fix: access revocation maxcompute (#327)

Author: bearaujus

plugins/providers/maxcompute/external.go

@@ -571,6 +571,13 @@ func (p *provider) revokeTableRolesFromMember(ctx context.Context, pc *domain.Pr
 	roleQuery := strings.Join(slices.GenericsStandardizeSlice(roles), ", ")
 	var query = fmt.Sprintf("REVOKE %s ON TABLE `%s`.`%s`.`%s` FROM USER `%s`", roleQuery, project, schema, table, ramAccountId)
 	if _, err = odpsExecuteQueryOnSecurityManager(ctx, invoker, query); err != nil {
+		// If the table no longer exists in MaxCompute there is nothing left to revoke,
+		// so treat it as a successful no-op. Otherwise a dropped table would permanently
+		// block stale-grant cleanup (e.g. auto-access-restoration). This mirrors the
+		// NoSuchObject handling in revokeProjectRolesFromMember.
+		if isTableNotFoundErr(err) {
+			return nil
+		}
 		var restErr restclient.HttpError
 		if errors.As(err, &restErr) && restErr.ErrorMessage != nil {
 			return fmt.Errorf("fail to revoke table role from '%s.%s.%s': %s", project, schema, table, restErr.ErrorMessage.Message)
@@ -580,6 +587,16 @@ func (p *provider) revokeTableRolesFromMember(ctx context.Context, pc *domain.Pr
 	return nil
 }
 
+// isTableNotFoundErr reports whether err is a MaxCompute "table not found" error
+// (ODPS-0130131). When revoking a role on a table that has already been dropped,
+// the grant is effectively gone, so callers can treat this as a no-op.
+func isTableNotFoundErr(err error) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(err.Error(), "ODPS-0130131")
+}
+
 // ---------------------------------------------------------------------------------------------------------------------
 // External Client
 // ---------------------------------------------------------------------------------------------------------------------

plugins/providers/maxcompute/external_test.go

@@ -3,6 +3,7 @@ package maxcompute
 import (
 	"context"
 	"errors"
+	"fmt"
 	"reflect"
 	"testing"
 
@@ -64,6 +65,42 @@ func TestODPSShouldRetry(t *testing.T) {
 	}
 }
 
+func TestIsTableNotFoundErr(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "nil error",
+			err:  nil,
+			want: false,
+		},
+		{
+			name: "odps table not found error",
+			err:  errors.New("ODPS-0130131:Table not found - 'haryo_poc_playground.a_table' table not found"),
+			want: true,
+		},
+		{
+			name: "wrapped odps table not found error",
+			err:  fmt.Errorf("fail to revoke: %w", errors.New("ODPS-0130131:Table not found")),
+			want: true,
+		},
+		{
+			name: "unrelated error",
+			err:  errors.New("read: connection reset by peer"),
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isTableNotFoundErr(tt.err); got != tt.want {
+				t.Errorf("isTableNotFoundErr() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
 func TestBatchLoadTablesSkippingFailuresSplitsOnlyFailedBatch(t *testing.T) {
 	p := &provider{logger: log.NewNoop()}
 	input := []string{"a", "b", "bad", "c", "d", "e", "f", "g"}