yuqi1129 opened a new issue, #12871: URL: https://github.com/apache/gravitino/issues/12871
### Version main branch ### Describe what is wrong After a function is dropped and recreated with the same name, a user may retain `EXECUTE_FUNCTION` access granted on the old function entity. JCasbin caches the function name-to-ID mapping. The drop path currently has three invalidation gaps: 1. `FunctionHookDispatcher.dropFunction()` does not invoke `authorizationPluginRemovePrivileges()`. 2. `authorizationPluginRemovePrivileges()` does not notify `handleEntityNameIdMappingChange()`. 3. Functions are not Entity Store cacheable, so function drops do not produce an `entity_change_log` record for peer-node invalidation. The configured three-second change polling interval does not bound the stale window when no change record is emitted. The metadata ID cache can remain stale until its TTL expires or the entry is evicted. ### Error message and/or stacktrace ```text After drop and recreate, access without a fresh EXECUTE_FUNCTION grant unexpectedly succeeds. ``` ### How to reproduce 1. Enable JCasbin authorization. 2. Register a function and grant a user `EXECUTE_FUNCTION`. 3. Access the function to populate the authorization caches. 4. Drop the function. 5. Register a new function with the same name. 6. Access the recreated function as the original user without granting a new privilege. Expected: Access is denied because the grant belongs to the old entity ID. Actual: The stale name-to-ID mapping may resolve the new path to the old entity ID, allowing the old in-memory policy to authorize the request. ### Additional context - `gravitino.authorization.jcasbin.changePollIntervalSecs` defaults to 3 seconds, but it only applies when an invalidation event exists. - `gravitino.authorization.jcasbin.cacheExpirationSecs` defaults to 3600 seconds. - Disabling the Entity Store cache does not disable JCasbin authorization caches. - The fix should cover both immediate local invalidation and propagation to peer nodes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
