nevzheng opened a new pull request, #14256:
URL: https://github.com/apache/gravitino/pull/14256
### What changes were proposed in this pull request?
- **`IcebergTableHookDispatcher#renameTable`** reads the source table
locations before the backend
rename. After the rename and the entity update, it calls
`AuthorizationUtils.authorizationPluginRenamePrivileges(source, TABLE,
destination, locations)`, like
`TableHookDispatcher#alterTable`. That call also evicts the cached name-id
mapping.
- **`IcebergViewHookDispatcher#renameView`** calls
`authorizationPluginRenamePrivileges(source, VIEW, destination, null)`,
like
`ViewHookDispatcher#alterView`.
Both pass the full destination identifier, because an Iceberg REST rename
can move the object to
another namespace. A failed backend rename or entity update throws before
the call, so the privileges
stay on the name the Gravitino entity still has.
### Why are the changes needed?
**Renames through Iceberg REST left plugin privileges on the old name.**
Table-level grants did not
follow the table, so users were denied on the new name, and a new object
under the old name was
covered by the old policies. The same renames through the Gravitino REST API
rename them.
Fix: #14255
### Does this PR introduce _any_ user-facing change?
Yes, with an authorization plugin configured: a rename through Iceberg REST
now renames the plugin
privileges. When authorization is disabled, the new calls are no-ops, as in
core.
### How was this patch tested?
New cases in `TestIcebergTableHookDispatcher` and
`TestIcebergViewHookDispatcher`:
- **Positive:** table rename in the same namespace, to another namespace,
and from a nested to a flat
namespace (source and destination identifiers and locations checked); view
rename from a nested
namespace to another namespace.
- **Negative:** a failed backend rename (table and view) and a failed entity
update after the rename
make no plugin call.
- **On `main`:** the 4 positive cases fail. The 3 negative cases pass.
- **With the fix:** all pass (57 tests in the three hook suites).
`TestIcebergAsyncPurge`,
`TestIcebergTableOperationExecutor` and `TestRESTService` also pass.
`./gradlew -PskipITs :iceberg:iceberg-rest-server:test --tests
'org.apache.gravitino.iceberg.service.dispatcher.TestIceberg*HookDispatcher'`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
