Skip to content

Commit 88f58fc

Browse files
XN137XN137
authored
Make PolarisAuthorizer RequestScoped (#2340)
all methods in `PolarisAuthorizer` currently have a `CallContext` parameter. in its only implementation only `CallContext.getRealmConfig` is getting used. so since `PolarisAuthorizer` cant be used outside a request, we can simply make it request-scoped and inject the request-scoped `RealmConfig` directly.
1 parent 6e036e0 commit 88f58fc

File tree

12 files changed

+21
-45
lines changed

12 files changed

+21
-45
lines changed

‎polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizer.java‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,23 +22,20 @@
2222
import jakarta.annotation.Nullable;
2323
import java.util.List;
2424
import java.util.Set;
25-
import org.apache.polaris.core.context.CallContext;
2625
import org.apache.polaris.core.entity.PolarisBaseEntity;
2726
import org.apache.polaris.core.persistence.PolarisResolvedPathWrapper;
2827

2928
/** Interface for invoking authorization checks. */
3029
public interface PolarisAuthorizer {
3130

3231
void authorizeOrThrow(
33-
@Nonnull CallContext callContext,
3432
@Nonnull AuthenticatedPolarisPrincipal authenticatedPrincipal,
3533
@Nonnull Set<PolarisBaseEntity> activatedEntities,
3634
@Nonnull PolarisAuthorizableOperation authzOp,
3735
@Nullable PolarisResolvedPathWrapper target,
3836
@Nullable PolarisResolvedPathWrapper secondary);
3937

4038
void authorizeOrThrow(
41-
@Nonnull CallContext callContext,
4239
@Nonnull AuthenticatedPolarisPrincipal authenticatedPrincipal,
4340
@Nonnull Set<PolarisBaseEntity> activatedEntities,
4441
@Nonnull PolarisAuthorizableOperation authzOp,

‎polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@
114114
import java.util.stream.Collectors;
115115
import org.apache.iceberg.exceptions.ForbiddenException;
116116
import org.apache.polaris.core.config.FeatureConfiguration;
117-
import org.apache.polaris.core.context.CallContext;
117+
import org.apache.polaris.core.config.RealmConfig;
118118
import org.apache.polaris.core.entity.PolarisBaseEntity;
119119
import org.apache.polaris.core.entity.PolarisEntityConstants;
120120
import org.apache.polaris.core.entity.PolarisEntityCore;
@@ -530,8 +530,12 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
530530
List.of(TABLE_DETACH_POLICY, CATALOG_MANAGE_METADATA, CATALOG_MANAGE_CONTENT));
531531
}
532532

533+
private final RealmConfig realmConfig;
534+
533535
@Inject
534-
public PolarisAuthorizerImpl() {}
536+
public PolarisAuthorizerImpl(RealmConfig realmConfig) {
537+
this.realmConfig = realmConfig;
538+
}
535539

536540
/**
537541
* Checks whether the {@code grantedPrivilege} is sufficient to confer {@code desiredPrivilege},
@@ -554,14 +558,12 @@ public boolean matchesOrIsSubsumedBy(
554558

555559
@Override
556560
public void authorizeOrThrow(
557-
@Nonnull CallContext callContext,
558561
@Nonnull AuthenticatedPolarisPrincipal authenticatedPrincipal,
559562
@Nonnull Set<PolarisBaseEntity> activatedEntities,
560563
@Nonnull PolarisAuthorizableOperation authzOp,
561564
@Nullable PolarisResolvedPathWrapper target,
562565
@Nullable PolarisResolvedPathWrapper secondary) {
563566
authorizeOrThrow(
564-
callContext,
565567
authenticatedPrincipal,
566568
activatedEntities,
567569
authzOp,
@@ -571,17 +573,14 @@ public void authorizeOrThrow(
571573

572574
@Override
573575
public void authorizeOrThrow(
574-
@Nonnull CallContext callContext,
575576
@Nonnull AuthenticatedPolarisPrincipal authenticatedPrincipal,
576577
@Nonnull Set<PolarisBaseEntity> activatedEntities,
577578
@Nonnull PolarisAuthorizableOperation authzOp,
578579
@Nullable List<PolarisResolvedPathWrapper> targets,
579580
@Nullable List<PolarisResolvedPathWrapper> secondaries) {
580581
boolean enforceCredentialRotationRequiredState =
581-
callContext
582-
.getRealmConfig()
583-
.getConfig(
584-
FeatureConfiguration.ENFORCE_PRINCIPAL_CREDENTIAL_ROTATION_REQUIRED_CHECKING);
582+
realmConfig.getConfig(
583+
FeatureConfiguration.ENFORCE_PRINCIPAL_CREDENTIAL_ROTATION_REQUIRED_CHECKING);
585584
if (enforceCredentialRotationRequiredState
586585
&& authenticatedPrincipal
587586
.getPrincipalEntity()

