[#13839] fix(server): Enforce metadata tag permissions on branch-1.3

clients/client-java/src/test/java/org/apache/gravitino/client/integration/test/authorization/TagOperationsAuthorizationIT.java

@@ -258,9 +258,10 @@ public void testAssociateTag() {
         .associateTags(new String[] {"tag3"}, null);
   }
 
+  /** Verify metadata access does not bypass tag permissions when listing or reading tags. */
   @Test
   @Order(7)
-  public void testListTagByMetadata() {
+  public void testListAndGetTagByMetadata() {
     GravitinoMetalake gravitinoMetalake = client.loadMetalake(METALAKE);
     SupportsTags tableSupportTag =
         gravitinoMetalake
@@ -281,6 +282,10 @@ public void testListTagByMetadata() {
     String[] tagsLoadByNormalUser = tableSupportTagByNormalUser.listTags();
     Arrays.sort(tagsLoadByNormalUser);
     assertArrayEquals(new String[] {"tag2", "tag3"}, tagsLoadByNormalUser);
+    assertEquals("tag1", tableSupportTag.getTag("tag1").name());
+    assertEquals("tag2", tableSupportTagByNormalUser.getTag("tag2").name());
+    assertEquals("tag3", tableSupportTagByNormalUser.getTag("tag3").name());
+    assertThrows(ForbiddenException.class, () -> tableSupportTagByNormalUser.getTag("tag1"));
   }
 
   @Test

server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConverter.java

@@ -171,7 +171,7 @@ public static String replaceCanAccessMetadataPrivilege(String expression) {
     return expression.replaceAll(
         AuthorizationExpressionConstants.CAN_ACCESS_METADATA,
         """
-              ( entityType == 'CATALOG' && (%s)) ||
+              (( entityType == 'CATALOG' && (%s)) ||
               ( entityType == 'SCHEMA' && (%s)) ||
               ( entityType == 'TABLE' && (%s)) ||
               ( entityType == 'VIEW' && (%s)) ||
@@ -185,7 +185,7 @@ public static String replaceCanAccessMetadataPrivilege(String expression) {
               ( entityType == 'JOB' && (%s)) ||
               ( entityType == 'JOB_TEMPLATE' && (%s)) ||
               ( entityType == 'COLUMN' && (%s)) ||
-              ( entityType == 'FUNCTION' && (%s))
+              ( entityType == 'FUNCTION' && (%s)))
               """
             .formatted(
                 LOAD_CATALOG_AUTHORIZATION_EXPRESSION,

server/src/test/java/org/apache/gravitino/server/web/rest/authorization/TestMetadataObjectTagAuthorizationExpression.java

@@ -0,0 +1,72 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.gravitino.server.web.rest.authorization;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import com.google.common.collect.ImmutableSet;
+import java.lang.reflect.Method;
+import org.apache.gravitino.server.authorization.annotations.AuthorizationExpression;
+import org.apache.gravitino.server.authorization.expression.AuthorizationExpressionConverter;
+import org.apache.gravitino.server.web.rest.MetadataObjectTagOperations;
+import org.apache.gravitino.server.web.rest.TagOperations;
+import org.junit.jupiter.api.Test;
+
+/** Tests that metadata access cannot bypass tag read authorization. */
+public class TestMetadataObjectTagAuthorizationExpression {
+
+  /** Verify tag reads require both metadata access and tag permission on both REST routes. */
+  @Test
+  public void testGetTagRequiresTagPermission() throws Exception {
+    for (Class<?> resource :
+        new Class<?>[] {MetadataObjectTagOperations.class, TagOperations.class}) {
+      Method method =
+          resource.getMethod(
+              "getTagForObject", String.class, String.class, String.class, String.class);
+      String expression = method.getAnnotation(AuthorizationExpression.class).expression();
+      for (String type : new String[] {"TABLE", "VIEW"}) {
+        MockAuthorizationExpressionEvaluator evaluator =
+            new MockAuthorizationExpressionEvaluator(
+                AuthorizationExpressionConverter.replaceCanAccessMetadataPrivilege(expression)
+                    .replace("entityType", "'" + type + "'"));
+        String context = resource.getSimpleName() + ": " + type;
+        String access = type.equals("TABLE") ? "TABLE::SELECT_TABLE" : "VIEW::SELECT_VIEW";
+        ImmutableSet<String> metadataAccess =
+            ImmutableSet.of("CATALOG::USE_CATALOG", "SCHEMA::USE_SCHEMA", access);
+        assertFalse(evaluator.getResult(metadataAccess), context);
+        for (String tagPrivilege : new String[] {"TAG::APPLY_TAG", "TAG::OWNER"}) {
+          assertFalse(evaluator.getResult(ImmutableSet.of(tagPrivilege)), context);
+          assertTrue(
+              evaluator.getResult(
+                  ImmutableSet.<String>builder().addAll(metadataAccess).add(tagPrivilege).build()),
+              context);
+        }
+        assertFalse(
+            evaluator.getResult(
+                ImmutableSet.<String>builder()
+                    .addAll(metadataAccess)
+                    .add("TAG::APPLY_TAG", "TAG::DENY_APPLY_TAG")
+                    .build()),
+            context);
+        assertTrue(evaluator.getResult(ImmutableSet.of("METALAKE::OWNER")), context);
+      }
+    }
+  }
+}