roryqi commented on code in PR #12850:
URL: https://github.com/apache/gravitino/pull/12850#discussion_r3930357435
##########
lineage/src/main/java/org/apache/gravitino/lineage/source/rest/LineageOperations.java:
##########
@@ -53,16 +56,25 @@ public LineageOperations(LineageDispatcher
lineageDispatcher) {
@Produces(MediaType.APPLICATION_JSON)
Review Comment:
Thanks for the detailed verification. I confirmed that the 406 behavior
exists on `main`. It is caused by the existing content-negotiation setup rather
than by the validation or authorization changes in this PR, so I consider it
outside the scope of this PR.
I have also not been able to reproduce the 201 response from #12840 through
the standard server wiring. The authorization gap applies once the request
reaches the resource and interceptor path.
##########
docs/open-api/lineage.yaml:
##########
@@ -21,21 +21,34 @@ paths:
/lineage:
post:
summary: Post runEvent
- description: Updates a run state for a job.
+ description: |
+ Updates a run state for a job. When authorization is enabled,
`job.namespace`
+ identifies the Gravitino metalake (organization), and every input and
output
+ dataset namespace must match it. Dataset names must be Gravitino
metadata full
+ names. The optional `datasetType` facet defaults to `TABLE`; supported
values are
+ `TABLE`, `VIEW`, `FILE`, `FILESET`, `MODEL`, `MODEL_VERSION`, and
`TOPIC`.
+ Inputs and outputs both require metadata visibility. Unsupported or
external
+ dataset identifiers are rejected when authorization is enabled. When
authorization
+ is disabled, generic OpenLineage namespaces remain supported.
Review Comment:
The strict namespace contract is intentional. The lineage endpoint has no
metalake path parameter or configured identifier resolver, while authorization
must resolve every target to exactly one Gravitino metalake and fail closed.
Therefore, when authorization is enabled, `job.namespace` is treated as the
event metalake and every dataset must use that namespace with a
Gravitino-normalized name.
Allowing generic or unresolved namespaces would require skipping dataset
authorization and would reintroduce the issue this PR fixes. A pluggable
identifier resolver could support standard producer namespaces in the future,
but that is a separate feature. The authorization-disabled path continues to
accept generic OpenLineage namespaces, and the strict authorization contract is
documented and tested in this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
