Skip to content

Commit 359388e

Browse files
XN137XN137
authored
Make ResolverFactory + ResolutionManifestFactory request-scoped (#2540)
this avoids passing around the `CallContext` parameter note that ideally the `SecurityContext` would also be injected from the request however our tests around `PolarisAuthzTestBase` are written in a way that does not easily support this currently.
1 parent 770a9d7 commit 359388e

File tree

19 files changed

+103
-147
lines changed

19 files changed

+103
-147
lines changed

‎polaris-core/src/main/java/org/apache/polaris/core/persistence/resolver/PolarisResolutionManifest.java‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
import java.util.Set;
3131
import org.apache.polaris.core.PolarisDiagnostics;
3232
import org.apache.polaris.core.auth.PolarisPrincipal;
33-
import org.apache.polaris.core.context.CallContext;
33+
import org.apache.polaris.core.context.RealmContext;
3434
import org.apache.polaris.core.entity.PolarisBaseEntity;
3535
import org.apache.polaris.core.entity.PolarisEntityConstants;
3636
import org.apache.polaris.core.entity.PolarisEntitySubType;
@@ -52,8 +52,8 @@ public class PolarisResolutionManifest implements PolarisResolutionManifestCatal
5252
private static final Logger LOGGER = LoggerFactory.getLogger(PolarisResolutionManifest.class);
5353

5454
private final ResolverFactory resolverFactory;
55-
private final CallContext callContext;
5655
private final SecurityContext securityContext;
56+
private final RealmContext realmContext;
5757
private final String catalogName;
5858
private final Resolver primaryResolver;
5959
private final PolarisDiagnostics diagnostics;
@@ -71,15 +71,14 @@ public class PolarisResolutionManifest implements PolarisResolutionManifestCatal
7171

7272
public PolarisResolutionManifest(
7373
PolarisDiagnostics diagnostics,
74-
CallContext callContext,
74+
RealmContext realmContext,
7575
ResolverFactory resolverFactory,
7676
SecurityContext securityContext,
7777
String catalogName) {
78-
this.callContext = callContext;
78+
this.realmContext = realmContext;
7979
this.resolverFactory = resolverFactory;
8080
this.catalogName = catalogName;
81-
this.primaryResolver =
82-
resolverFactory.createResolver(callContext, securityContext, catalogName);
81+
this.primaryResolver = resolverFactory.createResolver(securityContext, catalogName);
8382
this.diagnostics = diagnostics;
8483
this.diagnostics.checkNotNull(securityContext, "null_security_context_for_resolution_manifest");
8584
this.securityContext = securityContext;
@@ -187,8 +186,7 @@ public PolarisResolvedPathWrapper getPassthroughResolvedPath(Object key) {
187186
ResolverPath requestedPath = passthroughPaths.get(key);
188187

189188
// Run a single-use Resolver for this path.
190-
Resolver passthroughResolver =
191-
resolverFactory.createResolver(callContext, securityContext, catalogName);
189+
Resolver passthroughResolver = resolverFactory.createResolver(securityContext, catalogName);
192190
passthroughResolver.addPath(requestedPath);
193191
ResolverStatus status = passthroughResolver.resolveAll();
194192

@@ -273,7 +271,7 @@ public Set<PolarisBaseEntity> getAllActivatedPrincipalRoleEntities() {
273271
if (resolvedEntity == null) {
274272
LOGGER.warn(
275273
"Failed to find rootContainer for realm: {} and catalog: {}",
276-
callContext.getRealmContext().getRealmIdentifier(),
274+
realmContext.getRealmIdentifier(),
277275
catalogName);
278276
}
279277
return resolvedEntity;

‎polaris-core/src/main/java/org/apache/polaris/core/persistence/resolver/ResolutionManifestFactory.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,10 @@
2222
import jakarta.annotation.Nonnull;
2323
import jakarta.annotation.Nullable;
2424
import jakarta.ws.rs.core.SecurityContext;
25-
import org.apache.polaris.core.context.CallContext;
2625

2726
public interface ResolutionManifestFactory {
2827

2928
@Nonnull
3029
PolarisResolutionManifest createResolutionManifest(
31-
@Nonnull CallContext callContext,
32-
@Nonnull SecurityContext securityContext,
33-
@Nullable String referenceCatalogName);
30+
@Nonnull SecurityContext securityContext, @Nullable String referenceCatalogName);
3431
}

