yuqi1129 opened a new pull request, #13790:
URL: https://github.com/apache/gravitino/pull/13790
### What changes were proposed in this pull request?
Add a design document for replacing JCasbin in the built-in authorizer. It
describes:
- The current JCasbin model and its problems: an O(total policies) scan per
probe, shared
user-to-role grouping rows, in-place policy reload under a global lock,
string-row DENY
checks, and dependency weight.
- Immutable per-role `PolicyKey -> Effect` indexes and a request-local
`RequestRolePolicies`
view, with global DENY precedence and active-role narrowing for ALLOW.
- Generation-based publication and invalidation, adaptive merging for long
lists, and
fail-closed handling of unreadable roles.
- Alternatives considered, compatibility, verification, risks, and task
breakdown.
The implementation is in #12286.
### Why are the changes needed?
Reviewers asked for a design before reviewing #12286.
Fix: #13789
### Does this PR introduce _any_ user-facing change?
No. This pull request adds design documentation only.
### How was this patch tested?
- `python3 .claude/skills/gravitino-docs-refine/scripts/check_links.py
design-docs/gravitino-authorization-without-jcasbin.md`
- `git diff --check`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
