This is an automated email from the ASF dual-hosted git repository.
collado pushed a commit to branch mcollado-catalog-admin-revoke
in repository https://gitbox.apache.org/repos/asf/polaris.git
The following commit(s) were added to refs/heads/mcollado-catalog-admin-revoke
by this push:
new b75d424802 Fixed name collisions in integration test
b75d424802 is described below
commit b75d424802349347c5a788f3e40efafd8c7c2f20
Author: Michael Collado <[email protected]>
AuthorDate: Mon Mar 9 16:02:30 2026 -0700
Fixed name collisions in integration test
---
.../PolarisManagementServiceIntegrationTest.java | 35 ++++++++++++----------
1 file changed, 19 insertions(+), 16 deletions(-)
diff --git
a/integration-tests/src/main/java/org/apache/polaris/service/it/test/PolarisManagementServiceIntegrationTest.java
b/integration-tests/src/main/java/org/apache/polaris/service/it/test/PolarisManagementServiceIntegrationTest.java
index 532f7b6838..822fd5c04d 100644
---
a/integration-tests/src/main/java/org/apache/polaris/service/it/test/PolarisManagementServiceIntegrationTest.java
+++
b/integration-tests/src/main/java/org/apache/polaris/service/it/test/PolarisManagementServiceIntegrationTest.java
@@ -1752,12 +1752,12 @@ public class PolarisManagementServiceIntegrationTest {
// Create a second principal role. Use the catalog admin principal to list
principal roles and
// grant a catalog role to the new principal role
- String principalRoleName2 = "mypr2";
+ String principalRoleName2 =
client.newEntityName("mypr2_catalog_admin_grant_revoke");
PrincipalRole principalRole2 = new PrincipalRole(principalRoleName2);
managementApi.createPrincipalRole(principalRole2);
// create a catalog role and grant it manage_content privilege
- String catalogRoleName = "mycr1";
+ String catalogRoleName =
client.newEntityName("mycr1_catalog_admin_grant_revoke");
client.managementApi(catalogAdminToken).createCatalogRole(catalogName,
catalogRoleName);
CatalogPrivilege privilege = CatalogPrivilege.CATALOG_MANAGE_CONTENT;
@@ -1861,7 +1861,7 @@ public class PolarisManagementServiceIntegrationTest {
String catalogAdminToken = client.obtainToken(catalogAdminPrincipal);
- // service_admin revokes the catalog_admin privilege from its principal
role
+ // service_admin revokes the catalog_admin privilege from its own
principal role
try {
try (Response response =
managementApi
@@ -1874,10 +1874,11 @@ public class PolarisManagementServiceIntegrationTest {
.returns(Response.Status.NO_CONTENT.getStatusCode(),
Response::getStatus);
}
- // the service_admin can not revoke the catalog_admin privilege from the
new principal role
+ // After revoking its own catalog_admin, service_admin can no longer
revoke the
+ // catalog_admin privilege from the new principal role because it no
longer has
+ // CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE (which comes from having
catalog_admin)
try (Response response =
- client
- .managementApi(catalogAdminToken)
+ managementApi
.request(
"v1/principal-roles/"
+ principalRoleName
@@ -1929,7 +1930,7 @@ public class PolarisManagementServiceIntegrationTest {
managementApi.createCatalog(catalog2);
// create a catalog role *in the second catalog* and grant it
manage_content privilege
- String catalogRoleName = "mycr1";
+ String catalogRoleName = client.newEntityName("mycr1_wrong_catalog");
managementApi.createCatalogRole(catalogName2, catalogRoleName);
// Get the catalog admin role from the *first* catalog and grant that role
to the principal role
@@ -1981,7 +1982,8 @@ public class PolarisManagementServiceIntegrationTest {
managementApi.createCatalog(catalog);
// create a valid target CatalogRole in this catalog
- managementApi.createCatalogRole(catalogName, "target_catalog_role");
+ String targetCatalogRoleName = client.newEntityName("target_catalog_role");
+ managementApi.createCatalogRole(catalogName, targetCatalogRoleName);
// create a second catalog
String catalogName2 = client.newEntityName("anothertablemanagecatalog");
@@ -1995,17 +1997,18 @@ public class PolarisManagementServiceIntegrationTest {
managementApi.createCatalog(catalog2);
// create an *invalid* target CatalogRole in second catalog
- managementApi.createCatalogRole(catalogName2,
"invalid_target_catalog_role");
+ String invalidTargetCatalogRoleName =
client.newEntityName("invalid_target_catalog_role");
+ managementApi.createCatalogRole(catalogName2,
invalidTargetCatalogRoleName);
// create the namespace "c" in *both* namespaces
- String namespaceName = "c";
+ String namespaceName = client.newEntityName("c");
catalogApi.createNamespace(catalogName, namespaceName);
catalogApi.createNamespace(catalogName2, namespaceName);
// create a catalog role *in the first catalog* and grant it
manage_content privilege at the
// namespace level
// grant that role to the PrincipalRole
- String catalogRoleName = "ns_manage_access_role";
+ String catalogRoleName = client.newEntityName("ns_manage_access_role");
managementApi.createCatalogRole(catalogName, catalogRoleName);
managementApi.addGrant(
catalogName,
@@ -2034,7 +2037,7 @@ public class PolarisManagementServiceIntegrationTest {
.managementApi(manageAccessUserToken)
.addGrant(
catalogName,
- "target_catalog_role",
+ targetCatalogRoleName,
new NamespaceGrant(
List.of(namespaceName),
NamespacePrivilege.TABLE_CREATE,
@@ -2050,7 +2053,7 @@ public class PolarisManagementServiceIntegrationTest {
.managementApi(manageAccessUserToken)
.request("v1/principal-roles/" + principalRoleName +
"/catalog-roles/" + catalogName)
.put(
- Entity.json(new GrantCatalogRoleRequest(new
CatalogRole("target_catalog_role"))))) {
+ Entity.json(new GrantCatalogRoleRequest(new
CatalogRole(targetCatalogRoleName))))) {
assertThat(response).returns(FORBIDDEN.getStatusCode(),
Response::getStatus);
}
@@ -2060,7 +2063,7 @@ public class PolarisManagementServiceIntegrationTest {
.managementApi(manageAccessUserToken)
.request(
"v1/catalogs/{cat}/catalog-roles/{role}/grants",
- Map.of("cat", catalogName, "role", "target_catalog_role"))
+ Map.of("cat", catalogName, "role", targetCatalogRoleName))
.put(
Entity.json(
new CatalogGrant(
@@ -2076,7 +2079,7 @@ public class PolarisManagementServiceIntegrationTest {
.managementApi(manageAccessUserToken)
.request(
"v1/catalogs/{cat}/catalog-roles/{role}/grants",
- Map.of("cat", catalogName2, "role",
"invalid_target_catalog_role"))
+ Map.of("cat", catalogName2, "role",
invalidTargetCatalogRoleName))
.put(
Entity.json(
new NamespaceGrant(
@@ -2092,7 +2095,7 @@ public class PolarisManagementServiceIntegrationTest {
.managementApi(manageAccessUserToken)
.request(
"v1/catalogs/{cat}/catalog-roles/{role}/grants",
- Map.of("cat", catalogName2, "role",
"invalid_target_catalog_role"))
+ Map.of("cat", catalogName2, "role",
invalidTargetCatalogRoleName))
.put(
Entity.json(
new CatalogGrant(
