Implement PolicyCatalogHandler Stage 3: GetApplicablePolicies

[HonahX]

This is a follow-up of #1357, and in parallel to #1416. It adds privilege and auth methods for getApplicablePolicies

The tests are in PolicyCatalogHandlerAuthzTest.java

cc: @flyrain

[flyrain]

LGTM. Left questions and minor comments.

[flyrain]

Just for my information: Is this mainly for refreshing the object resolutionManifest in the polarisCatalog? I guess we could give a better name to something like reinitiatCatalog(). Not a blocker though.

[sfc-gh-jojiang]

This is the time when the PolicyCatalog is initialized. The high-level workflow is that for each rest request, we first initialize a PoicyCatalogHandler and put entities into resolutionManifest, resolve and do authorization, if the authorization passed, a PolicyCatalog is initialized to handle the request. So PolicyCatalog object is never re-used after it serves one request

[flyrain]

Q: Does CATALOG_READ_PROPERTIES imply NAMESPACE_READ_PROPERTIES?

[HonahX]

No, CATALOG_READ_PROPERTIES is not a super privilege of NAMESPACE_READ_PROPERTIES.

polaris/polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java

Lines 209 to 216 in 5f2a375

	SUPER_PRIVILEGES.putAll(
	NAMESPACE_READ_PROPERTIES,
	List.of(
	CATALOG_MANAGE_CONTENT,
	CATALOG_MANAGE_METADATA,
	NAMESPACE_FULL_METADATA,
	NAMESPACE_READ_PROPERTIES,
	NAMESPACE_WRITE_PROPERTIES));

Just to confirm: This should be the expected that user have right to getApplicablePolicies on catalog does not necessarily have the right to getApplicablePolicies on namespace?

[flyrain]

Q: is there a namespace level read privilege can cascade to privilege TABLE_READ_PROPERTIES?

[HonahX]

No, only CATALOG_MANAGE_METADATA which is a super privilege implies TABLE_READ_PROPERTIES

polaris/polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java

Lines 217 to 226 in 5f2a375

	SUPER_PRIVILEGES.putAll(
	TABLE_READ_PROPERTIES,
	List.of(
	CATALOG_MANAGE_CONTENT,
	CATALOG_MANAGE_METADATA,
	TABLE_FULL_METADATA,
	TABLE_READ_DATA,
	TABLE_READ_PROPERTIES,
	TABLE_WRITE_DATA,
	TABLE_WRITE_PROPERTIES));