bharos opened a new pull request, #13511:
URL: https://github.com/apache/gravitino/pull/13511
### What changes were proposed in this pull request?
Adds the `ACCESS_CONTROL` built-in policy type (wire name
`system_access_control`) and
its content class `AccessControlContent`, constructed through
`PolicyContents.accessControl(...)`.
The content carries two fields:
- `privileges` — the privileges the rule confers on an object the tag is
applied to.
- `applicableRoles` — the roles that satisfy the rule's condition. These are
a
*condition* on the caller's roles, not the principals the privilege is
granted to.
Two invariants are enforced in the class:
- `PERMITTED_PRIVILEGES` is an explicit allowlist rather than a denylist, so
the
boundary fails closed: a privilege added to `Privilege.Name` later confers
nothing
through a tag until it is listed here deliberately. `USE_CATALOG` and
`USE_SCHEMA`
are excluded on purpose — traversal stays RBAC, so a tag can only widen
access
inside territory a role can already reach.
- `supportedObjectTypes()` is the union of `canBindTo` over
`PERMITTED_PRIVILEGES`,
minus `METALAKE`.
This is the API surface only. Nothing reads it yet: no authorizer change, no
enforcement, no REST path.
**This is part 1 of M1** in the milestone table of the design doc. The rest
of M1 —
the content DTO, the `DTOConverters` branches, and the derived
policy-to-role record
written on create and update — follows in separate PRs. Until the DTO lands,
`system_access_control` is accepted by `fromPolicyType` but is not creatable
over
REST.
**Draft, and it should not merge ahead of the design doc.** It depends on
decisions
still open in #12757 — OQ-3 in particular (what happens when a referenced
role is
deleted), which settles whether `validate()` should require the role to
exist.
### Why are the changes needed?
Tag-based access control needs a policy content type before a rule can be
authored,
stored or evaluated. Every later milestone rests on this shape.
Fix: #13510
### Does this PR introduce _any_ user-facing change?
New public API in the `api` module:
- `Policy.BuiltInType.ACCESS_CONTROL`, wire name `system_access_control`
- `AccessControlContent`, with `privileges()` and `applicableRoles()`
- `PolicyContents.accessControl(List<Privilege.Name>, List<String>)`
No property keys are added and no existing behaviour changes. The type is not
reachable over REST yet.
### How was this patch tested?
Unit tests in `TestPolicyContents` and `TestPolicyBuiltInType`, covering:
- every privilege in `PERMITTED_PRIVILEGES` is accepted, and privileges
outside it —
including `USE_CATALOG` and `USE_SCHEMA` — are rejected
- `privileges` and `applicableRoles` reject null, empty, blank and
empty-string
entries
- `supportedObjectTypes()` is recomputed from `PERMITTED_PRIVILEGES` in the
test
rather than asserted against a hardcoded set, so the two cannot drift apart
silently
- equality and the built-in type name mapping in both directions
```
./gradlew :api:test --tests '*TestPolicyContents*' --tests
'*TestPolicyBuiltInType*'
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
