Copilot commented on code in PR #12873:
URL: https://github.com/apache/gravitino/pull/12873#discussion_r3923882638
##########
core/src/main/java/org/apache/gravitino/hook/FunctionHookDispatcher.java:
##########
@@ -108,6 +110,11 @@ public Function alterFunction(NameIdentifier ident,
FunctionChange... changes)
@Override
public boolean dropFunction(NameIdentifier ident) {
- return dispatcher.dropFunction(ident);
+ boolean dropped = dispatcher.dropFunction(ident);
+ if (dropped) {
+ AuthorizationUtils.authorizationPluginRemovePrivileges(
+ ident, Entity.EntityType.FUNCTION, Collections.emptyList());
+ }
Review Comment:
dropFunction() removes privileges using the caller-provided identifier, but
the underlying dispatcher may normalize/case-fold function identifiers (see the
normalization applied during registerFunction owner assignment and
FunctionNormalizeDispatcher.dropFunction). If the caller passes a non-canonical
identifier (e.g., different casing under a case-insensitive catalog), the
authorization cache invalidation may target the wrong key and leave stale
grants/mappings behind.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