‎runtime/service/src/main/java/org/apache/polaris/service/admin/PolarisAdminService.java‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,6 @@ private void authorizeBasicRootOperationOrThrow(PolarisAuthorizableOperation op)
251251
PolarisResolvedPathWrapper rootContainerWrapper =
252252
resolutionManifest.getResolvedRootContainerEntityAsPath();
253253
authorizer.authorizeOrThrow(
254-
callContext,
255254
authenticatedPrincipal,
256255
resolutionManifest.getAllActivatedPrincipalRoleEntities(),
257256
op,
@@ -297,7 +296,6 @@ private void authorizeBasicTopLevelEntityOperationOrThrow(
297296
return;
298297
}
299298
authorizer.authorizeOrThrow(
300-
callContext,
301299
authenticatedPrincipal,
302300
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
303301
op,
@@ -319,7 +317,6 @@ private void authorizeBasicCatalogRoleOperationOrThrow(
319317
throw new NotFoundException("CatalogRole does not exist: %s", catalogRoleName);
320318
}
321319
authorizer.authorizeOrThrow(
322-
callContext,
323320
authenticatedPrincipal,
324321
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
325322
op,
@@ -350,7 +347,6 @@ private void authorizeGrantOnRootContainerToPrincipalRoleOperationOrThrow(
350347
principalRoleName, PolarisEntityType.PRINCIPAL_ROLE);
351348

352349
authorizer.authorizeOrThrow(
353-
callContext,
354350
authenticatedPrincipal,
355351
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
356352
op,
@@ -387,7 +383,6 @@ private void authorizeGrantOnTopLevelEntityToPrincipalRoleOperationOrThrow(
387383
principalRoleName, PolarisEntityType.PRINCIPAL_ROLE);
388384

389385
authorizer.authorizeOrThrow(
390-
callContext,
391386
authenticatedPrincipal,
392387
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
393388
op,
@@ -418,7 +413,6 @@ private void authorizeGrantOnPrincipalRoleToPrincipalOperationOrThrow(
418413
resolutionManifest.getResolvedTopLevelEntity(principalName, PolarisEntityType.PRINCIPAL);
419414

420415
authorizer.authorizeOrThrow(
421-
callContext,
422416
authenticatedPrincipal,
423417
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
424418
op,
@@ -458,7 +452,6 @@ private void authorizeGrantOnCatalogRoleToPrincipalRoleOperationOrThrow(
458452
resolutionManifest.getResolvedPath(catalogRoleName, true);
459453

460454
authorizer.authorizeOrThrow(
461-
callContext,
462455
authenticatedPrincipal,
463456
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
464457
op,
@@ -489,7 +482,6 @@ private void authorizeGrantOnCatalogOperationOrThrow(
489482
PolarisResolvedPathWrapper catalogRoleWrapper =
490483
resolutionManifest.getResolvedPath(catalogRoleName, true);
491484
authorizer.authorizeOrThrow(
492-
callContext,
493485
authenticatedPrincipal,
494486
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
495487
op,
@@ -530,7 +522,6 @@ private void authorizeGrantOnNamespaceOperationOrThrow(
530522
resolutionManifest.getResolvedPath(catalogRoleName, true);
531523

532524
authorizer.authorizeOrThrow(
533-
callContext,
534525
authenticatedPrincipal,
535526
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
536527
op,
@@ -577,7 +568,6 @@ private void authorizeGrantOnTableLikeOperationOrThrow(
577568
resolutionManifest.getResolvedPath(catalogRoleName, true);
578569

579570
authorizer.authorizeOrThrow(
580-
callContext,
581571
authenticatedPrincipal,
582572
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
583573
op,
@@ -617,7 +607,6 @@ private void authorizeGrantOnPolicyOperationOrThrow(
617607
resolutionManifest.getResolvedPath(catalogRoleName, true);
618608

619609
authorizer.authorizeOrThrow(
620-
callContext,
621610
authenticatedPrincipal,
622611
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
623612
op,

‎runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,6 @@ protected void authorizeBasicNamespaceOperationOrThrow(
142142
throw new NoSuchNamespaceException("Namespace does not exist: %s", namespace);
143143
}
144144
authorizer.authorizeOrThrow(
145-
callContext,
146145
authenticatedPrincipal,
147146
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
148147
op,
@@ -177,7 +176,6 @@ protected void authorizeCreateNamespaceUnderNamespaceOperationOrThrow(
177176
throw new NoSuchNamespaceException("Namespace does not exist: %s", parentNamespace);
178177
}
179178
authorizer.authorizeOrThrow(
180-
callContext,
181179
authenticatedPrincipal,
182180
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
183181
op,
@@ -216,7 +214,6 @@ protected void authorizeCreateTableLikeUnderNamespaceOperationOrThrow(
216214
throw new NoSuchNamespaceException("Namespace does not exist: %s", namespace);
217215
}
218216
authorizer.authorizeOrThrow(
219-
callContext,
220217
authenticatedPrincipal,
221218
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
222219
op,
@@ -246,7 +243,6 @@ protected void authorizeBasicTableLikeOperationOrThrow(
246243
throwNotFoundExceptionForTableLikeEntity(identifier, List.of(subType));
247244
}
248245
authorizer.authorizeOrThrow(
249-
callContext,
250246
authenticatedPrincipal,
251247
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
252248
op,
@@ -298,7 +294,6 @@ protected void authorizeCollectionOfTableLikeOperationOrThrow(
298294
"View does not exist: %s", identifier)))
299295
.toList();
300296
authorizer.authorizeOrThrow(
301-
callContext,
302297
authenticatedPrincipal,
303298
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
304299
op,
@@ -368,7 +363,6 @@ protected void authorizeRenameTableLikeOperationOrThrow(
368363
PolarisResolvedPathWrapper secondary =
369364
resolutionManifest.getResolvedPath(dst.namespace(), true);
370365
authorizer.authorizeOrThrow(
371-
callContext,
372366
authenticatedPrincipal,
373367
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
374368
op,

