nevzheng commented on issue #13083: URL: https://github.com/apache/gravitino/issues/13083#issuecomment-5627323364
issue: @lasdf1234 @sunyuhan1998, could you coordinate the repair for this cross-change regression? Tracing the source history shows two interacting changes rather than a single faulty change: - @lasdf1234's #12983 introduced the intentional USE_SECRET gate and empty-on-denied credential response. Its final test repair updated Spark coverage but left the Cloud Filesystem authorization tests on the prior contract. - @sunyuhan1998's #10791 introduced Python GVFS credential caching, including indefinite caching of an empty credential list. Together, a caller denied USE_SECRET can receive an empty result, be granted USE_SECRET later, and still receive no credentials because the Python client does not re-contact the server. Requested ownership: - @lasdf1234: migrate the Cloud Filesystem authorization tests to scoped USE_SECRET, including missing/denied-permission coverage and a positive GCS assertion that a credential was actually vended. - @sunyuhan1998: make an empty credential response retryable (uncached or bounded negative TTL) and add a deny -> grant -> successful-vend regression test. The intended authorization policy should remain in place; the repair is the dependent test migration and safe client caching behavior. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
