yuqi1129 opened a new issue, #13001: URL: https://github.com/apache/gravitino/issues/13001
### Describe the subtask User/Group updates CAS the principal row but insert membership rows without fencing the referenced Role. A grant can resolve a Role, race with its deletion and cleanup, then insert an active membership to that deleted Role. Controlled reproductions confirm both principal types on H2, MySQL, and PostgreSQL. Joined reads filter deleted Roles; this finding does not establish an authorization bypass. Validate and fence newly referenced stable Role IDs in the membership transaction, with a lock order compatible with principal writes and metalake cascades. Review update, insert, and overwrite membership writers without changing overwrite into a CAS API. Acceptance: - Cover both winner orders, batch atomicity, same-name recreation, and missing/cross-metalake endpoints on all three SQL engines. - Preserve grant/revoke idempotency and define concurrent deletion outcomes under the existing error contract. - Do not leave an active membership referencing a deleted Role after both operations complete. Cleanup of existing orphan rows is a separate companion task. ### Parent issue https://github.com/apache/gravitino/issues/10238 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
