bharos commented on code in PR #10867:
URL: https://github.com/apache/gravitino/pull/10867#discussion_r3141614684
##########
server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java:
##########
@@ -601,4 +610,65 @@ private void loadPolicyByRoleEntity(RoleEntity roleEntity)
{
}
}
}
+
+ /**
+ * Checks whether the given principal is the owner of the metadata object
identified by
+ * metadataId. Supports both user and group ownership.
+ */
+ private boolean checkOwnership(Principal principal, String metalake, Long
metadataId) {
+ Optional<OwnerInfo> ownerOpt = ownerRel.getIfPresent(metadataId);
+ if (ownerOpt == null || !ownerOpt.isPresent()) {
+ return false;
+ }
+ OwnerInfo owner = ownerOpt.get();
+ // We compare by entity ID rather than name to guard against stale cache
entries.
+ // If a user/group is deleted and recreated with the same name, the cached
OwnerInfo
+ // still holds the old ID. A name-only comparison would incorrectly grant
ownership
+ // to the new entity. The extra IO to fetch the current entity ensures
correctness.
+ if (owner.type == Entity.EntityType.USER) {
+ try {
+ UserEntity userEntity = getUserEntity(principal.getName(), metalake);
+ return Objects.equals(userEntity.id(), owner.id);
+ } catch (Exception e) {
+ LOG.debug("Can not get user entity for ownership check", e);
+ return false;
+ }
+ } else if (owner.type == Entity.EntityType.GROUP) {
+ if (principal instanceof UserPrincipal) {
+ for (UserGroup group : ((UserPrincipal) principal).getGroups()) {
+ if (group.getGroupname().equals(owner.name)) {
+ try {
+ GroupEntity groupEntity =
Review Comment:
Used entityStore.batchGet() for the group ownership check. Note that
JDBCBackend.batchGet() for GROUP/USER/ROLE currently loops individually ([see
the TODO at JDBCBackend.java
L357](https://github.com/apache/gravitino/blob/f4d61784c996c24918b6bab4f27926e77af628a6/core/src/main/java/org/apache/gravitino/storage/relational/JDBCBackend.java#L355)).
True SQL-level batch support for these types can be added in a follow-up PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
