yuqi1129 opened a new pull request, #13293:
URL: https://github.com/apache/gravitino/pull/13293
### What changes were proposed in this pull request?
Fence the metalake and the owner principal (User/Group) inside the
`setOwner`/`batchSetOwners` transaction on the identity the caller observed,
and tighten `owner_meta` to one live owner per object.
- `OwnerMetaService`: both assignment paths run through one transaction that
holds the metalake and the principal `FOR SHARE` (exclusive on H2), checks the
principal's metalake and name, retires the previous owner rows and inserts the
new ones. A missing, deleted, same-name-recreated or foreign-metalake principal
fails as not found. Batches write in stable object-id order.
- `owner_meta` unique key becomes `uk_mi_mo_del (metadata_object_id,
metadata_object_type, deleted_at)`. Two initial assignments that cannot see
each other's row now collide on the key; the loser is replayed once so it
retires the row it could not see ("last assignment wins").
- `upgrade-1.3.0-to-2.0.0-*.sql` merges duplicate live owners (largest id
kept, others soft-deleted) before swapping the key. `schema-2.0.0-*.sql`
updated for H2/MySQL/PostgreSQL.
- `UserMetaMapper`/`GroupMetaMapper` gain `selectXxxMetaByIdForShare`, same
shape as the Role fence in #13006.
### Why are the changes needed?
`setOwner` resolved the principal id before the transaction and never locked
it. Another server could delete the User/Group and finish its `owner_meta`
cleanup before the assignment inserted, leaving a live row pointing at a
deleted principal; a same-name recreate could be hit by the stale id. The old
unique key included `owner_id`, so two concurrent initial assignments left two
live owners and `getOwner` returned whichever came first. Part of the TreeLock
removal plan (#10238, design M2).
Fix: #13002
### Does this PR introduce _any_ user-facing change?
No API change. Assigning an owner whose principal was deleted or replaced
concurrently now fails with the existing not-found error instead of writing an
invalid relation. `owner_meta` gets a new unique key via the 2.0.0 upgrade
script; pre-existing duplicate live owners are merged to the newest one.
### How was this patch tested?
- New `TestOwnerAssignmentWrites` (7 cases, User and Group): assignment
waits for an uncommitted principal delete and fails; delete waits for an
uncommitted assignment and cleans it; stale id after same-name recreate is
rejected and a fresh lookup succeeds; two initial and two re-assignments leave
exactly one live owner; batch rolls back when the principal is deleted and
succeeds when the delete rolls back. Each case drives two real transactions and
observes the blocker on the database side.
- `TestSQLScripts#testUpgradeToTwoZeroMergesDuplicateLiveOwners`: duplicate
live owners on a 1.3.0 schema are merged by the upgrade and the new key rejects
a second live owner.
- H2: `storage.relational.*`, `authorization.*`, `TestSQLScripts` — 730
tests green; spotless and javadoc pass. MySQL/PostgreSQL could not be exercised
locally (JVM cannot reach container IPs on this machine) and rely on CI.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
