Skip to content

[#7570] feat(authz): Support topic authorization #7580

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 11 commits into from
Jul 14, 2025
Merged

[#7570] feat(authz): Support topic authorization #7580

merged 11 commits into from
Jul 14, 2025

Conversation

KyleLin0927
Copy link
Contributor

What changes were proposed in this pull request?

Support topic authorization.

Why are the changes needed?

Fixes #7570

Does this PR introduce any user-facing change?

No.

How was this patch tested?

org.apache.gravitino.client.integration.test.authorization.TopicAuthorizationIT

hdygxsj
hdygxsj reviewed Jul 7, 2025
View reviewed changes
server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java Outdated
@PathParam("catalog") @AuthorizationMetadata(type = MetadataObject.Type.CATALOG)
String catalog,
@PathParam("schema") @AuthorizationMetadata(type = MetadataObject.Type.SCHEMA)
String schema) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The list interface does not require AuthorizationMetadata.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java Outdated
topics =
MetadataFilterHelper.filterByExpression(
metalake,
"METALAKE::CONSUME_TOPIC || CATALOG::CONSUME_TOPIC || SCHEMA::CONSUME_TOPIC || TOPIC::CONSUME_TOPIC || METALAKE::PRODUCE_TOPIC ||CATALOG::PRODUCE_TOPIC || SCHEMA::PRODUCE_TOPIC || TOPIC::PRODUCE_TOPIC || METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

USE_CATALOG and USE_SCHEMA is required.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java Outdated
@@ -133,11 +154,17 @@ public Response createTopic(
@Produces("application/vnd.gravitino.v1+json")
@Timed(name = "load-topic." + MetricNames.HTTP_PROCESS_DURATION, absolute = true)
@ResponseMetered(name = "load-topic", absolute = true)
@AuthorizationExpression(
expression =
"METALAKE::CONSUME_TOPIC || CATALOG::CONSUME_TOPIC || SCHEMA::CONSUME_TOPIC || TOPIC::CONSUME_TOPIC || METALAKE::PRODUCE_TOPIC || CATALOG::PRODUCE_TOPIC || SCHEMA::PRODUCE_TOPIC || TOPIC::PRODUCE_TOPIC || METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

USE_CATALOG and USE_SCHEMA is required.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

hdygxsj
hdygxsj reviewed Jul 7, 2025
View reviewed changes
server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java Outdated
topics =
MetadataFilterHelper.filterByExpression(
metalake,
"METALAKE::CONSUME_TOPIC || CATALOG::CONSUME_TOPIC || SCHEMA::CONSUME_TOPIC || TOPIC::CONSUME_TOPIC || METALAKE::PRODUCE_TOPIC ||CATALOG::PRODUCE_TOPIC || SCHEMA::PRODUCE_TOPIC || TOPIC::PRODUCE_TOPIC || METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java Outdated
@@ -92,10 +107,16 @@ public Response listTopics(
@Produces("application/vnd.gravitino.v1+json")
@Timed(name = "create-topic." + MetricNames.HTTP_PROCESS_DURATION, absolute = true)
@ResponseMetered(name = "create-topic", absolute = true)
@AuthorizationExpression(
expression =
"METALAKE::CREATE_TOPIC || CATALOG::CREATE_TOPIC || SCHEMA::CREATE_TOPIC || METALAKE::OWNER || CATALOG::OWNER || SCHEMA::OWNER",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java Outdated
@@ -133,11 +154,17 @@ public Response createTopic(
@Produces("application/vnd.gravitino.v1+json")
@Timed(name = "load-topic." + MetricNames.HTTP_PROCESS_DURATION, absolute = true)
@ResponseMetered(name = "load-topic", absolute = true)
@AuthorizationExpression(
expression =
"METALAKE::CONSUME_TOPIC || CATALOG::CONSUME_TOPIC || SCHEMA::CONSUME_TOPIC || TOPIC::CONSUME_TOPIC || METALAKE::PRODUCE_TOPIC || CATALOG::PRODUCE_TOPIC || SCHEMA::PRODUCE_TOPIC || TOPIC::PRODUCE_TOPIC || METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java Outdated
@@ -161,11 +188,17 @@ public Response loadTopic(
@Produces("application/vnd.gravitino.v1+json")
@Timed(name = "alter-topic." + MetricNames.HTTP_PROCESS_DURATION, absolute = true)
@ResponseMetered(name = "alter-topic", absolute = true)
@AuthorizationExpression(
expression =
"METALAKE::PRODUCE_TOPIC || CATALOG::PRODUCE_TOPIC || SCHEMA::PRODUCE_TOPIC || TOPIC::PRODUCE_TOPIC || METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

