[littlegrasscao]

Summary

• add SharePermissionEntity persistence for the privileges recipients hold on shares; SELECT is the only privilege so far
• GET /shares/{share}/permissions lists who holds which privilege on the share, by recipient name; any caller may list
• PATCH /shares/{share}/permissions grants and revokes privileges on one share for one or more recipients, then returns the share's permissions. Owner only
  • the body is {"changes": [{"recipientName": "<recipient name>", "add": ["SELECT"], "remove": ["SELECT"]}]}; each change revokes before it grants, and changes apply in request order
  • an update is atomic, as in Databricks UpdatePermissions: every grant and revoke runs in one database transaction, and any failure, such as revoking a privilege the recipient does not hold, rolls back the whole request
  • recipients are looked up before the transaction opens, so an unknown recipient also leaves the permissions unchanged
  • granting a privilege the recipient already holds is a no-op; revoking one it does not hold is 404
  • the share's row lock from server: add provider-admin share entities and CRUD #96 makes concurrent updates of one share's permissions run one at a time, so this holds even when two requests grant or revoke the same privilege together
• deleting a share or a recipient deletes its permissions

Testing

• mvn clean install: 106 tests passed
• SharePermissionAdminServiceTest: owner-only grants, case-insensitive recipient names, idempotent grants, listing by any caller, revokes, 404 for revoking an ungranted privilege, and 400 for null changes or privileges
• SharePermissionUpdateTransactionTest:
  • revoking from one recipient and granting to another, then revoking from a recipient that holds nothing, returns 404; the first recipient still holds SELECT and the second was not granted it
  • the same request ending with an unknown recipient returns 404 and changes nothing
• SharePermissionConcurrencyTest: two concurrent grants of the same privilege both succeed, and two concurrent revokes return 200 and 404