This is an automated email from the ASF dual-hosted git repository.
roryqi pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/branch-1.3 by this push:
new 8c1e08cebb [Cherry-pick to branch-1.3] [#12885] fix(audit): Include
role names in role assignment logs (#12886) (#12898)
8c1e08cebb is described below
commit 8c1e08cebbbd0e26287db585d0ab42eb02bc4b1a
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Fri Sep 4 11:03:02 2026 +0800
[Cherry-pick to branch-1.3] [#12885] fix(audit): Include role names in role
assignment logs (#12886) (#12898)
**Cherry-pick Information:**
- Original commit: 8e25f016d026b3fffe0012e6ca3a5906746c0781
- Target branch: `branch-1.3`
- Status: ✅ Clean cherry-pick (no conflicts)
Co-authored-by: roryqi <[email protected]>
---
.../listener/api/event/GrantGroupRolesEvent.java | 7 ++++
.../api/event/GrantGroupRolesFailureEvent.java | 7 ++++
.../listener/api/event/GrantUserRolesEvent.java | 7 ++++
.../api/event/GrantUserRolesFailureEvent.java | 7 ++++
.../listener/api/event/RevokeGroupRolesEvent.java | 7 ++++
.../api/event/RevokeGroupRolesFailureEvent.java | 7 ++++
.../listener/api/event/RevokeUserRolesEvent.java | 7 ++++
.../api/event/RevokeUserRolesFailureEvent.java | 7 ++++
.../api/event/RoleAssignmentAuditInfos.java | 40 ++++++++++++++++++++++
.../gravitino/audit/v2/TestSimpleAuditLogV2.java | 16 +++++++++
.../listener/api/event/TestGroupEvent.java | 8 +++++
.../listener/api/event/TestUserEvent.java | 8 +++++
12 files changed, 128 insertions(+)
diff --git
a/core/src/main/java/org/apache/gravitino/listener/api/event/GrantGroupRolesEvent.java
b/core/src/main/java/org/apache/gravitino/listener/api/event/GrantGroupRolesEvent.java
index 04c754ed02..e3d181357d 100644
---
a/core/src/main/java/org/apache/gravitino/listener/api/event/GrantGroupRolesEvent.java
+++
b/core/src/main/java/org/apache/gravitino/listener/api/event/GrantGroupRolesEvent.java
@@ -21,6 +21,7 @@ package org.apache.gravitino.listener.api.event;
import com.google.common.collect.ImmutableList;
import java.util.List;
+import java.util.Map;
import org.apache.gravitino.annotation.DeveloperApi;
import org.apache.gravitino.listener.api.info.GroupInfo;
import org.apache.gravitino.utils.NameIdentifierUtil;
@@ -65,6 +66,12 @@ public class GrantGroupRolesEvent extends GroupEvent {
return roles;
}
+ /** {@inheritDoc} */
+ @Override
+ public Map<String, String> customInfo() {
+ return RoleAssignmentAuditInfos.of(roles);
+ }
+
/**
* Returns the operation type of this event.
*
diff --git
a/core/src/main/java/org/apache/gravitino/listener/api/event/GrantGroupRolesFailureEvent.java
b/core/src/main/java/org/apache/gravitino/listener/api/event/GrantGroupRolesFailureEvent.java
index 21e8f03567..23c0b4eb02 100644
---
a/core/src/main/java/org/apache/gravitino/listener/api/event/GrantGroupRolesFailureEvent.java
+++
b/core/src/main/java/org/apache/gravitino/listener/api/event/GrantGroupRolesFailureEvent.java
@@ -20,6 +20,7 @@
package org.apache.gravitino.listener.api.event;
import java.util.List;
+import java.util.Map;
import org.apache.gravitino.annotation.DeveloperApi;
import org.apache.gravitino.utils.NameIdentifierUtil;
@@ -71,6 +72,12 @@ public class GrantGroupRolesFailureEvent extends
GroupFailureEvent {
return roles;
}
+ /** {@inheritDoc} */
+ @Override
+ public Map<String, String> customInfo() {
+ return RoleAssignmentAuditInfos.of(roles);
+ }
+
/**
* Returns the operation type of this event.