‎polaris-core/src/main/java/org/apache/polaris/core/persistence/resolver/ResolutionManifestFactoryImpl.java‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,26 +23,28 @@
2323
import jakarta.annotation.Nullable;
2424
import jakarta.ws.rs.core.SecurityContext;
2525
import org.apache.polaris.core.PolarisDiagnostics;
26-
import org.apache.polaris.core.context.CallContext;
26+
import org.apache.polaris.core.context.RealmContext;
2727

2828
public class ResolutionManifestFactoryImpl implements ResolutionManifestFactory {
2929

3030
private final PolarisDiagnostics diagnostics;
31+
private final RealmContext realmContext;
3132
private final ResolverFactory resolverFactory;
3233

3334
public ResolutionManifestFactoryImpl(
34-
@Nonnull PolarisDiagnostics diagnostics, @Nonnull ResolverFactory resolverFactory) {
35+
@Nonnull PolarisDiagnostics diagnostics,
36+
@Nonnull RealmContext realmContext,
37+
@Nonnull ResolverFactory resolverFactory) {
3538
this.diagnostics = diagnostics;
39+
this.realmContext = realmContext;
3640
this.resolverFactory = resolverFactory;
3741
}
3842

3943
@Nonnull
4044
@Override
4145
public PolarisResolutionManifest createResolutionManifest(
42-
@Nonnull CallContext callContext,
43-
@Nonnull SecurityContext securityContext,
44-
@Nullable String referenceCatalogName) {
46+
@Nonnull SecurityContext securityContext, @Nullable String referenceCatalogName) {
4547
return new PolarisResolutionManifest(
46-
diagnostics, callContext, resolverFactory, securityContext, referenceCatalogName);
48+
diagnostics, realmContext, resolverFactory, securityContext, referenceCatalogName);
4749
}
4850
}

‎polaris-core/src/main/java/org/apache/polaris/core/persistence/resolver/ResolverFactory.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,8 @@
2222
import jakarta.annotation.Nonnull;
2323
import jakarta.annotation.Nullable;
2424
import jakarta.ws.rs.core.SecurityContext;
25-
import org.apache.polaris.core.context.CallContext;
2625

2726
public interface ResolverFactory {
2827
Resolver createResolver(
29-
@Nonnull CallContext callContext,
30-
@Nonnull SecurityContext securityContext,
31-
@Nullable String referenceCatalogName);
28+
@Nonnull SecurityContext securityContext, @Nullable String referenceCatalogName);
3229
}

‎runtime/service/src/main/java/org/apache/polaris/service/admin/PolarisAdminService.java‎

Lines changed: 14 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,10 @@ private UserSecretsManager getUserSecretsManager() {
190190
return userSecretsManager;
191191
}
192192

193+
private PolarisResolutionManifest newResolutionManifest(@Nullable String catalogName) {
194+
return resolutionManifestFactory.createResolutionManifest(securityContext, catalogName);
195+
}
196+
193197
private Optional<CatalogEntity> currentCatalog() {
194198
return Optional.ofNullable(resolutionManifest.getResolvedReferenceCatalogEntity())
195199
.map(path -> CatalogEntity.of(path.getRawLeafEntity()));
@@ -213,9 +217,7 @@ private Optional<CatalogRoleEntity> findCatalogRoleByName(String catalogName, St
213217
}
214218

215219
private void authorizeBasicRootOperationOrThrow(PolarisAuthorizableOperation op) {
216-
resolutionManifest =
217-
resolutionManifestFactory.createResolutionManifest(
218-
callContext, securityContext, null /* referenceCatalogName */);
220+
resolutionManifest = newResolutionManifest(null);
219221
resolutionManifest.resolveAll();
220222
PolarisResolvedPathWrapper rootContainerWrapper =
221223
resolutionManifest.getResolvedRootContainerEntityAsPath();
@@ -240,9 +242,7 @@ private void authorizeBasicTopLevelEntityOperationOrThrow(
240242
String topLevelEntityName,
241243
PolarisEntityType entityType,
242244
@Nullable String referenceCatalogName) {
243-
resolutionManifest =
244-
resolutionManifestFactory.createResolutionManifest(
245-
callContext, securityContext, referenceCatalogName);
245+
resolutionManifest = newResolutionManifest(referenceCatalogName);
246246
resolutionManifest.addTopLevelName(topLevelEntityName, entityType, false /* isOptional */);
247247
ResolverStatus status = resolutionManifest.resolveAll();
248248
if (status.getStatus() == ResolverStatus.StatusEnum.ENTITY_COULD_NOT_BE_RESOLVED) {
@@ -293,9 +293,7 @@ private static boolean isSelfOperation(PolarisAuthorizableOperation op) {
293293

