You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "dimas-b (via GitHub)" <gi...@apache.org> on 2026/05/26 02:29:22 UTC
[PR] Move tests for direct credential vending call paths to IcebergCatalogHandlerTest [polaris]
dimas-b opened a new pull request, #4540:
URL: https://github.com/apache/polaris/pull/4540
* AbstractIcebergCatalogHandlerAuthzTest was not the right place for these mockito-based tests.
* Enhance the tests a bit to validate how actual credential values are handled.
<!--
๐ Describe what changes you're proposing, especially breaking or user-facing changes.
๐ See https://github.com/apache/polaris/blob/main/CONTRIBUTING.md for more.
-->
## Checklist
- [ ] ๐ก๏ธ Don't disclose security issues! (contact security@apache.org)
- [ ] ๐ Clearly explained why the changes are needed, or linked related issues: Fixes #
- [ ] ๐งช Added/updated tests with good coverage, or manually tested (and explained how)
- [ ] ๐ก Added comments for complex logic
- [ ] ๐งพ Updated `CHANGELOG.md` (if needed)
- [ ] ๐ Updated documentation in `site/content/in-dev/unreleased` (if needed)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Move tests for direct credential vending call paths to IcebergCatalogHandlerTest [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b merged PR #4540:
URL: https://github.com/apache/polaris/pull/4540
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Move tests for direct credential vending call paths to IcebergCatalogHandlerTest [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #4540:
URL: https://github.com/apache/polaris/pull/4540#discussion_r3314061483
##########
runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerTest.java:
##########
@@ -0,0 +1,232 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.polaris.service.catalog.iceberg;
+
+import static org.apache.polaris.service.catalog.AccessDelegationMode.VENDED_CREDENTIALS;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import jakarta.enterprise.inject.Instance;
+import java.time.Clock;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import org.apache.iceberg.BaseTable;
+import org.apache.iceberg.TableMetadata;
+import org.apache.iceberg.TableOperations;
+import org.apache.iceberg.catalog.Catalog;
+import org.apache.iceberg.catalog.Namespace;
+import org.apache.iceberg.catalog.TableIdentifier;
+import org.apache.iceberg.rest.credentials.Credential;
+import org.apache.iceberg.rest.responses.ImmutableLoadCredentialsResponse;
+import org.apache.polaris.core.PolarisDiagnostics;
+import org.apache.polaris.core.auth.PolarisAuthorizer;
+import org.apache.polaris.core.auth.PolarisPrincipal;
+import org.apache.polaris.core.catalog.LocalCatalogFactory;
+import org.apache.polaris.core.config.RealmConfig;
+import org.apache.polaris.core.context.CallContext;
+import org.apache.polaris.core.context.RealmContext;
+import org.apache.polaris.core.credentials.PolarisCredentialManager;
+import org.apache.polaris.core.entity.CatalogEntity;
+import org.apache.polaris.core.entity.PolarisBaseEntity;
+import org.apache.polaris.core.entity.PolarisEntity;
+import org.apache.polaris.core.entity.PolarisEntitySubType;
+import org.apache.polaris.core.entity.PolarisEntityType;
+import org.apache.polaris.core.entity.table.IcebergTableLikeEntity;
+import org.apache.polaris.core.persistence.PolarisMetaStoreManager;
+import org.apache.polaris.core.persistence.PolarisResolvedPathWrapper;
+import org.apache.polaris.core.persistence.resolver.PolarisResolutionManifest;
+import org.apache.polaris.core.persistence.resolver.ResolutionManifestFactory;
+import org.apache.polaris.core.persistence.resolver.ResolverFactory;
+import org.apache.polaris.core.storage.StorageAccessConfig;
+import org.apache.polaris.service.catalog.AccessDelegationModeResolver;
+import org.apache.polaris.service.catalog.CatalogPrefixParser;
+import org.apache.polaris.service.catalog.io.StorageAccessConfigProvider;
+import org.apache.polaris.service.config.ReservedProperties;
+import org.apache.polaris.service.events.EventAttributeMap;
+import org.apache.polaris.service.reporting.PolarisMetricsReporter;
+import org.junit.jupiter.api.Test;
+
+class IcebergCatalogHandlerTest {
+
+ private static final String CATALOG_NAME = "test";
+ private static final Namespace NS1 = Namespace.of("ns1");
+ private static final TableIdentifier TABLE2 = TableIdentifier.of(NS1, "table2");
+
+ private final PolarisResolutionManifest resolutionManifest =
+ mock(PolarisResolutionManifest.class);
+ private final PolarisResolvedPathWrapper resolvedPath = mock(PolarisResolvedPathWrapper.class);
+ private final CatalogEntity catalogEntity = mock(CatalogEntity.class);
+ private final CallContext callContext = mock(CallContext.class);
+ private final RealmConfig realmConfig = mock(RealmConfig.class);
+ private final LocalCatalogFactory localCatalogFactory = mock(LocalCatalogFactory.class);
+ private final AccessDelegationModeResolver accessDelegationModeResolver =
+ mock(AccessDelegationModeResolver.class);
+ private final StorageAccessConfigProvider storageAccessConfigProvider =
+ mock(StorageAccessConfigProvider.class);
+
+ @SuppressWarnings({"unchecked", "rawtypes"})
+ private IcebergCatalogHandler newHandler() {
+ when(callContext.getRealmConfig()).thenReturn(realmConfig);
+ when(callContext.getRealmContext()).thenReturn(mock(RealmContext.class));
+
+ // Resolution manifest factory always returns our pre-configured manifest mock so we can
+ // observe and stub interactions with it.
