bharos opened a new pull request, #13901: URL: https://github.com/apache/gravitino/pull/13901
### What changes were proposed in this pull request? Adds the DTO layer for the `system_access_control` policy type introduced in #13511, so it can travel over REST. - `PolicyContentDTO.AccessControlContentDTO` — a new `@JsonSubTypes` entry registered under `system_access_control`, carrying `privileges` and `applicableRoles`. Validation and rule/property derivation delegate to the `AccessControlContent` domain object. - `DTOConverters` — conversion in both directions between `AccessControlContent` and the DTO. - `docs/open-api/policies.yaml` — an `AccessControlContent` schema plus `AccessControlPolicy`, `AccessControlPolicyCreateRequest`, and `UpdateAccessControlPolicyContentRequest`, wired into the three `oneOf`/discriminator blocks and excluded from the three `custom` `not: enum` lists. - `docs/policies.md` — table row and the "not enforced yet" note. ### Why are the changes needed? #13511 added `ACCESS_CONTROL` to `Policy.BuiltInType`, but no Jackson subtype is registered for `system_access_control`. A request carrying that policy type fails deserialization before it reaches a handler, so the type is currently unreachable over REST. This change makes it decode and round-trip. The OpenAPI spec is updated here because it is the published contract for that wire format. The `not: enum` lists matter in particular: they define `custom` as "any type not in this list", so omitting `system_access_control` would let a spec-driven client treat it as a valid custom type, which the Java rejects. Fix: #13510 ### Does this PR introduce _any_ user-facing change? Yes. `system_access_control` becomes a valid `policyType` in the policy create, get, and update-content payloads, with `privileges` and `applicableRoles` fields. The type is still not enforced — this adds only the wire representation. ### How was this patch tested? New unit tests: - `TestPolicyContentDTO` — rules, properties and supported object types; absent fields; and delegation of validation (unpermitted privilege, missing roles, missing privileges). - `TestPolicyDTO` — full `PolicyDTO` round-trip, plus a hand-written JSON case pinning the wire encoding of privilege names. - `TestDTOConverters` — both conversion directions and equality after a round-trip. `./gradlew :common:spotlessJavaCheck :common:test` passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