294294
private void authorizeBasicCatalogRoleOperationOrThrow(
295295
PolarisAuthorizableOperation op, String catalogName, String catalogRoleName) {
296-
resolutionManifest =
297-
resolutionManifestFactory.createResolutionManifest(
298-
callContext, securityContext, catalogName);
296+
resolutionManifest = newResolutionManifest(catalogName);
299297
resolutionManifest.addPath(
300298
new ResolverPath(List.of(catalogRoleName), PolarisEntityType.CATALOG_ROLE),
301299
catalogRoleName);
@@ -314,8 +312,7 @@ private void authorizeBasicCatalogRoleOperationOrThrow(
314312

315313
private void authorizeGrantOnRootContainerToPrincipalRoleOperationOrThrow(
316314
PolarisAuthorizableOperation op, String principalRoleName) {
317-
resolutionManifest =
318-
resolutionManifestFactory.createResolutionManifest(callContext, securityContext, null);
315+
resolutionManifest = newResolutionManifest(null);
319316
resolutionManifest.addTopLevelName(
320317
principalRoleName, PolarisEntityType.PRINCIPAL_ROLE, false /* isOptional */);
321318
ResolverStatus status = resolutionManifest.resolveAll();
@@ -342,8 +339,7 @@ private void authorizeGrantOnRootContainerToPrincipalRoleOperationOrThrow(
342339

343340
private void authorizeGrantOnPrincipalRoleToPrincipalOperationOrThrow(
344341
PolarisAuthorizableOperation op, String principalRoleName, String principalName) {
345-
resolutionManifest =
346-
resolutionManifestFactory.createResolutionManifest(callContext, securityContext, null);
342+
resolutionManifest = newResolutionManifest(null);
347343
resolutionManifest.addTopLevelName(
348344
principalRoleName, PolarisEntityType.PRINCIPAL_ROLE, false /* isOptional */);
349345
resolutionManifest.addTopLevelName(
@@ -375,9 +371,7 @@ private void authorizeGrantOnCatalogRoleToPrincipalRoleOperationOrThrow(
375371
String catalogName,
376372
String catalogRoleName,
377373
String principalRoleName) {
378-
resolutionManifest =
379-
resolutionManifestFactory.createResolutionManifest(
380-
callContext, securityContext, catalogName);
374+
resolutionManifest = newResolutionManifest(catalogName);
381375
resolutionManifest.addPath(
382376
new ResolverPath(List.of(catalogRoleName), PolarisEntityType.CATALOG_ROLE),
383377
catalogRoleName);
@@ -411,9 +405,7 @@ private void authorizeGrantOnCatalogRoleToPrincipalRoleOperationOrThrow(
411405

