Skip to content

[#12112] fix(authz): Align group load authorization#12113

Open
roryqi wants to merge 3 commits into
apache:mainfrom
qqqttt123:fix-group-load-authz
Open

[#12112] fix(authz): Align group load authorization#12113
roryqi wants to merge 3 commits into
apache:mainfrom
qqqttt123:fix-group-load-authz

Conversation

@roryqi

@roryqi roryqi commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

What changes were proposed in this pull request?

  • Add an explicit authorization expression for loading group details.
  • Include metalake and group path parameters in the authorization metadata context.
  • Support GROUP::SELF in JCasbin authorization checks.
  • Add regression tests for group load authorization metadata and GROUP::SELF evaluation.

Why are the changes needed?

The group load API should follow the same authorization interception path as related user and group access-control APIs.

Fix: #12112

Does this PR introduce any user-facing change?

No public API change. Group detail loading now follows the expected authorization behavior.

How was this patch tested?

  • ./gradlew :server:test --tests org.apache.gravitino.server.web.rest.authorization.TestGroupAuthorizationExpression --tests org.apache.gravitino.server.web.rest.TestGroupOperations
  • ./gradlew :server-common:test --tests org.apache.gravitino.server.authorization.jcasbin.TestJcasbinAuthorizer
  • git diff --check

@roryqi roryqi changed the title fix(authz): Align group load authorization [#12112] fix(authz): Align group load authorization Jul 20, 2026
@roryqi
roryqi requested a review from yuqi1129 July 20, 2026 15:09
@github-actions

Copy link
Copy Markdown

Code Coverage Report

Overall Project 67.71% +0.17% 🟢
Files changed 90.69% 🟢

Module Coverage
aliyun 1.72% 🔴
api 47.82% 🟢
authorization-common 85.96% 🟢
aws 42.04% 🟢
azure 2.47% 🔴
catalog-common 9.92% 🔴
catalog-fileset 79.77% 🟢
catalog-glue 66.91% 🟢
catalog-hive 79.42% 🟢
catalog-jdbc-common 44.81% 🟢
catalog-jdbc-doris 81.6% 🟢
catalog-jdbc-mysql 79.23% 🟢
catalog-jdbc-postgresql 82.29% 🟢
catalog-jdbc-starrocks 78.51% 🟢
catalog-kafka 77.01% 🟢
catalog-lakehouse-generic 59.18% 🟢
catalog-lakehouse-hudi 79.1% 🟢
catalog-lakehouse-iceberg 85.87% 🟢
catalog-lakehouse-paimon 84.25% 🟢
catalog-model 77.72% 🟢
cli 44.5% 🟢
client-java 78.27% 🟢
common 51.95% 🟢
core 82.51% 🟢
filesystem-hadoop3 77.28% 🟢
flink 0.0% 🔴
flink-common 47.09% 🟢
flink-runtime 0.0% 🔴
gcp 14.12% 🔴
hadoop-auth 68.0% 🟢
hadoop-common 12.7% 🔴
hive-metastore-common 53.4% 🟢
iceberg-common 63.77% 🟢
iceberg-rest-server 74.9% 🟢
idp-basic 86.02% 🟢
integration-test-common 0.0% 🔴
jobs 66.17% 🟢
lance-common 20.67% 🔴
lance-rest-server 64.84% 🟢
lineage 53.02% 🟢
optimizer 83.24% 🟢
optimizer-api 21.95% 🔴
server 85.89% +0.19% 🟢
server-common 76.13% +3.76% 🟢
spark 28.57% 🔴
spark-common 46.01% 🟢
tencent 69.84% 🟢
trino-connector 40.29% 🟢
Files
Module File Coverage
server GroupOperations.java 96.36% 🟢
server-common JcasbinAuthorizer.java 90.14% 🟢

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug report] Align group detail authorization behavior

1 participant