Skip to content

Make PolarisAuthorizer RequestScoped #2340

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 15, 2025
Merged

Make PolarisAuthorizer RequestScoped #2340

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,23 +22,20 @@
import jakarta.annotation.Nullable;
import java.util.List;
import java.util.Set;
import org.apache.polaris.core.context.CallContext;
import org.apache.polaris.core.entity.PolarisBaseEntity;
import org.apache.polaris.core.persistence.PolarisResolvedPathWrapper;

/** Interface for invoking authorization checks. */
public interface PolarisAuthorizer {

void authorizeOrThrow(
@Nonnull CallContext callContext,
@Nonnull AuthenticatedPolarisPrincipal authenticatedPrincipal,
@Nonnull Set<PolarisBaseEntity> activatedEntities,
@Nonnull PolarisAuthorizableOperation authzOp,
@Nullable PolarisResolvedPathWrapper target,
@Nullable PolarisResolvedPathWrapper secondary);

void authorizeOrThrow(
@Nonnull CallContext callContext,
@Nonnull AuthenticatedPolarisPrincipal authenticatedPrincipal,
@Nonnull Set<PolarisBaseEntity> activatedEntities,
@Nonnull PolarisAuthorizableOperation authzOp,
Expand Down
17 changes: 8 additions & 9 deletions polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@
import java.util.stream.Collectors;
import org.apache.iceberg.exceptions.ForbiddenException;
import org.apache.polaris.core.config.FeatureConfiguration;
import org.apache.polaris.core.context.CallContext;
import org.apache.polaris.core.config.RealmConfig;
import org.apache.polaris.core.entity.PolarisBaseEntity;
import org.apache.polaris.core.entity.PolarisEntityConstants;
import org.apache.polaris.core.entity.PolarisEntityCore;
Expand Down Expand Up @@ -530,8 +530,12 @@ public class PolarisAuthorizerImpl implements PolarisAuthorizer {
List.of(TABLE_DETACH_POLICY, CATALOG_MANAGE_METADATA, CATALOG_MANAGE_CONTENT));
}

private final RealmConfig realmConfig;

@Inject
public PolarisAuthorizerImpl() {}
public PolarisAuthorizerImpl(RealmConfig realmConfig) {
this.realmConfig = realmConfig;
}

/**
* Checks whether the {@code grantedPrivilege} is sufficient to confer {@code desiredPrivilege},
Expand All @@ -554,14 +558,12 @@ public boolean matchesOrIsSubsumedBy(

@Override
public void authorizeOrThrow(
@Nonnull CallContext callContext,
@Nonnull AuthenticatedPolarisPrincipal authenticatedPrincipal,
@Nonnull Set<PolarisBaseEntity> activatedEntities,
@Nonnull PolarisAuthorizableOperation authzOp,
@Nullable PolarisResolvedPathWrapper target,
@Nullable PolarisResolvedPathWrapper secondary) {
authorizeOrThrow(
callContext,
authenticatedPrincipal,
activatedEntities,
authzOp,
Expand All @@ -571,17 +573,14 @@ public void authorizeOrThrow(

@Override
public void authorizeOrThrow(
@Nonnull CallContext callContext,
@Nonnull AuthenticatedPolarisPrincipal authenticatedPrincipal,
@Nonnull Set<PolarisBaseEntity> activatedEntities,
@Nonnull PolarisAuthorizableOperation authzOp,
@Nullable List<PolarisResolvedPathWrapper> targets,
@Nullable List<PolarisResolvedPathWrapper> secondaries) {
boolean enforceCredentialRotationRequiredState =
callContext
.getRealmConfig()
.getConfig(
FeatureConfiguration.ENFORCE_PRINCIPAL_CREDENTIAL_ROTATION_REQUIRED_CHECKING);
realmConfig.getConfig(
FeatureConfiguration.ENFORCE_PRINCIPAL_CREDENTIAL_ROTATION_REQUIRED_CHECKING);
if (enforceCredentialRotationRequiredState
&& authenticatedPrincipal
.getPrincipalEntity()
Expand Down
11 changes: 0 additions & 11 deletions runtime/service/src/main/java/org/apache/polaris/service/admin/PolarisAdminService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,7 +250,6 @@ private void authorizeBasicRootOperationOrThrow(PolarisAuthorizableOperation op)
PolarisResolvedPathWrapper rootContainerWrapper =
resolutionManifest.getResolvedRootContainerEntityAsPath();
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedPrincipalRoleEntities(),
op,
Expand Down Expand Up @@ -296,7 +295,6 @@ private void authorizeBasicTopLevelEntityOperationOrThrow(
return;
}
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand All @@ -318,7 +316,6 @@ private void authorizeBasicCatalogRoleOperationOrThrow(
throw new NotFoundException("CatalogRole does not exist: %s", catalogRoleName);
}
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -349,7 +346,6 @@ private void authorizeGrantOnRootContainerToPrincipalRoleOperationOrThrow(
principalRoleName, PolarisEntityType.PRINCIPAL_ROLE);

authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -386,7 +382,6 @@ private void authorizeGrantOnTopLevelEntityToPrincipalRoleOperationOrThrow(
principalRoleName, PolarisEntityType.PRINCIPAL_ROLE);

authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -417,7 +412,6 @@ private void authorizeGrantOnPrincipalRoleToPrincipalOperationOrThrow(
resolutionManifest.getResolvedTopLevelEntity(principalName, PolarisEntityType.PRINCIPAL);

authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -457,7 +451,6 @@ private void authorizeGrantOnCatalogRoleToPrincipalRoleOperationOrThrow(
resolutionManifest.getResolvedPath(catalogRoleName, true);

authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -488,7 +481,6 @@ private void authorizeGrantOnCatalogOperationOrThrow(
PolarisResolvedPathWrapper catalogRoleWrapper =
resolutionManifest.getResolvedPath(catalogRoleName, true);
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -529,7 +521,6 @@ private void authorizeGrantOnNamespaceOperationOrThrow(
resolutionManifest.getResolvedPath(catalogRoleName, true);

authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -576,7 +567,6 @@ private void authorizeGrantOnTableLikeOperationOrThrow(
resolutionManifest.getResolvedPath(catalogRoleName, true);

authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -616,7 +606,6 @@ private void authorizeGrantOnPolicyOperationOrThrow(
resolutionManifest.getResolvedPath(catalogRoleName, true);

authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down
6 changes: 0 additions & 6 deletions runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,6 @@ protected void authorizeBasicNamespaceOperationOrThrow(
throw new NoSuchNamespaceException("Namespace does not exist: %s", namespace);
}
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -177,7 +176,6 @@ protected void authorizeCreateNamespaceUnderNamespaceOperationOrThrow(
throw new NoSuchNamespaceException("Namespace does not exist: %s", parentNamespace);
}
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -216,7 +214,6 @@ protected void authorizeCreateTableLikeUnderNamespaceOperationOrThrow(
throw new NoSuchNamespaceException("Namespace does not exist: %s", namespace);
}
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -246,7 +243,6 @@ protected void authorizeBasicTableLikeOperationOrThrow(
throwNotFoundExceptionForTableLikeEntity(identifier, List.of(subType));
}
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -298,7 +294,6 @@ protected void authorizeCollectionOfTableLikeOperationOrThrow(
"View does not exist: %s", identifier)))
.toList();
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -368,7 +363,6 @@ protected void authorizeRenameTableLikeOperationOrThrow(
PolarisResolvedPathWrapper secondary =
resolutionManifest.getResolvedPath(dst.namespace(), true);
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down
3 changes: 0 additions & 3 deletions ...service/src/main/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,7 +167,6 @@ private void authorizeBasicPolicyOperationOrThrow(
}

authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -212,7 +211,6 @@ private void authorizeBasicCatalogOperationOrThrow(PolarisAuthorizableOperation
throw new NotFoundException("Catalog not found");
}
authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down Expand Up @@ -272,7 +270,6 @@ private void authorizePolicyMappingOperationOrThrow(
determinePolicyMappingOperation(target, targetWrapper, isAttach);

authorizer.authorizeOrThrow(
callContext,
authenticatedPrincipal,
resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles(),
op,
Expand Down
12 changes: 6 additions & 6 deletions runtime/service/src/main/java/org/apache/polaris/service/config/ServiceProducers.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,12 +133,6 @@ public ResolutionManifestFactory resolutionManifestFactory(ResolverFactory resol
return new ResolutionManifestFactoryImpl(resolverFactory);
}

