LuciferYang opened a new pull request, #13833: URL: https://github.com/apache/gravitino/pull/13833
### What changes were proposed in this pull request? Add parent-scope list short-circuits to `MetadataAuthzHelper.LIST_SHORT_CIRCUITS` for `VIEW`, `FUNCTION`, `FILESET`, `TOPIC` and `SEMANTIC_MODEL`, matching their filter expressions: - `VIEW`: owner, `SELECT_VIEW` - `FUNCTION`: owner, `EXECUTE_FUNCTION`, `MODIFY_FUNCTION` - `FILESET`: owner, `READ_FILESET`, `WRITE_FILESET` - `TOPIC`: owner, `CONSUME_TOPIC`, `PRODUCE_TOPIC` - `SEMANTIC_MODEL`: owner, `USE_SEMANTIC_MODEL`, `MODIFY_SEMANTIC_MODEL` Each privilege path is scoped to the metalake, catalog and schema and tracks its own deny privilege, as the existing entries do, so a possible deny still falls back to per-object checks. The map now has 13 entries, more than `Map.of` accepts, so it is built with `Map.ofEntries`; the existing entries are unchanged. ### Why are the changes needed? #11778 and #13300 added list short-circuits for tables, models and job templates; views, functions, filesets, topics and semantic models still have none. Without an entry, each listed object goes through the per-object filter. For an owner of the metalake, catalog or schema this is cheap, since the ancestor owner check is served from the per-request cache. A caller who holds only a parent-scope privilege still pays, per object, an owner lookup (metadata id and owner, a store read on cache miss) and a deny check, and listing filesets or topics also batch-loads every listed entity first. Measured against a local server with 1,000 objects in one schema and a user holding only schema-level `EXECUTE_FUNCTION` / `READ_FILESET`, a warm list went from about 170-220 ms to about 20 ms for both functions and filesets. Fix: #13832 ### Does this PR introduce _any_ user-facing change? No. List results are unchanged; only the evaluation path differs. ### How was this patch tested? New tests in `TestMetadataAuthzHelper`, one pair per type: a schema-level grant returns every object without per-object checks (for filesets and topics, also without touching the entity store), and a possible deny falls back to per-object checks while the short-circuit queries exactly that path's deny privilege. The deny tests use each entry's second privilege where it has one, so every privilege path is covered by a test. All ten fail against the code before this change. The latency numbers above come from a local benchmark that is not part of this PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