‎runtime/service/src/main/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandler.java‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,6 @@ private void authorizeBasicPolicyOperationOrThrow(
167167
}
168168

169169
authorizer.authorizeOrThrow(
170-
callContext,
171170
authenticatedPrincipal,
172171
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
173172
op,
@@ -212,7 +211,6 @@ private void authorizeBasicCatalogOperationOrThrow(PolarisAuthorizableOperation
212211
throw new NotFoundException("Catalog not found");
213212
}
214213
authorizer.authorizeOrThrow(
215-
callContext,
216214
authenticatedPrincipal,
217215
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
218216
op,
@@ -272,7 +270,6 @@ private void authorizePolicyMappingOperationOrThrow(
272270
determinePolicyMappingOperation(target, targetWrapper, isAttach);
273271

274272
authorizer.authorizeOrThrow(
275-
callContext,
276273
authenticatedPrincipal,
277274
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
278275
op,

‎runtime/service/src/main/java/org/apache/polaris/service/config/ServiceProducers.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -133,12 +133,6 @@ public ResolutionManifestFactory resolutionManifestFactory(ResolverFactory resol
133133
return new ResolutionManifestFactoryImpl(resolverFactory);
134134
}
135135

136-
@Produces
137-
@ApplicationScoped
138-
public PolarisAuthorizer polarisAuthorizer() {
139-
return new PolarisAuthorizerImpl();
140-
}
141-
142136
@Produces
143137
@Singleton
144138
public PolarisDiagnostics polarisDiagnostics() {
@@ -170,6 +164,12 @@ public RealmConfig realmConfig(CallContext callContext) {
170164
return callContext.getRealmConfig();
171165
}
172166

167+
@Produces
168+
@RequestScoped
169+
public PolarisAuthorizer polarisAuthorizer(RealmConfig realmConfig) {
170+
return new PolarisAuthorizerImpl(realmConfig);
171+
}
172+
173173
// Polaris service beans - selected from @Identifier-annotated beans
174174

175175
@Produces

‎runtime/service/src/test/java/org/apache/polaris/service/admin/ManagementServiceTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ public String getAuthenticationScheme() {
201201
return "";
202202
}
203203
},
204-
new PolarisAuthorizerImpl(),
204+
new PolarisAuthorizerImpl(callContext.getRealmConfig()),
205205
new ReservedProperties() {
206206
@Override
207207
public List<String> prefixes() {

‎runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAuthzTestBase.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -228,8 +228,6 @@ public void before(TestInfo testInfo) {
228228
metaStoreManager = managerFactory.getOrCreateMetaStoreManager(realmContext);
229229
userSecretsManager = userSecretsManagerFactory.getOrCreateUserSecretsManager(realmContext);
230230

231-
polarisAuthorizer = new PolarisAuthorizerImpl();
232-
233231
polarisContext =
234232
new PolarisCallContext(
235233
realmContext,
@@ -240,6 +238,8 @@ public void before(TestInfo testInfo) {
240238
callContext = polarisContext;
241239
realmConfig = polarisContext.getRealmConfig();
242240

241+
polarisAuthorizer = new PolarisAuthorizerImpl(polarisContext.getRealmConfig());
242+
243243
PrincipalEntity rootPrincipal =
244244
metaStoreManager.findRootPrincipal(polarisContext).orElseThrow();
245245
this.authenticatedRoot = new AuthenticatedPolarisPrincipal(rootPrincipal, Set.of());

‎runtime/service/src/test/java/org/apache/polaris/service/catalog/AbstractIcebergCatalogTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -313,7 +313,7 @@ public void before(TestInfo testInfo) {
313313
metaStoreManager,
314314
userSecretsManager,
315315
securityContext,
316-
new PolarisAuthorizerImpl(),
316+
new PolarisAuthorizerImpl(polarisContext.getRealmConfig()),
317317
reservedProperties);
318318

319319
String storageLocation = "s3://my-bucket/path/to/data";

‎runtime/service/src/test/java/org/apache/polaris/service/catalog/AbstractIcebergCatalogViewTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ public void before(TestInfo testInfo) {
182182
metaStoreManager,
183183
userSecretsManager,
184184
securityContext,
185-
new PolarisAuthorizerImpl(),
185+
new PolarisAuthorizerImpl(polarisContext.getRealmConfig()),
186186
reservedProperties);
187187
adminService.createCatalog(
188188
new CreateCatalogRequest(

0 commit comments

Comments
 (0)