412406
private void authorizeGrantOnCatalogOperationOrThrow(
413407
PolarisAuthorizableOperation op, String catalogName, String catalogRoleName) {
414-
resolutionManifest =
415-
resolutionManifestFactory.createResolutionManifest(
416-
callContext, securityContext, catalogName);
408+
resolutionManifest = newResolutionManifest(catalogName);
417409
resolutionManifest.addTopLevelName(
418410
catalogName, PolarisEntityType.CATALOG, false /* isOptional */);
419411
resolutionManifest.addPath(
@@ -444,9 +436,7 @@ private void authorizeGrantOnNamespaceOperationOrThrow(
444436
String catalogName,
445437
Namespace namespace,
446438
String catalogRoleName) {
447-
resolutionManifest =
448-
resolutionManifestFactory.createResolutionManifest(
449-
callContext, securityContext, catalogName);
439+
resolutionManifest = newResolutionManifest(catalogName);
450440
resolutionManifest.addPassthroughPath(
451441
new ResolverPath(Arrays.asList(namespace.levels()), PolarisEntityType.NAMESPACE),
452442
namespace);
@@ -485,9 +475,7 @@ private void authorizeGrantOnTableLikeOperationOrThrow(
485475
List<PolarisEntitySubType> subTypes,
486476
TableIdentifier identifier,
487477
String catalogRoleName) {
488-
resolutionManifest =
489-
resolutionManifestFactory.createResolutionManifest(
490-
callContext, securityContext, catalogName);
478+
resolutionManifest = newResolutionManifest(catalogName);
491479
resolutionManifest.addPassthroughPath(
492480
new ResolverPath(
493481
Arrays.asList(identifier.namespace().levels()), PolarisEntityType.NAMESPACE),
@@ -544,9 +532,7 @@ private void authorizeGrantOnPolicyOperationOrThrow(
544532
String catalogName,
545533
PolicyIdentifier identifier,
546534
String catalogRoleName) {
547-
resolutionManifest =
548-
resolutionManifestFactory.createResolutionManifest(
549-
callContext, securityContext, catalogName);
535+
resolutionManifest = newResolutionManifest(catalogName);
550536
resolutionManifest.addPath(
551537
new ResolverPath(
552538
PolarisCatalogHelpers.identifierToList(identifier.getNamespace(), identifier.getName()),

‎runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java‎

Lines changed: 10 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,10 @@ protected UserSecretsManager getUserSecretsManager() {
102102
return userSecretsManager;
103103
}
104104

105+
protected PolarisResolutionManifest newResolutionManifest() {
106+
return resolutionManifestFactory.createResolutionManifest(securityContext, catalogName);
107+
}
108+
105109
/** Initialize the catalog once authorized. Called after all `authorize...` methods. */
106110
protected abstract void initializeCatalog();
107111

@@ -116,9 +120,7 @@ protected void authorizeBasicNamespaceOperationOrThrow(
116120
List<Namespace> extraPassthroughNamespaces,
117121
List<TableIdentifier> extraPassthroughTableLikes,
118122
List<PolicyIdentifier> extraPassThroughPolicies) {
119-
resolutionManifest =
120-
resolutionManifestFactory.createResolutionManifest(
121-
callContext, securityContext, catalogName);
123+
resolutionManifest = newResolutionManifest();
122124
resolutionManifest.addPath(
123125
new ResolverPath(Arrays.asList(namespace.levels()), PolarisEntityType.NAMESPACE),
124126
namespace);
@@ -170,9 +172,7 @@ protected void authorizeBasicNamespaceOperationOrThrow(
170172

171173
protected void authorizeCreateNamespaceUnderNamespaceOperationOrThrow(
172174
PolarisAuthorizableOperation op, Namespace namespace) {
173-
resolutionManifest =
174-
resolutionManifestFactory.createResolutionManifest(
175-
callContext, securityContext, catalogName);
175+
resolutionManifest = newResolutionManifest();
176176

177177
Namespace parentNamespace = PolarisCatalogHelpers.getParentNamespace(namespace);
178178
resolutionManifest.addPath(
@@ -206,9 +206,7 @@ protected void authorizeCreateTableLikeUnderNamespaceOperationOrThrow(
206206
PolarisAuthorizableOperation op, TableIdentifier identifier) {
207207
Namespace namespace = identifier.namespace();
208208

209-
resolutionManifest =
210-
resolutionManifestFactory.createResolutionManifest(
211-
callContext, securityContext, catalogName);
209+
resolutionManifest = newResolutionManifest();
212210
resolutionManifest.addPath(
213211
new ResolverPath(Arrays.asList(namespace.levels()), PolarisEntityType.NAMESPACE),
214212
namespace);
@@ -242,9 +240,7 @@ protected void authorizeCreateTableLikeUnderNamespaceOperationOrThrow(
242240

243241
protected void authorizeBasicTableLikeOperationOrThrow(
244242
PolarisAuthorizableOperation op, PolarisEntitySubType subType, TableIdentifier identifier) {
245-
resolutionManifest =
246-
resolutionManifestFactory.createResolutionManifest(
247-
callContext, securityContext, catalogName);
243+
resolutionManifest = newResolutionManifest();
248244

