(polaris) branch main updated: Add authenticate() tests for DefaultAuthenticator role selection (#5867)

[ad...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

adutra pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/polaris.git


The following commit(s) were added to refs/heads/main by this push:
     new 9bbe8f5d83 Add authenticate() tests for DefaultAuthenticator role selection (#5867)
9bbe8f5d83 is described below

commit 9bbe8f5d83cd9c7fce4bf6a92afa3e769b44ebeb
Author: Arnab Karmakar <11...@users.noreply.github.com>
AuthorDate: Mon Oct 26 17:52:04 2026 +0530

    Add authenticate() tests for DefaultAuthenticator role selection (#5867)
    
    Cover two role-selection cases through the public authenticate()
    entry point:
    
    - PRINCIPAL_ROLE:ALL takes precedence over a named role in the same
      credentials, activating every granted role.
    - Credentials containing only unprefixed scopes activate no roles,
      even when the principal has grants.
    
    The remaining cases listed in #5092 are already covered by existing
    authenticate() tests.
    
    Fixes #5092
---
 .../service/auth/DefaultAuthenticatorTest.java     | 37 ++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/runtime/service/src/test/java/org/apache/polaris/service/auth/DefaultAuthenticatorTest.java b/runtime/service/src/test/java/org/apache/polaris/service/auth/DefaultAuthenticatorTest.java
index e02d908b22..5e6cb45d3c 100644
--- a/runtime/service/src/test/java/org/apache/polaris/service/auth/DefaultAuthenticatorTest.java
+++ b/runtime/service/src/test/java/org/apache/polaris/service/auth/DefaultAuthenticatorTest.java
@@ -367,6 +367,43 @@ public class DefaultAuthenticatorTest {
     assertInternalPrincipal(result, principalEntity, PRINCIPAL_ROLE1);
   }
 
+  @Test
+  void testPrincipalRoleAllTakesPrecedenceOverNamedRoleInCredentials() {
+    // Given: credentials contain both PRINCIPAL_ROLE:ALL and a specific role name
+    PolarisCredential credentials =
+        PolarisCredential.of(
+            null,
+            PRINCIPAL_NAME,
+            Set.of(
+                DefaultAuthenticator.PRINCIPAL_ROLE_ALL,
+                DefaultAuthenticator.PRINCIPAL_ROLE_PREFIX + PRINCIPAL_ROLE1));
+
+    // When: authenticating the principal
+    PolarisPrincipal result = authenticator.authenticate(identityFor(credentials));
+
+    // Then: ALL wins over the named role and every granted role is activated
+    assertInternalPrincipal(result, principalEntity, PRINCIPAL_ROLE1, PRINCIPAL_ROLE2);
+    assertThat(
+            result.getAttributes().get(PolarisPrincipalAttributes.PRINCIPAL_ROLE_ALL_ATTRIBUTE_KEY))
+        .isTrue();
+  }
+
+  @Test
+  void testOnlyUnprefixedRolesInCredentialsYieldsNoActiveRoles() {
+    // Given: credentials whose scopes lack the PRINCIPAL_ROLE: prefix (invalid for activation)
+    PolarisCredential credentials =
+        PolarisCredential.of(null, PRINCIPAL_NAME, Set.of("unprefixed-role", "other-role"));
+
+    // When: authenticating the principal
+    PolarisPrincipal result = authenticator.authenticate(identityFor(credentials));
+
+    // Then: no roles are activated even though the principal has grants in the metastore
+    assertInternalPrincipal(result, principalEntity);
+    assertThat(
+            result.getAttributes().get(PolarisPrincipalAttributes.PRINCIPAL_ROLE_ALL_ATTRIBUTE_KEY))
+        .isFalse();
+  }
+
   @Test
   void testEmptyRolesRequestedReturnsEmptyRoles() {
     // Given: credentials with empty roles set