yuqi1129 opened a new issue, #13178: URL: https://github.com/apache/gravitino/issues/13178
### Describe the subtask `PermissionManager.grantRolesToUser` and friends write the store first and call the authorization plugin (Ranger, …) second, and the only thing ordering two such calls is the per-JVM write lock on the user/group/role in `AccessControlManager`. On two servers the store can apply grant-then-revoke while Ranger applies revoke-then-grant, and nothing ever reads Ranger back, so the mismatch is permanent. This is the one place where removing TreeLock changes single-server behaviour with no replacement yet. Options: - (a) Target: carry the store version (or a generation) of the principal into the plugin call and have the plugin apply only when the version is newer than the last one it saw. - (b) Migration step: keep a small per-principal in-process guard behind the `doWithTreeLock` signature and document that two servers can still reorder. Deliverables: decision recorded in the design doc; implementation of (a) or (b); test with a delayed grant/revoke reorder. Design: implementation design Part 4 (S1). Gate G4. ### Parent issue https://github.com/apache/gravitino/issues/10238 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