@Produces
@ApplicationScoped
public PolarisAuthorizer polarisAuthorizer() {
return new PolarisAuthorizerImpl();
}

@Produces
@Singleton
public PolarisDiagnostics polarisDiagnostics() {
Expand Down Expand Up @@ -170,6 +164,12 @@ public RealmConfig realmConfig(CallContext callContext) {
return callContext.getRealmConfig();
}

@Produces
@RequestScoped
public PolarisAuthorizer polarisAuthorizer(RealmConfig realmConfig) {
return new PolarisAuthorizerImpl(realmConfig);
Copy link
Contributor Author

@XN137 XN137 Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

note: if any custom implementations of PolarisAuthorizer are out there and still need the CallContext for whatever reason, they are free to still inject it here.

}

// Polaris service beans - selected from @Identifier-annotated beans

@Produces
Expand Down
2 changes: 1 addition & 1 deletion runtime/service/src/test/java/org/apache/polaris/service/admin/ManagementServiceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ public String getAuthenticationScheme() {
return "";
}
},
new PolarisAuthorizerImpl(),
new PolarisAuthorizerImpl(callContext.getRealmConfig()),
new ReservedProperties() {
@Override
public List<String> prefixes() {
Expand Down
4 changes: 2 additions & 2 deletions runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAuthzTestBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,8 +224,6 @@ public void before(TestInfo testInfo) {
metaStoreManager = managerFactory.getOrCreateMetaStoreManager(realmContext);
userSecretsManager = userSecretsManagerFactory.getOrCreateUserSecretsManager(realmContext);

polarisAuthorizer = new PolarisAuthorizerImpl();

polarisContext =
new PolarisCallContext(
realmContext,
Expand All @@ -235,6 +233,8 @@ public void before(TestInfo testInfo) {

callContext = polarisContext;

polarisAuthorizer = new PolarisAuthorizerImpl(polarisContext.getRealmConfig());

PrincipalEntity rootPrincipal =
metaStoreManager.findRootPrincipal(polarisContext).orElseThrow();
this.authenticatedRoot = new AuthenticatedPolarisPrincipal(rootPrincipal, Set.of());
Expand Down
2 changes: 1 addition & 1 deletion .../service/src/test/java/org/apache/polaris/service/catalog/AbstractIcebergCatalogTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -311,7 +311,7 @@ public void before(TestInfo testInfo) {
metaStoreManager,
userSecretsManager,
securityContext,
new PolarisAuthorizerImpl(),
new PolarisAuthorizerImpl(polarisContext.getRealmConfig()),
reservedProperties);

String storageLocation = "s3://my-bucket/path/to/data";
Expand Down
2 changes: 1 addition & 1 deletion ...vice/src/test/java/org/apache/polaris/service/catalog/AbstractIcebergCatalogViewTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ public void before(TestInfo testInfo) {
metaStoreManager,
userSecretsManager,
securityContext,
new PolarisAuthorizerImpl(),
new PolarisAuthorizerImpl(polarisContext.getRealmConfig()),
reservedProperties);
adminService.createCatalog(
new CreateCatalogRequest(
Expand Down
2 changes: 1 addition & 1 deletion .../test/java/org/apache/polaris/service/catalog/AbstractPolarisGenericTableCatalogTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@ public void before(TestInfo testInfo) {
metaStoreManager,
userSecretsManager,
securityContext,
new PolarisAuthorizerImpl(),
new PolarisAuthorizerImpl(polarisContext.getRealmConfig()),
reservedProperties);

String storageLocation = "s3://my-bucket/path/to/data";
Expand Down
2 changes: 1 addition & 1 deletion ...e/service/src/test/java/org/apache/polaris/service/catalog/AbstractPolicyCatalogTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,7 @@ public void before(TestInfo testInfo) {
metaStoreManager,
userSecretsManager,
securityContext,
new PolarisAuthorizerImpl(),
new PolarisAuthorizerImpl(callContext.getRealmConfig()),
reservedProperties);

String storageLocation = "s3://my-bucket/path/to/data";
Expand Down