yuqi1129 commented on code in PR #13707:
URL: https://github.com/apache/gravitino/pull/13707#discussion_r4414036588
##########
server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java:
##########
@@ -488,6 +514,29 @@ public boolean hasDenyPolicy(
metalake,
requestContext,
() -> {
+ // The request holds these roles (direct + group-inherited);
inactive roles are
+ // included because a DENY remains in effect regardless of
active-role narrowing.
+ Set<String> heldRoleIds = roleSubjects(requestContext, false);
+
+ // A role whose securable objects could not all be resolved
installs only the rows it
+ // could resolve, so its deny rows may be missing. This method
answers an existence
+ // question — "can a DENY on these privileges hide one of the
listed objects?" — and
+ // missing rows can never prove the absence of a DENY, so a held
role with incomplete
+ // policies must be reported as possibly holding one. The caller
then falls back to
+ // per-object checks instead of the parent-scope short-circuit.
Note that this only
+ // disables that short-circuit: per-object evaluation is
unchanged, so an unresolvable
+ // DENY still cannot hide an object it never resolved to.
+ for (String roleId : heldRoleIds) {
+ if (incompleteRolePolicyIds.contains(roleId)) {
Review Comment:
Filed the remaining gap as #14379 and updated the PR description: it now
links #14379, says the list result is the same as with the short-circuit today,
and notes that since #13699 the marker only matters for a genuine NotFound.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
