[#12594] feat(authz): Add Semantic Model ownership and privilege support - #12867
Open
laserninja wants to merge 1 commit into
Open
[#12594] feat(authz): Add Semantic Model ownership and privilege support#12867laserninja wants to merge 1 commit into
laserninja wants to merge 1 commit into
Conversation
…e support Introduce the CREATE_SEMANTIC_MODEL, SELECT_SEMANTIC_MODEL, and MODIFY_SEMANTIC_MODEL privileges together with their schema-level and object-level binding rules, and add SemanticModelHookDispatcher so the creator becomes the owner of a newly created Semantic Model. Semantic Models are managed entirely by Gravitino, so their privileges are not pushed down to catalog authorization plugins.
Code Coverage Report
Files
|
Collaborator
Author
|
CI is green except
Both look unrelated to this PR:
I do not have rights to re-run the single failed job. Happy to push a rebase to re-trigger the matrix if a committer prefers a clean run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Adds the authorization layer for Semantic Models, following the "Authorization and Governance" section of
design-docs/gravitino-semantic-model-design.md.Privileges (
api)CREATE_SEMANTIC_MODEL,SELECT_SEMANTIC_MODEL, andMODIFY_SEMANTIC_MODELinPrivilege.Name, plus the matchingPrivilegesclasses andallow/denyresolution.CREATE_SEMANTIC_MODELbinds to METALAKE, CATALOG, and SCHEMA (the scope it creates into);SELECT_SEMANTIC_MODELandMODIFY_SEMANTIC_MODELadditionally bind to SEMANTIC_MODEL.SecurableObjects.ofSemanticModel(...), andSEMANTIC_MODELadded toManageGrantsbindings so grant management can be delegated per Semantic Model, as it already can for every other schema-level object.AuthorizationUtils.checkPrivilegerejects the new privileges on non-relational catalogs, matchingSemanticModelOperationDispatcher, which only serves relational catalogs.Ownership (
core)SemanticModelHookDispatchersets the creator as owner after a successful create.SemanticModelHookDispatcher -> SemanticModelNormalizeDispatcher -> SemanticModelOperationDispatcher, with a TODO marking where [Subtask] Add event listener support for Semantic Model operations #12595's event dispatcher belongs.SemanticModelNormalizeDispatchercase-folds only the parent namespace against the catalog capability and applies Gravitino-owned naming to the model name, so reusingapplyCapabilities(ident, scope, catalogManager)the wayModelHookDispatcherdoes would attach the owner to a case-folded name the store never used.SEMANTIC_MODELadded toAuthorizationUtils.SKIP_APPLY_TYPES: Semantic Models exist only in Gravitino, so there is nothing for a catalog authorization plugin to grant, revoke, or rename.Authorization plumbing
AuthorizationExpressionConstants. Drop deliberately requires ownership rather thanMODIFY_SEMANTIC_MODEL, per the design doc.ANY_CREATE_SEMANTIC_MODEL,ANY_SELECT_SEMANTIC_MODEL, andANY_MODIFY_SEMANTIC_MODELtoken expansion inAuthorizationExpressionConverter, with deny taking precedence at every scope.SEMANTIC_MODELinCAN_ACCESS_METADATA, so the owner API accepts Semantic Model objects.MetadataObjectUtil.checkMetadataObject,EntityClassMapper,MetadataIdConvertercase-sensitivity scope, andJcasbinAuthorizationCacheKeysall handleSEMANTIC_MODEL.Docs
docs/security/access-control.md: object tree, privilege table, and required-privileges table.Why are the changes needed?
Semantic Models are new securable metadata objects. Without privileges and an ownership hook they would be created with no owner and no way to grant access, so the REST APIs in #12607 and #12608 have nothing to enforce.
Fix: #12594
Does this PR introduce any user-facing change?
Yes, additive only:
CREATE_SEMANTIC_MODEL,SELECT_SEMANTIC_MODEL,MODIFY_SEMANTIC_MODEL.SecurableObjects.ofSemanticModel(...)in the public API.SEMANTIC_MODELaccepted by the owner API and as aMANAGE_GRANTStarget.No existing privilege, wire format, or config default changes.
Follow-up
Two items in the issue's checklist depend on
SemanticModelMetaMapperandSemanticModelPO, which land in #12602/#12603, and are deferred to a follow-up PR:MetadataObjectService.TYPE_TO_FULLNAME_FUNCTION_MAPneeds agetSemanticModelObjectsFullNameentry to resolve a Semantic Model ID back to a full name when listing owned objects.OrphanedMetadataObjectRelationService.ENTITY_TABLESneeds a Semantic Model entry so owner relation rows are cleaned up after a hard delete.Neither is reachable on
maintoday:JDBCBackendstill stubs Semantic Model persistence, so no Semantic Model, and therefore no owner relation, can exist yet.How was this patch tested?
New tests:
TestSemanticModelHookDispatcher: owner assignment, namespace normalization versus Gravitino-owned naming, pass-through when the owner dispatcher is disabled, propagation whensetOwnerfails, and no owner interaction on list/load/alter/drop.TestSemanticModelAuthorizationExpression: create, load, filter, alter, and drop expressions, covering owner paths, theUSE_CATALOG+USE_SCHEMAchain, deny precedence, and the two negative cases that matter, namelySELECT_SEMANTIC_MODELnot permitting alter andMODIFY_SEMANTIC_MODELnot permitting drop.Extended:
TestSecurableObjects(binding matrix, allow/deny resolution, name-length validation),TestAuthorizationUtils(plugin is not notified for Semantic Models),TestMetadataIdConverter,TestJcasbinAuthorizationCacheKeys.Local verification with JDK 17:
All green, plus
spotlessCheckandjavadocclean on:api,:core,:server-common, and:server.