roryqi commented on code in PR #13863:
URL: https://github.com/apache/gravitino/pull/13863#discussion_r4280494201
##########
clients/client-java/src/test/java/org/apache/gravitino/client/integration/test/authorization/TagOperationsAuthorizationIT.java:
##########
@@ -281,6 +284,32 @@ public void testListTagByMetadata() {
String[] tagsLoadByNormalUser = tableSupportTagByNormalUser.listTags();
Arrays.sort(tagsLoadByNormalUser);
assertArrayEquals(new String[] {"tag2", "tag3"}, tagsLoadByNormalUser);
+
+ RESTClient restClient = getNormalUserRestClient();
+ String path =
+ "api/metalakes/" + METALAKE + "/objects/table/" + CATALOG + "." +
SCHEMA + ".table1/tags";
+ TagNameListResponse nameListResponse =
+ restClient.get(
+ path,
+ TagNameListResponse.class,
+ Map.of(),
+ error -> {
+ throw new AssertionError(error);
+ });
+ Assertions.assertEquals(2, nameListResponse.getNames().length);
+ Assertions.assertTrue(nameListResponse.hasInaccessibleTags());
Review Comment:
Addressed in a4c8f52f62. Added real authorization coverage for both response
modes using two distinct objects: an untagged catalog returns empty arrays with
`hasInaccessibleTags=false`, while a table whose only effective tag is
inherited and inaccessible returns empty arrays with
`hasInaccessibleTags=true`. `TagOperationsAuthorizationIT` passes with Docker
tests enabled.
##########
server/src/test/java/org/apache/gravitino/server/web/rest/TestMetadataObjectPolicyOperations.java:
##########
@@ -390,14 +395,18 @@ public void testListPoliciesFiltersResolvedResult()
throws IllegalAccessExceptio
operations.listPoliciesForMetadataObject(
metalake, table.type().toString(), table.fullName(), true);
Assertions.assertEquals(Response.Status.OK.getStatusCode(),
detailsResponse.getStatus());
- Assertions.assertEquals(
- 0, ((PolicyListResponse)
detailsResponse.getEntity()).getPolicies().length);
+ MetadataObjectPolicyListResponse details =
+ (MetadataObjectPolicyListResponse) detailsResponse.getEntity();
+ Assertions.assertEquals(0, details.getPolicies().length);
+ Assertions.assertTrue(details.hasInaccessiblePolicies());
Review Comment:
Addressed in a4c8f52f62. Added `PolicyAuthorizationIT` coverage through the
real tag-to-policy resolution and authorization path. It verifies all-hidden
and mixed-visible results, including both arrays and `hasInaccessiblePolicies`,
for names and details responses. Both `PolicyAuthorizationIT` and
`TagOperationsAuthorizationIT` pass with Docker tests enabled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
