yuqi1129 opened a new issue, #14379: URL: https://github.com/apache/gravitino/issues/14379
### Version main branch ### Describe what's wrong When a role loads, `JcasbinAuthorizer` resolves each securable object by the name read with the role entity. If the object is renamed between the role read and the resolution, the old name resolves to NotFound. The role then loads partially and the DENY row for the renamed object is missing until the partial-load retry (`PARTIAL_ROLE_LOAD_RETRY_MS`). During that window, the object is not hidden by the DENY, in both list and per-object checks. #13707 only disables the list short-circuit for such roles. It does not make the missing DENY effective. ### Error message and/or stacktrace No error. The log shows `Loaded role ... with N of M securable objects; unresolved objects: ...`. ### How to reproduce 1. Give a user a parent-scope ALLOW and a role with a DENY on table `t`. 2. Rename `t` to `t2` after the role entity is read and before its objects are resolved (for example, with a test hook in `resolveRolePolicies`). 3. List the tables or load `t2` before the retry. `t2` is visible. ### Additional context Follow-up of #13691 / #13707. Normalization failures are already covered by the catalog-scoped deny guard (#13699). This case is a genuine NotFound for an object that still exists under a new name. A possible fix is to resolve DENY objects by id instead of by name, or to treat a NotFound DENY like a normalization failure. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
