[#7570] feat(authz): Support topic authorization by KyleLin0927 · Pull Request #7580 · apache/gravitino

KyleLin0927 · 2025-07-06T03:45:57Z

What changes were proposed in this pull request?

Support topic authorization.

Why are the changes needed?

Fixes #7570

Does this PR introduce any user-facing change?

No.

How was this patch tested?

org.apache.gravitino.client.integration.test.authorization.TopicAuthorizationIT

hdygxsj · 2025-07-07T01:06:59Z

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java

+      @PathParam("catalog") @AuthorizationMetadata(type = MetadataObject.Type.CATALOG)
+          String catalog,
+      @PathParam("schema") @AuthorizationMetadata(type = MetadataObject.Type.SCHEMA)
+          String schema) {


The list interface does not require AuthorizationMetadata.

hdygxsj · 2025-07-07T01:07:48Z

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java

+            topics =
+                MetadataFilterHelper.filterByExpression(
+                    metalake,
+                    "METALAKE::CONSUME_TOPIC || CATALOG::CONSUME_TOPIC || SCHEMA::CONSUME_TOPIC || TOPIC::CONSUME_TOPIC || METALAKE::PRODUCE_TOPIC ||CATALOG::PRODUCE_TOPIC || SCHEMA::PRODUCE_TOPIC || TOPIC::PRODUCE_TOPIC || METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",


USE_CATALOG and USE_SCHEMA is required.

hdygxsj · 2025-07-07T01:07:54Z

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java

  @ResponseMetered(name = "load-topic", absolute = true)
+  @AuthorizationExpression(
+      expression =
+          "METALAKE::CONSUME_TOPIC || CATALOG::CONSUME_TOPIC || SCHEMA::CONSUME_TOPIC || TOPIC::CONSUME_TOPIC || METALAKE::PRODUCE_TOPIC || CATALOG::PRODUCE_TOPIC || SCHEMA::PRODUCE_TOPIC || TOPIC::PRODUCE_TOPIC || METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",


USE_CATALOG and USE_SCHEMA is required.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

hdygxsj · 2025-07-07T06:28:17Z

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java

+            topics =
+                MetadataFilterHelper.filterByExpression(
+                    metalake,
+                    "METALAKE::CONSUME_TOPIC || CATALOG::CONSUME_TOPIC || SCHEMA::CONSUME_TOPIC || TOPIC::CONSUME_TOPIC || METALAKE::PRODUCE_TOPIC ||CATALOG::PRODUCE_TOPIC || SCHEMA::PRODUCE_TOPIC || TOPIC::PRODUCE_TOPIC || METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",


Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

hdygxsj · 2025-07-07T06:28:22Z

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java

  @ResponseMetered(name = "create-topic", absolute = true)
+  @AuthorizationExpression(
+      expression =
+          "METALAKE::CREATE_TOPIC || CATALOG::CREATE_TOPIC || SCHEMA::CREATE_TOPIC || METALAKE::OWNER || CATALOG::OWNER || SCHEMA::OWNER",


Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

hdygxsj · 2025-07-07T06:28:28Z

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java

  @ResponseMetered(name = "load-topic", absolute = true)
+  @AuthorizationExpression(
+      expression =
+          "METALAKE::CONSUME_TOPIC || CATALOG::CONSUME_TOPIC || SCHEMA::CONSUME_TOPIC || TOPIC::CONSUME_TOPIC || METALAKE::PRODUCE_TOPIC || CATALOG::PRODUCE_TOPIC || SCHEMA::PRODUCE_TOPIC || TOPIC::PRODUCE_TOPIC || METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",


Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

hdygxsj · 2025-07-07T06:28:35Z

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java

  @ResponseMetered(name = "alter-topic", absolute = true)
+  @AuthorizationExpression(
+      expression =
+          "METALAKE::PRODUCE_TOPIC || CATALOG::PRODUCE_TOPIC || SCHEMA::PRODUCE_TOPIC || TOPIC::PRODUCE_TOPIC || METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",


Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

hdygxsj · 2025-07-07T06:28:43Z

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java

  @ResponseMetered(name = "drop-topic", absolute = true)
+  @AuthorizationExpression(
+      expression =
+          "METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",


Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

hdygxsj · 2025-07-11T00:56:25Z

PHAL @jerqi

roryqi

LGTM, wait for CI.

xunliu

LGTM

### What changes were proposed in this pull request? Support topic authorization. ### Why are the changes needed? Fixes apache#7570 ### Does this PR introduce any user-facing change? No. ### How was this patch tested? `org.apache.gravitino.client.integration.test.authorization.TopicAuthorizationIT` --------- Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com> Co-authored-by: 1161623489@qq.com <1161623489@qq.com>

### What changes were proposed in this pull request? Support topic authorization. ### Why are the changes needed? Fixes #7570 ### Does this PR introduce any user-facing change? No. ### How was this patch tested? `org.apache.gravitino.client.integration.test.authorization.TopicAuthorizationIT` --------- Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com> Co-authored-by: 1161623489@qq.com <1161623489@qq.com>

### What changes were proposed in this pull request? Support topic authorization. ### Why are the changes needed? Fixes apache#7570 ### Does this PR introduce any user-facing change? No. ### How was this patch tested? `org.apache.gravitino.client.integration.test.authorization.TopicAuthorizationIT` --------- Co-authored-by: yangyang zhong <35210666+hdygxsj@users.noreply.github.com> Co-authored-by: 1161623489@qq.com <1161623489@qq.com>

add topic auth annotation

7115e15

hdygxsj reviewed Jul 7, 2025

View reviewed changes

xunliu assigned KyleLin0927 Jul 7, 2025

hdygxsj reviewed Jul 7, 2025

View reviewed changes

KyleLin0927 and others added 8 commits July 9, 2025 20:29

remove AuthorizationMetadata annotation in listTopic method

a07f39c

modify TopicOperations auth logic

1d3f363

add topic case in MetadataFilterHelper

3d57578

fix

5c68577

merge from branch-metadata-authz

333572f

modify expression

99fabea

modify expression and fix ci

929351d

fix ci

5791581

hdygxsj self-assigned this Jul 10, 2025

fix ci

0e7715f

roryqi approved these changes Jul 11, 2025

View reviewed changes

fix ci

b09ba5a

xunliu approved these changes Jul 14, 2025

View reviewed changes

xunliu merged commit 4ae2440 into apache:branch-metadata-authz Jul 14, 2025
30 checks passed

Conversation

KyleLin0927 commented Jul 6, 2025

What changes were proposed in this pull request?

Why are the changes needed?

Does this PR introduce any user-facing change?

How was this patch tested?

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hdygxsj commented Jul 11, 2025

Uh oh!

roryqi left a comment

Choose a reason for hiding this comment

Uh oh!

xunliu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants