(gravitino) branch branch-1.3 updated: [Cherry-pick to branch-1.3] [MINOR] refactor(server): Reuse the shared user and group authorization expressions (#12973) (#12974)

[jshao]

This is an automated email from the ASF dual-hosted git repository.

jerryshao pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git


The following commit(s) were added to refs/heads/branch-1.3 by this push:
     new 91a46b770f [Cherry-pick to branch-1.3] [MINOR] refactor(server): Reuse 
the shared user and group authorization expressions (#12973) (#12974)
91a46b770f is described below

commit 91a46b770f293207363079836d4fb10529871151
Author: github-actions[bot] 
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Tue Sep 8 14:06:13 2026 +0800

    [Cherry-pick to branch-1.3] [MINOR] refactor(server): Reuse the shared user 
and group authorization expressions (#12973) (#12974)
    
    **Cherry-pick Information:**
    - Original commit: eeb810a474124bb88d438fb57072bc16311e5ff5
    - Target branch: `branch-1.3`
    - Status: ✅ Clean cherry-pick (no conflicts)
    
    Co-authored-by: Qi Yu <y...@datastrato.com>
---
 .../authorization/expression/AuthorizationExpressionConstants.java  | 6 ++++++
 .../java/org/apache/gravitino/server/web/rest/GroupOperations.java  | 3 ++-
 .../java/org/apache/gravitino/server/web/rest/UserOperations.java   | 3 ++-
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git 
a/server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConstants.java
 
b/server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConstants.java
index 0bd9b23405..4f56ae2c4a 100644
--- 
a/server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConstants.java
+++ 
b/server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConstants.java
@@ -270,6 +270,12 @@ public class AuthorizationExpressionConstants {
           ((CAN_ACCESS_METADATA) && (TAG::OWNER || ANY_APPLY_TAG))
           """;
 
+  public static final String LOAD_USER_AUTHORIZATION_EXPRESSION =
+      "METALAKE::OWNER || METALAKE::MANAGE_USERS || USER::SELF";
+
+  public static final String LOAD_GROUP_AUTHORIZATION_EXPRESSION =
+      "METALAKE::OWNER || METALAKE::MANAGE_GROUPS || GROUP::SELF";
+
   public static final String LOAD_TAG_AUTHORIZATION_EXPRESSION =
       "METALAKE::OWNER || TAG::OWNER || ANY_APPLY_TAG";
 
diff --git 
a/server/src/main/java/org/apache/gravitino/server/web/rest/GroupOperations.java
 
b/server/src/main/java/org/apache/gravitino/server/web/rest/GroupOperations.java
index 48c901975c..f53b1158cc 100644
--- 
a/server/src/main/java/org/apache/gravitino/server/web/rest/GroupOperations.java
+++ 
b/server/src/main/java/org/apache/gravitino/server/web/rest/GroupOperations.java
@@ -52,6 +52,7 @@ import 
org.apache.gravitino.server.authorization.MetadataAuthzHelper;
 import org.apache.gravitino.server.authorization.NameBindings;
 import 
org.apache.gravitino.server.authorization.annotations.AuthorizationExpression;
 import 
org.apache.gravitino.server.authorization.annotations.AuthorizationMetadata;
+import 
org.apache.gravitino.server.authorization.expression.AuthorizationExpressionConstants;
 import org.apache.gravitino.server.web.Utils;
 import org.apache.gravitino.utils.NameIdentifierUtil;
 import org.slf4j.Logger;
@@ -64,7 +65,7 @@ public class GroupOperations {
   private static final Logger LOG = 
LoggerFactory.getLogger(GroupOperations.class);
 
   private static final String LOAD_GROUP_PRIVILEGE =
-      "METALAKE::OWNER || METALAKE::MANAGE_GROUPS || GROUP::SELF";
+      AuthorizationExpressionConstants.LOAD_GROUP_AUTHORIZATION_EXPRESSION;
 
   private final AccessControlDispatcher accessControlManager;
   private final OwnerDispatcher ownerDispatcher;
diff --git 
a/server/src/main/java/org/apache/gravitino/server/web/rest/UserOperations.java 
b/server/src/main/java/org/apache/gravitino/server/web/rest/UserOperations.java
index 96263a8edd..a7929b11ec 100644
--- 
a/server/src/main/java/org/apache/gravitino/server/web/rest/UserOperations.java
+++ 
b/server/src/main/java/org/apache/gravitino/server/web/rest/UserOperations.java
@@ -51,6 +51,7 @@ import 
org.apache.gravitino.server.authorization.MetadataAuthzHelper;
 import org.apache.gravitino.server.authorization.NameBindings;
 import 
org.apache.gravitino.server.authorization.annotations.AuthorizationExpression;
 import 
org.apache.gravitino.server.authorization.annotations.AuthorizationMetadata;
+import 
org.apache.gravitino.server.authorization.expression.AuthorizationExpressionConstants;
 import org.apache.gravitino.server.web.Utils;
 import org.apache.gravitino.utils.NameIdentifierUtil;
 import org.slf4j.Logger;
@@ -63,7 +64,7 @@ public class UserOperations {
   private static final Logger LOG = 
LoggerFactory.getLogger(UserOperations.class);
 
   private static final String LOAD_USER_PRIVILEGE =
-      "METALAKE::OWNER || METALAKE::MANAGE_USERS || USER::SELF";
+      AuthorizationExpressionConstants.LOAD_USER_AUTHORIZATION_EXPRESSION;
 
   private final AccessControlDispatcher accessControlManager;
   private final OwnerDispatcher ownerManager;