@Override
  public TSStatus checkUserPathPrivilegesGrantOpt(
      String username, List<? extends PartialPath> paths, PrivilegeType permission) {
    User user = iAuthorCache.getUserCache(username);
    if (user != null) {
      if (user.isOpenIdUser()) {
        return RpcUtils.getStatus(TSStatusCode.SUCCESS_STATUS);
      }
      for (PartialPath path : paths) {
        if (!user.checkPathPrivilegeGrantOpt(path, permission)) {
          boolean checkFromRole = false;
          for (String roleName : user.getRoleSet()) {
            Role role = iAuthorCache.getRoleCache(roleName);
            if (role == null) {
              return checkPrivilegeFromConfigNode(
                      new TCheckUserPrivilegesReq(
                              username,
                              PrivilegeModelType.TREE.ordinal(),
                              permission.ordinal(),
                              true)
                          .setPaths(AuthUtils.serializePartialPathList(paths)))
                  .getStatus();
            }
            if (role.checkPathPrivilegeGrantOpt(path, permission)) {
              checkFromRole = true;
              break;
            }
          }
          if (!checkFromRole) {
            return RpcUtils.getStatus(TSStatusCode.NO_PERMISSION);
          }
        }
      }
      return RpcUtils.getStatus(TSStatusCode.SUCCESS_STATUS);
    } else {
      return checkPrivilegeFromConfigNode(
              new TCheckUserPrivilegesReq(
                      username, PrivilegeModelType.TREE.ordinal(), permission.ordinal(), true)
                  .setPaths(AuthUtils.serializePartialPathList(paths)))
          .getStatus();
    }
  }
-- check user privileges SYSTEM, TREE, RELATIONAL-- *
iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java