nevzheng opened a new pull request, #14254:
URL: https://github.com/apache/gravitino/pull/14254
### What changes were proposed in this pull request?
The Iceberg REST hook dispatchers now follow the core hooks on drop:
- **`IcebergTableHookDispatcher#dropTable`** (drop and purge) reads the
table locations before the
backend drop. After the drop and the existing entity and orphan-schema
cleanup, it calls
`AuthorizationUtils.authorizationPluginRemovePrivileges(table, TABLE,
locations)`, like
`TableHookDispatcher#dropTable`. That call also evicts the cached name-id
mapping.
- **`IcebergNamespaceHookDispatcher#dropNamespace`** does the same for the
namespace (SCHEMA), like
`SchemaHookDispatcher#dropSchema`.
- **`IcebergViewHookDispatcher#dropView`** calls
`AuthorizationUtils.notifyEntityNameIdMappingChange`,
like `ViewHookDispatcher#dropView`. Views have no plugin privileges.
A failed backend drop throws before these calls, so the privileges are kept.
### Why are the changes needed?
**Drops through Iceberg REST left plugin privileges in place.** The
Gravitino entity was removed, but
the authorization plugins were never told, and the name-id cache was not
evicted. A table or namespace
created later under the same name was covered by the old plugin policies.
The same drops through the
Gravitino REST API remove them.
Fix: #14253
### Does this PR introduce _any_ user-facing change?
Yes, with an authorization plugin configured: a drop through Iceberg REST
now removes the plugin
privileges for the dropped table or namespace. When authorization is
disabled, the new calls are
no-ops, as in core. If the plugin call fails after a successful backend
drop, the error is returned,
as in core.
### How was this patch tested?
New cases in `TestIcebergTableHookDispatcher`,
`TestIcebergViewHookDispatcher` and
`TestIcebergNamespaceHookDispatcher` (`AuthorizationUtils` mocked
statically):
- **Positive:** table drop and purge (parameterized on `purgeRequested`,
nested namespace, locations
passed through), namespace drop (nested namespace), view drop (name-id
mapping evicted, no plugin
removal), and a plugin failure that propagates after the entity cleanup.
- **Negative:** a failed backend drop of a table, view or namespace makes no
plugin call.
- **On `main`:** 5 of the new cases fail (table drop x2, plugin-failure
propagation, namespace drop,
view eviction). The 3 negative cases pass.
- **With the fix:** all pass (58 tests in the three hook suites).
`TestIcebergAsyncPurge`,
`TestIcebergTableOperationExecutor` and `TestRESTService` also pass.
`./gradlew -PskipITs :iceberg:iceberg-rest-server:test --tests
'org.apache.gravitino.iceberg.service.dispatcher.TestIceberg*HookDispatcher'`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