server/src/main/java/org/apache/gravitino/server/web/rest/TopicOperations.java Outdated
@@ -195,11 +228,17 @@ public Response alterTopic(
@Produces("application/vnd.gravitino.v1+json")
@Timed(name = "drop-topic." + MetricNames.HTTP_PROCESS_DURATION, absolute = true)
@ResponseMetered(name = "drop-topic", absolute = true)
@AuthorizationExpression(
expression =
"METALAKE::OWNERSHIP || CATALOG::OWNERSHIP || SCHEMA::OWNERSHIP || TOPIC::OWNERSHIP",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use any expression like ANY(SELECT_TABLE,METALAKE,CATALOG,SCHEMA,TABLE)

Please refer to https://github.com/apache/gravitino/pull/7577/files

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

@hdygxsj hdygxsj self-assigned this Jul 10, 2025
@hdygxsj
Copy link
Collaborator

hdygxsj commented Jul 11, 2025

PHAL @jerqi

jerqi
jerqi approved these changes Jul 11, 2025
View reviewed changes
Copy link
Contributor

@jerqi jerqi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, wait for CI.

xunliu
xunliu approved these changes Jul 14, 2025
View reviewed changes
Copy link
Member

@xunliu xunliu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@xunliu xunliu merged commit 4ae2440 into apache:branch-metadata-authz Jul 14, 2025
30 checks passed
hdygxsj added a commit to hdygxsj/gravitino that referenced this pull request Jul 15, 2025
@KyleLin0927 @hdygxsj
[apache#7570] feat(authz): Support topic authorization (apache#7580)
de09b08 
### What changes were proposed in this pull request?

Support topic authorization.

### Why are the changes needed?

Fixes apache#7570

### Does this PR introduce any user-facing change?

No.

### How was this patch tested?


`org.apache.gravitino.client.integration.test.authorization.TopicAuthorizationIT`

---------

Co-authored-by: yangyang zhong <[email protected]>
Co-authored-by: [email protected] <[email protected]>
hdygxsj added a commit to hdygxsj/gravitino that referenced this pull request Jul 15, 2025
@KyleLin0927 @hdygxsj
[apache#7570] feat(authz): Support topic authorization (apache#7580)
c098736 
### What changes were proposed in this pull request?

Support topic authorization.

### Why are the changes needed?

Fixes apache#7570

### Does this PR introduce any user-facing change?

No.

### How was this patch tested?


`org.apache.gravitino.client.integration.test.authorization.TopicAuthorizationIT`

---------

Co-authored-by: yangyang zhong <[email protected]>
Co-authored-by: [email protected] <[email protected]>
hdygxsj added a commit to hdygxsj/gravitino that referenced this pull request Jul 15, 2025
@KyleLin0927 @hdygxsj
[apache#7570] feat(authz): Support topic authorization (apache#7580)
1e9a133 
### What changes were proposed in this pull request?

Support topic authorization.

### Why are the changes needed?

Fixes apache#7570

### Does this PR introduce any user-facing change?

No.

### How was this patch tested?


`org.apache.gravitino.client.integration.test.authorization.TopicAuthorizationIT`

---------

Co-authored-by: yangyang zhong <[email protected]>
Co-authored-by: [email protected] <[email protected]>
jerryshao pushed a commit that referenced this pull request Jul 15, 2025
@KyleLin0927 @hdygxsj @jerryshao
[#7570] feat(authz): Support topic authorization (#7580)
fc8e2eb 
### What changes were proposed in this pull request?

Support topic authorization.

### Why are the changes needed?

Fixes #7570

### Does this PR introduce any user-facing change?

No.

### How was this patch tested?


`org.apache.gravitino.client.integration.test.authorization.TopicAuthorizationIT`

---------

Co-authored-by: yangyang zhong <[email protected]>
Co-authored-by: [email protected] <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hdygxsj hdygxsj hdygxsj left review comments

@xunliu xunliu xunliu approved these changes

@jerqi jerqi jerqi approved these changes

Assignees

@hdygxsj hdygxsj

@KyleLin0927 KyleLin0927

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@KyleLin0927 @hdygxsj @xunliu @jerqi