249245
// The underlying Catalog is also allowed to fetch "fresh" versions of the target entity.
250246
resolutionManifest.addPassthroughPath(
@@ -273,9 +269,7 @@ protected void authorizeCollectionOfTableLikeOperationOrThrow(
273269
PolarisAuthorizableOperation op,
274270
final PolarisEntitySubType subType,
275271
List<TableIdentifier> ids) {
276-
resolutionManifest =
277-
resolutionManifestFactory.createResolutionManifest(
278-
callContext, securityContext, catalogName);
272+
resolutionManifest = newResolutionManifest();
279273
ids.forEach(
280274
identifier ->
281275
resolutionManifest.addPassthroughPath(
@@ -325,9 +319,7 @@ protected void authorizeRenameTableLikeOperationOrThrow(
325319
PolarisEntitySubType subType,
326320
TableIdentifier src,
327321
TableIdentifier dst) {
328-
resolutionManifest =
329-
resolutionManifestFactory.createResolutionManifest(
330-
callContext, securityContext, catalogName);
322+
resolutionManifest = newResolutionManifest();
331323
// Add src, dstParent, and dst(optional)
332324
resolutionManifest.addPath(
333325
new ResolverPath(

‎runtime/service/src/main/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalog.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1231,7 +1231,7 @@ private <T extends PolarisEntity & LocationBasedEntity> void validateNoLocationO
12311231
PolarisResolutionManifest resolutionManifest =
12321232
new PolarisResolutionManifest(
12331233
diagnostics,
1234-
callContext,
1234+
callContext.getRealmContext(),
12351235
resolverFactory,
12361236
securityContext,
12371237
parentPath.getFirst().getName());

‎runtime/service/src/main/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogAdapter.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -800,7 +800,7 @@ public Response getConfig(
800800
if (warehouse == null) {
801801
throw new BadRequestException("Please specify a warehouse");
802802
}
803-
Resolver resolver = resolverFactory.createResolver(callContext, securityContext, warehouse);
803+
Resolver resolver = resolverFactory.createResolver(securityContext, warehouse);
804804
ResolverStatus resolverStatus = resolver.resolveAll();
805805
if (!resolverStatus.getStatus().equals(ResolverStatus.StatusEnum.SUCCESS)) {
806806
throw new NotFoundException("Unable to find warehouse %s", warehouse);

‎runtime/service/src/main/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandler.java‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -165,9 +165,7 @@ public GetApplicablePoliciesResponse getApplicablePolicies(
165165

166166
private void authorizeBasicPolicyOperationOrThrow(
167167
PolarisAuthorizableOperation op, PolicyIdentifier identifier) {
168-
resolutionManifest =
169-
resolutionManifestFactory.createResolutionManifest(
170-
callContext, securityContext, catalogName);
168+
resolutionManifest = newResolutionManifest();
171169
resolutionManifest.addPassthroughPath(
172170
new ResolverPath(
173171
PolarisCatalogHelpers.identifierToList(identifier.getNamespace(), identifier.getName()),
@@ -215,9 +213,7 @@ private void authorizeGetApplicablePoliciesOperationOrThrow(
215213
}
216214

217215
private void authorizeBasicCatalogOperationOrThrow(PolarisAuthorizableOperation op) {
218-
resolutionManifest =
219-
resolutionManifestFactory.createResolutionManifest(
220-
callContext, securityContext, catalogName);
216+
resolutionManifest = newResolutionManifest();
221217
resolutionManifest.resolveAll();
222218

223219
PolarisResolvedPathWrapper targetCatalog =
@@ -237,9 +233,7 @@ private void authorizeBasicCatalogOperationOrThrow(PolarisAuthorizableOperation
237233

238234
private void authorizePolicyMappingOperationOrThrow(
239235
PolicyIdentifier identifier, PolicyAttachmentTarget target, boolean isAttach) {
240-
resolutionManifest =
241-
resolutionManifestFactory.createResolutionManifest(
242-
callContext, securityContext, catalogName);
236+
resolutionManifest = newResolutionManifest();
243237
resolutionManifest.addPassthroughPath(
244238
new ResolverPath(
245239
PolarisCatalogHelpers.identifierToList(identifier.getNamespace(), identifier.getName()),

0 commit comments

Comments
 (0)