yuqi1129 commented on code in PR #12873:
URL: https://github.com/apache/gravitino/pull/12873#discussion_r3924379436
##########
core/src/main/java/org/apache/gravitino/hook/FunctionHookDispatcher.java:
##########
@@ -108,6 +110,11 @@ public Function alterFunction(NameIdentifier ident,
FunctionChange... changes)
@Override
public boolean dropFunction(NameIdentifier ident) {
- return dispatcher.dropFunction(ident);
+ boolean dropped = dispatcher.dropFunction(ident);
+ if (dropped) {
+ AuthorizationUtils.authorizationPluginRemovePrivileges(
Review Comment:
Fixed in d1eceff739. FunctionMetaService already removes Gravitino
securable-object relations in the function-delete transaction, so the hook no
longer calls authorizationPluginRemovePrivileges(FUNCTION). It now only
invalidates the canonical JCasbin name-to-ID mapping through a dedicated
helper, avoiding any post-commit callback to Ranger or another catalog
authorization plugin. The updated test enables access control, wires a catalog
authorization plugin, and verifies that JCasbin is invalidated while the plugin
receives no interaction; no-op and exceptional drops remain covered.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
