Repository navigation
Conversation
… return null
### What changes were proposed in this pull request?
Allow restricted Rego (`restricted-rego-v1`) column-mask rules to return `null` as a valid branch result (in conditional branches, fallback `else`, or unconditional `mask := null`). Returning `null` signifies that the policy contributes no mask for the current request.
- Updated `RestrictedRegoProgram`:
- `MaskBranch`: allowed `@Nullable MaskAction action`, updated constructor and getter `@Nullable public MaskAction action()`, and removed non-null assertion on action in `validate()`.
- `ColumnMask`: allowed `@Nullable MaskAction fallback`, updated constructor and getter `@Nullable public MaskAction fallback()`, and removed non-null assertion on fallback in `validate()`.
- Updated `RestrictedRegoSourceParser`:
- Added `parseMaskResult()` allowing `null` (mapped to Java `null`) or mask actions.
- Updated error messages when expecting action or null.
- Updated documentation in `docs/policies.md` with grammar update and an example of a column-mask rule returning `null`.
- Updated test suites with comprehensive regression tests:
- Added test cases in `restricted-rego-v1-cases.txt` and regenerated `restricted-rego-v1-cases.golden`.
- Added parser tests in `TestRestrictedRegoSourceParser`.
- Added AST validation and equality tests in `TestRestrictedRegoProgram`.
- Added expression parser facade tests in `TestRestrictedRegoExpressionParserFacade`.
- Added policy management test in `TestPolicyManager`.
### Why are the changes needed?
Restricted Rego column-mask policies need to express that under certain conditions (or by default), no masking should be applied to a column. Returning `null` allows the policy to contribute no mask for the current request, while strictly distinguishing from `action("replace-with-null")` which replaces column values with SQL NULL.
Fix: apache#14059
### Does this PR introduce _any_ user-facing change?
Yes, users can now author `restricted-rego-v1` column-mask rules that return `null` when no masking is desired.
### How was this patch tested?
- Ran `:core:spotlessCheck` and verified spotless formatting passes.
- Ran `:core:coreUnitTest --tests "org.apache.gravitino.policy.rego.*"` and `:core:test` targeting all policy and restricted Rego suites.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Allow restricted Rego (
restricted-rego-v1) column-mask rules to returnnullas a valid branch result (in conditional branches, fallbackelse, or unconditionalmask := null). Returningnullsignifies that the policy contributes no mask for the current request.RestrictedRegoProgram:MaskBranch: allowed@Nullable MaskAction action, updated constructor and getter@Nullable public MaskAction action(), and removed non-null assertion on action invalidate().ColumnMask: allowed@Nullable MaskAction fallback, updated constructor and getter@Nullable public MaskAction fallback(), and removed non-null assertion on fallback invalidate().RestrictedRegoSourceParser:parseMaskResult()allowingnull(mapped to Javanull) or mask actions.docs/policies.mdwith grammar update and an example of a column-mask rule returningnull.restricted-rego-v1-cases.txtand regeneratedrestricted-rego-v1-cases.golden.TestRestrictedRegoSourceParser.TestRestrictedRegoProgram.TestRestrictedRegoExpressionParserFacade.TestPolicyManager.Why are the changes needed?
Restricted Rego column-mask policies need to express that under certain conditions (or by default), no masking should be applied to a column. Returning
nullallows the policy to contribute no mask for the current request, while strictly distinguishing fromaction("replace-with-null")which replaces column values with SQL NULL.Closes #14059
Does this PR introduce any user-facing change?
Yes, users can now author
restricted-rego-v1column-mask rules that returnnullwhen no masking is desired.How was this patch tested?
./gradlew :core:spotlessCheck(BUILD SUCCESSFUL)../gradlew :core:coreUnitTest --tests "org.apache.gravitino.policy.rego.*"(BUILD SUCCESSFUL, 124 tests completed, 0 failed)../gradlew :core:coreUnitTest --tests "org.apache.gravitino.policy.TestPolicyManager.testCreateColumnMaskPolicyWithNullBranch"(BUILD SUCCESSFUL).