bharos opened a new pull request, #13905: URL: https://github.com/apache/gravitino/pull/13905
### What changes were proposed in this pull request? Adds `USE_SEMANTIC_MODEL` to `AccessControlContent.PERMITTED_PRIVILEGES` and `SEMANTIC_MODEL` to its supported object types, and mirrors the privilege in the `AccessControlContent` enum in `docs/open-api/policies.yaml`. ### Why are the changes needed? The allowlist was written before the semantic model privileges existed (#12867) and before semantic models became taggable (#12870), so the omission is a rebase gap rather than a deliberate exclusion. `USE_SEMANTIC_MODEL` is "discover a semantic model and load its definition". That is strictly narrower than the already permitted `USE_MODEL`, and it acts only on the tagged object. Reading data through a referenced table still requires `SELECT_TABLE`, the same indirection the permitted `SELECT_VIEW` already has. `CREATE_SEMANTIC_MODEL` and `MODIFY_SEMANTIC_MODEL` stay excluded, since one creates an entity and the other changes what other principals execute. The allowlist fails closed, so nothing is broken today. A tag simply cannot confer the privilege. Adding `SEMANTIC_MODEL` also makes the comment above `SUPPORTED_OBJECT_TYPES` accurate again: the set is now exactly the types a tag can be applied to, minus `COLUMN`. Part of #13510 ### Does this PR introduce _any_ user-facing change? Yes. `USE_SEMANTIC_MODEL` is now accepted in the `privileges` list of an access control policy, and `SEMANTIC_MODEL` is reported by `supportedObjectTypes()`. The OpenAPI schema enum is updated to match. No property keys are added or removed. ### How was this patch tested? `TestPolicyContents.testAccessControlContentSupportedObjectTypes` is updated for the new object type. The existing `testAccessControlContentAcceptsEveryPermittedPrivilege`, `testAccessControlContentRejectsPrivilegesOutsideAllowlist` and `testAccessControlContentSupportedObjectTypesTrackPermittedPrivileges` iterate the enums or recompute the union through `canBindTo`, so they cover the addition without needing a change. ``` ./gradlew :api:spotlessJavaCheck :api:javadoc :api:test ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
