
operations. Most
+bulk operations are authorized once before processing the request. Role
removal is authorized per
+item because each role can be removed by the metalake owner or by the owner of
that role. Bulk
+requests report item-level failures in `errors`.
| API | Required privilege
|
|-----------------------------------------------------|--------------------------------------------|
| `POST /api/bulk/metalakes/{metalake}/users/add` | `OWNER` of the
metalake or `MANAGE_USERS` |
| `POST /api/bulk/metalakes/{metalake}/users/remove` | `OWNER` of the
metalake or `MANAGE_USERS` |
| `POST /api/bulk/metalakes/{metalake}/groups/add` | `OWNER` of the
metalake or `MANAGE_GROUPS` |
| `POST /api/bulk/metalakes/{metalake}/groups/remove` | `OWNER` of the
metalake or `MANAGE_GROUPS` |
+| `POST /api/bulk/metalakes/{metalake}/roles/add` | `OWNER` of the
metalake or `CREATE_ROLE` |
+| `POST /api/bulk/metalakes/{metalake}/roles/remove` | `OWNER` of the
metalake or each role |
Review Comment:
`OWNER` of the metalake, or `OWNER` of the role May be this
better for roles remove.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
