yuqi1129 commented on code in PR #13880:
URL: https://github.com/apache/gravitino/pull/13880#discussion_r4375580308
##########
core/src/main/java/org/apache/gravitino/storage/relational/po/RolePO.java:
##########
@@ -31,6 +33,17 @@ public class RolePO {
private Long lastVersion;
private Long deletedAt;
+ private List<SecurableObjectPO> securableObjectPOs = new ArrayList<>();
+
+ /**
+ * Returns privileges read in the same statement as this role.
+ *
+ * @return the privilege snapshot, or an empty list for metadata-only reads
+ */
+ public List<SecurableObjectPO> getSecurableObjectPOs() {
Review Comment:
Fixed in 2f925cb84d. Table/role/user/group PO collections now remain null on
metadata-only reads, while the aggregate result maps initialize loaded
collections, including empty ones. Nullable raw getters are reserved for mapper
access; full conversions and updater inputs use checked require-accessors with
the entity ID and an aggregate-mapper hint. A real-mapper H2 regression
distinguishes unloaded from loaded-empty collections and injects metadata-only
input into all four get/update paths to verify rejection before the updater
runs. The targeted H2/unit suites pass, and removing the table guard makes the
new test fail.
##########
core/src/main/java/org/apache/gravitino/storage/relational/service/RoleMetaService.java:
##########
@@ -514,7 +517,8 @@ public int deleteRoleMetasByLegacyTimeline(long
legacyTimeline, int limit) {
}
private static List<SecurableObject> listSecurableObjects(RolePO po) {
- List<SecurableObjectPO> securableObjectPOs =
listSecurableObjectsByRoleId(po.getRoleId());
+ // Full role conversions must use privileges from the same statement as
the role metadata.
+ List<SecurableObjectPO> securableObjectPOs = po.getSecurableObjectPOs();
Review Comment:
Addressed in 2f925cb84d. Removed the now test-only service wrapper and
changed the storage assertion to query SecurableObjectMapper directly. The raw
mapper/provider stay available. Both the audit document and PR description now
disclose that the listSecurableObjectsByRoleId service metric is no longer
emitted and point monitoring at the enclosing role-read operations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
