[#3342] feat(core): Refactor the role and privilege model (#3389)

### What changes were proposed in this pull request? Add support for ALLOW/DENY effect for privileges. Move privileges from the role to the securable object. ### Why are the changes needed? Fix: #3342 ### Does this PR introduce _any_ user-facing change? Yes. ### How was this patch tested? UT passed. --------- Co-authored-by: Heng Qin <[email protected]>
apache · May 22, 2024 · 5a4931b · 5a4931b
1 parent 264612e
commit 5a4931b
Show file tree

Hide file tree

Showing 36 changed files with 1,714 additions and 717 deletions.
diff --git a/api/src/main/java/com/datastrato/gravitino/authorization/Privilege.java b/api/src/main/java/com/datastrato/gravitino/authorization/Privilege.java
@@ -19,6 +19,12 @@ public interface Privilege {
   /** @return A readable string representation for the privilege. */
   String simpleString();
 
+  /**
+   * @return The condition of the privilege. `ALLOW` means that you are allowed to use the
+   *     privilege, `DENY` means that you are denied to use the privilege
+   */
+  Condition condition();
+
   /** The name of this privilege. */
   enum Name {
     /** The privilege to create a catalog. */
@@ -116,4 +122,16 @@ public long getHighBits() {
       return highBits;
     }
   }
+
+  /**
+   * The condition of this privilege. `ALLOW` means that you are allowed to use the privilege,
+   * `DENY` means that you are denied to use the privilege. If you have `ALLOW` and `DENY` for the
+   * same privilege name of the same securable object, the `DENY` will take effect.
+   */
+  enum Condition {
+    /** Allow to use the privilege */
+    ALLOW,
+    /** Deny to use the privilege */
+    DENY
+  }
 }