*
diff --git
a/core/src/main/java/org/apache/gravitino/listener/api/event/GrantUserRolesEvent.java
b/core/src/main/java/org/apache/gravitino/listener/api/event/GrantUserRolesEvent.java
index 160c0e106b..705877b484 100644
---
a/core/src/main/java/org/apache/gravitino/listener/api/event/GrantUserRolesEvent.java
+++
b/core/src/main/java/org/apache/gravitino/listener/api/event/GrantUserRolesEvent.java
@@ -21,6 +21,7 @@ package org.apache.gravitino.listener.api.event;
import com.google.common.collect.ImmutableList;
import java.util.List;
+import java.util.Map;
import org.apache.gravitino.annotation.DeveloperApi;
import org.apache.gravitino.listener.api.info.UserInfo;
import org.apache.gravitino.utils.NameIdentifierUtil;
@@ -66,6 +67,12 @@ public class GrantUserRolesEvent extends UserEvent {
return roles;
}
+ /** {@inheritDoc} */
+ @Override
+ public Map<String, String> customInfo() {
+ return RoleAssignmentAuditInfos.of(roles);
+ }
+
/**
* Returns the operation type of this event.
*
diff --git
a/core/src/main/java/org/apache/gravitino/listener/api/event/GrantUserRolesFailureEvent.java
b/core/src/main/java/org/apache/gravitino/listener/api/event/GrantUserRolesFailureEvent.java
index 5db68065bc..2cf48293e1 100644
---
a/core/src/main/java/org/apache/gravitino/listener/api/event/GrantUserRolesFailureEvent.java
+++
b/core/src/main/java/org/apache/gravitino/listener/api/event/GrantUserRolesFailureEvent.java
@@ -20,6 +20,7 @@
package org.apache.gravitino.listener.api.event;
import java.util.List;
+import java.util.Map;
import org.apache.gravitino.annotation.DeveloperApi;
import org.apache.gravitino.utils.NameIdentifierUtil;
@@ -65,6 +66,12 @@ public class GrantUserRolesFailureEvent extends
UserFailureEvent {
return roles;
}
+ /** {@inheritDoc} */
+ @Override
+ public Map<String, String> customInfo() {
+ return RoleAssignmentAuditInfos.of(roles);
+ }
+
/**
* Returns the operation type of this event.
*
diff --git
a/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeGroupRolesEvent.java
b/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeGroupRolesEvent.java
index 48f928a821..6a7af8106c 100644
---
a/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeGroupRolesEvent.java
+++
b/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeGroupRolesEvent.java
@@ -21,6 +21,7 @@ package org.apache.gravitino.listener.api.event;
import com.google.common.collect.ImmutableList;
import java.util.List;
+import java.util.Map;
import org.apache.gravitino.annotation.DeveloperApi;
import org.apache.gravitino.listener.api.info.GroupInfo;
import org.apache.gravitino.utils.NameIdentifierUtil;
@@ -66,6 +67,12 @@ public class RevokeGroupRolesEvent extends GroupEvent {
return roles;
}
+ /** {@inheritDoc} */
+ @Override
+ public Map<String, String> customInfo() {
+ return RoleAssignmentAuditInfos.of(roles);
+ }
+
/**
* Returns the operation type of this event.
*
diff --git
a/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeGroupRolesFailureEvent.java
b/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeGroupRolesFailureEvent.java
index 08f7f99662..8d1d993fce 100644
---
a/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeGroupRolesFailureEvent.java
+++
b/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeGroupRolesFailureEvent.java
@@ -20,6 +20,7 @@
package org.apache.gravitino.listener.api.event;
import java.util.List;
+import java.util.Map;
import org.apache.gravitino.annotation.DeveloperApi;
import org.apache.gravitino.utils.NameIdentifierUtil;
@@ -71,6 +72,12 @@ public class RevokeGroupRolesFailureEvent extends
GroupFailureEvent {
return roles;
}
+ /** {@inheritDoc} */
+ @Override
+ public Map<String, String> customInfo() {
+ return RoleAssignmentAuditInfos.of(roles);
+ }
+
/**
* Returns the operation type of this event.
*
diff --git
a/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeUserRolesEvent.java
b/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeUserRolesEvent.java
index 94d0450f05..76091ab704 100644
---
a/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeUserRolesEvent.java
+++
b/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeUserRolesEvent.java
@@ -21,6 +21,7 @@ package org.apache.gravitino.listener.api.event;
import com.google.common.collect.ImmutableList;
import java.util.List;
+import java.util.Map;
import org.apache.gravitino.annotation.DeveloperApi;
import org.apache.gravitino.listener.api.info.UserInfo;
import org.apache.gravitino.utils.NameIdentifierUtil;
@@ -66,6 +67,12 @@ public class RevokeUserRolesEvent extends UserEvent {
return roles;
}
+ /** {@inheritDoc} */
+ @Override
+ public Map<String, String> customInfo() {
+ return RoleAssignmentAuditInfos.of(roles);
+ }
+
/**
* Returns the operation type of this event.
