yuqi1129 opened a new issue, #13789: URL: https://github.com/apache/gravitino/issues/13789
### What would you like to be improved? The built-in authorizer evaluates privileges with JCasbin. JCasbin scans every loaded policy on each probe, keeps user-to-role membership in shared grouping rows that concurrent requests of the same user can overwrite (#13748), and reloads role policies by mutating shared state under a global lock. #12286 replaces the JCasbin enforcer with immutable per-role policy indexes and request-local role views. Reviewers asked for a design document before reviewing the implementation. ### How should we improve? Add `design-docs/gravitino-authorization-without-jcasbin.md` covering: - How the authorizer uses JCasbin today and the problems with it. - Goals and non-goals; decisions and public APIs stay unchanged. - Alternatives considered, including keeping JCasbin with a request-aware matcher (#13747). - Core data structures, evaluation, loading, publication and invalidation, and complexity. - Compatibility, verification, risks, and task breakdown. Related: #12173, #12282, #12286, #13747, #13748. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