*
diff --git
a/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeUserRolesFailureEvent.java
b/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeUserRolesFailureEvent.java
index d64d02e794..4f25e51395 100644
---
a/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeUserRolesFailureEvent.java
+++
b/core/src/main/java/org/apache/gravitino/listener/api/event/RevokeUserRolesFailureEvent.java
@@ -20,6 +20,7 @@
package org.apache.gravitino.listener.api.event;
import java.util.List;
+import java.util.Map;
import org.apache.gravitino.annotation.DeveloperApi;
import org.apache.gravitino.utils.NameIdentifierUtil;
@@ -66,6 +67,12 @@ public class RevokeUserRolesFailureEvent extends
UserFailureEvent {
return roles;
}
+ /** {@inheritDoc} */
+ @Override
+ public Map<String, String> customInfo() {
+ return RoleAssignmentAuditInfos.of(roles);
+ }
+
/**
* Returns the operation type of this event.
*
diff --git
a/core/src/main/java/org/apache/gravitino/listener/api/event/RoleAssignmentAuditInfos.java
b/core/src/main/java/org/apache/gravitino/listener/api/event/RoleAssignmentAuditInfos.java
new file mode 100644
index 0000000000..e559109d7a
--- /dev/null
+++
b/core/src/main/java/org/apache/gravitino/listener/api/event/RoleAssignmentAuditInfos.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.gravitino.listener.api.event;
+
+import com.google.common.collect.ImmutableMap;
+import java.util.List;
+import java.util.Map;
+import javax.annotation.Nullable;
+
+/** Shared customInfo keys and values for role assignment audit events. */
+final class RoleAssignmentAuditInfos {
+
+ static final String ROLE_NAMES = "roleNames";
+
+ private RoleAssignmentAuditInfos() {}
+
+ static Map<String, String> of(@Nullable List<String> roles) {
+ if (roles == null || roles.isEmpty()) {
+ return ImmutableMap.of();
+ }
+ return ImmutableMap.of(ROLE_NAMES, String.join(",", roles));
+ }
+}
diff --git
a/core/src/test/java/org/apache/gravitino/audit/v2/TestSimpleAuditLogV2.java
b/core/src/test/java/org/apache/gravitino/audit/v2/TestSimpleAuditLogV2.java
index 233d28b009..8c68859ef1 100644
--- a/core/src/test/java/org/apache/gravitino/audit/v2/TestSimpleAuditLogV2.java
+++ b/core/src/test/java/org/apache/gravitino/audit/v2/TestSimpleAuditLogV2.java
@@ -19,12 +19,14 @@
package org.apache.gravitino.audit.v2;
+import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import java.util.Map;
import org.apache.gravitino.NameIdentifier;
import org.apache.gravitino.Namespace;
import org.apache.gravitino.listener.api.event.Event;
import org.apache.gravitino.listener.api.event.EventSource;
+import org.apache.gravitino.listener.api.event.GrantUserRolesFailureEvent;
import org.apache.gravitino.listener.api.event.ListCatalogEvent;
import org.apache.gravitino.listener.api.event.ListMetalakeEvent;
import org.apache.gravitino.listener.api.event.ListSchemaEvent;
@@ -68,6 +70,20 @@ public class TestSimpleAuditLogV2 {
Assertions.assertEquals("", fields[7], "Last field should be empty when
customInfo is absent");
}
+ @Test
+ public void testRoleAssignmentIncludesRoleNames() {
+ GrantUserRolesFailureEvent event =
+ new GrantUserRolesFailureEvent(
+ "admin",
+ "metalake",
+ new RuntimeException("failed"),
+ "alice",
+ ImmutableList.of("reader", "admin"));
+
+ String customInfo = new SimpleAuditLogV2(event).toString().split("\\t",
-1)[7];
+ Assertions.assertEquals("{roleNames=reader,admin}", customInfo);
+ }
+
@Test
public void testOutputContainsAllCoreFields() {
SimpleAuditLogV2 log = new SimpleAuditLogV2(new StubEvent());
diff --git
a/core/src/test/java/org/apache/gravitino/listener/api/event/TestGroupEvent.java
b/core/src/test/java/org/apache/gravitino/listener/api/event/TestGroupEvent.java
index b69a0dcae9..2e4878462d 100644
---
a/core/src/test/java/org/apache/gravitino/listener/api/event/TestGroupEvent.java
+++
b/core/src/test/java/org/apache/gravitino/listener/api/event/TestGroupEvent.java
@@ -452,6 +452,8 @@ public class TestGroupEvent {
GrantGroupRolesEvent grantGroupRolesEvent = (GrantGroupRolesEvent) event;
Assertions.assertEquals(
NameIdentifierUtil.ofGroup(METALAKE, groupName),
grantGroupRolesEvent.identifier());
+ Assertions.assertEquals(
+ String.join(",", grantedRoles),
grantGroupRolesEvent.customInfo().get("roleNames"));
GroupInfo groupInfo = grantGroupRolesEvent.grantedGroupInfo();
validateGroup(groupInfo, group);
@@ -474,6 +476,8 @@ public class TestGroupEvent {
NameIdentifierUtil.ofGroup(METALAKE, groupName),
grantGroupRolesFailureEvent.identifier());
Assertions.assertEquals(groupName,
grantGroupRolesFailureEvent.groupName());
Assertions.assertEquals(grantedRoles, grantGroupRolesFailureEvent.roles());
+ Assertions.assertEquals(
+ String.join(",", grantedRoles),
grantGroupRolesFailureEvent.customInfo().get("roleNames"));
}
@Test
@@ -508,6 +512,8 @@ public class TestGroupEvent {
RevokeGroupRolesEvent revokeGroupRolesEvent = (RevokeGroupRolesEvent)
event;
Assertions.assertEquals(
NameIdentifierUtil.ofGroup(METALAKE, otherGroupName),
revokeGroupRolesEvent.identifier());
+ Assertions.assertEquals(
+ String.join(",", revokedRoles),
revokeGroupRolesEvent.customInfo().get("roleNames"));
GroupInfo groupInfo = revokeGroupRolesEvent.revokedGroupInfo();
validateGroup(groupInfo, otherGroup);
@@ -532,6 +538,8 @@ public class TestGroupEvent {
revokeGroupRolesFailureEvent.identifier());
Assertions.assertEquals(otherGroupName,
revokeGroupRolesFailureEvent.groupName());
Assertions.assertEquals(revokedRoles,
revokeGroupRolesFailureEvent.roles());
+ Assertions.assertEquals(
+ String.join(",", revokedRoles),
revokeGroupRolesFailureEvent.customInfo().get("roleNames"));
}
private Group getMockGroup(String name, List<String> roles) {
diff --git
a/core/src/test/java/org/apache/gravitino/listener/api/event/TestUserEvent.java
b/core/src/test/java/org/apache/gravitino/listener/api/event/TestUserEvent.java
index c6574a140e..c6bdb9d6e0 100644
---
a/core/src/test/java/org/apache/gravitino/listener/api/event/TestUserEvent.java
+++
b/core/src/test/java/org/apache/gravitino/listener/api/event/TestUserEvent.java
@@ -393,6 +393,8 @@ public class TestUserEvent {
GrantUserRolesEvent grantUserRolesEvent = (GrantUserRolesEvent) event;
Assertions.assertEquals(identifier, grantUserRolesEvent.identifier());
+ Assertions.assertEquals(
+ String.join(",", grantedRoles),
grantUserRolesEvent.customInfo().get("roleNames"));
UserInfo userInfo = grantUserRolesEvent.grantUserInfo();
validateUserInfo(userInfo, user);
@@ -416,6 +418,8 @@ public class TestUserEvent {
grantUserRolesFailureEvent.identifier());
Assertions.assertEquals(inExistUserName,
grantUserRolesFailureEvent.userName());
Assertions.assertEquals(grantedRoles, grantUserRolesFailureEvent.roles());
+ Assertions.assertEquals(
+ String.join(",", grantedRoles),
grantUserRolesFailureEvent.customInfo().get("roleNames"));
}
@Test
@@ -447,6 +451,8 @@ public class TestUserEvent {
RevokeUserRolesEvent revokeUserRolesEvent = (RevokeUserRolesEvent) event;
Assertions.assertEquals(otherIdentifier,
revokeUserRolesEvent.identifier());
+ Assertions.assertEquals(
+ String.join(",", revokedRoles),
revokeUserRolesEvent.customInfo().get("roleNames"));
UserInfo userInfo = revokeUserRolesEvent.revokedUserInfo();
validateUserInfo(userInfo, otherUser);
@@ -470,6 +476,8 @@ public class TestUserEvent {
revokeUserRolesFailureEvent.identifier());
Assertions.assertEquals(inExistUserName,
revokeUserRolesFailureEvent.userName());
Assertions.assertEquals(revokedRoles, revokeUserRolesFailureEvent.roles());
+ Assertions.assertEquals(
+ String.join(",", revokedRoles),
revokeUserRolesFailureEvent.customInfo().get("roleNames"));
}
private AccessControlEventDispatcher mockUserDispatcher() {