+ ResolutionManifestFactory resolutionManifestFactory = mock(ResolutionManifestFactory.class);
+ when(resolutionManifestFactory.createResolutionManifest(any(), any()))
+ .thenReturn(resolutionManifest);
+
+ // Authorization path: any resolved path lookup returns a non-null wrapper so the
+ // "not found" check in CatalogHandler#authorizeBasicTableLikeOperationsOrThrow passes.
+ when(resolutionManifest.getResolvedPath(any(), any(), anyBoolean())).thenReturn(resolvedPath);
+ when(resolutionManifest.getResolvedPath(any(), any())).thenReturn(resolvedPath);
+ when(resolutionManifest.getResolvedPath(any())).thenReturn(resolvedPath);
+ when(resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles()).thenReturn(Set.of());
+
+ // initializeCatalog() reads the resolved catalog entity to decide federated vs. local.
+ // Return a CatalogEntity without a connection config so we take the local-catalog path.
+ when(resolutionManifest.getResolvedCatalogEntity()).thenReturn(catalogEntity);
+ when(catalogEntity.getConnectionConfigInfoDpo()).thenReturn(null);
+
+ return ImmutableIcebergCatalogHandler.builder()
Review Comment:
For the tests added in this PR the main purpose (as far as I can tell) was validating specific and somewhat complex code paths... These tests used to use Mockito for that and they continue to use Mockito. I think that is appropriate for the present purpose.
I would not want to mix Mockito with `@QuarkusTest` though. I think it would defeat the purpose of running a full server.
Perhaps there is a better way to structure and test the related code, but for now I'm moving these tests out of `AbstractIcebergCatalogHandlerAuthzTest` specifically to reduce the amount of mocks in the server :slightly_smiling_face: ... this proved to complicate the refactoring in #4136 ... I should have mentioned that PR upfront :facepalm:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Move tests for direct credential vending call paths to IcebergCatalogHandlerTest [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #4540:
URL: https://github.com/apache/polaris/pull/4540#discussion_r3314067304
##########
runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerTest.java:
##########
@@ -0,0 +1,232 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.polaris.service.catalog.iceberg;
+
+import static org.apache.polaris.service.catalog.AccessDelegationMode.VENDED_CREDENTIALS;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import jakarta.enterprise.inject.Instance;
+import java.time.Clock;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import org.apache.iceberg.BaseTable;
+import org.apache.iceberg.TableMetadata;
+import org.apache.iceberg.TableOperations;
+import org.apache.iceberg.catalog.Catalog;
+import org.apache.iceberg.catalog.Namespace;
+import org.apache.iceberg.catalog.TableIdentifier;
+import org.apache.iceberg.rest.credentials.Credential;
+import org.apache.iceberg.rest.responses.ImmutableLoadCredentialsResponse;
+import org.apache.polaris.core.PolarisDiagnostics;
+import org.apache.polaris.core.auth.PolarisAuthorizer;
+import org.apache.polaris.core.auth.PolarisPrincipal;
+import org.apache.polaris.core.catalog.LocalCatalogFactory;
+import org.apache.polaris.core.config.RealmConfig;
+import org.apache.polaris.core.context.CallContext;
+import org.apache.polaris.core.context.RealmContext;
+import org.apache.polaris.core.credentials.PolarisCredentialManager;
+import org.apache.polaris.core.entity.CatalogEntity;
+import org.apache.polaris.core.entity.PolarisBaseEntity;
+import org.apache.polaris.core.entity.PolarisEntity;
+import org.apache.polaris.core.entity.PolarisEntitySubType;
+import org.apache.polaris.core.entity.PolarisEntityType;
+import org.apache.polaris.core.entity.table.IcebergTableLikeEntity;
+import org.apache.polaris.core.persistence.PolarisMetaStoreManager;
+import org.apache.polaris.core.persistence.PolarisResolvedPathWrapper;
+import org.apache.polaris.core.persistence.resolver.PolarisResolutionManifest;
+import org.apache.polaris.core.persistence.resolver.ResolutionManifestFactory;
+import org.apache.polaris.core.persistence.resolver.ResolverFactory;
+import org.apache.polaris.core.storage.StorageAccessConfig;
+import org.apache.polaris.service.catalog.AccessDelegationModeResolver;
+import org.apache.polaris.service.catalog.CatalogPrefixParser;
+import org.apache.polaris.service.catalog.io.StorageAccessConfigProvider;
+import org.apache.polaris.service.config.ReservedProperties;
+import org.apache.polaris.service.events.EventAttributeMap;
+import org.apache.polaris.service.reporting.PolarisMetricsReporter;
+import org.junit.jupiter.api.Test;
+
+class IcebergCatalogHandlerTest {
+
+ private static final String CATALOG_NAME = "test";
+ private static final Namespace NS1 = Namespace.of("ns1");
+ private static final TableIdentifier TABLE2 = TableIdentifier.of(NS1, "table2");
+
+ private final PolarisResolutionManifest resolutionManifest =
+ mock(PolarisResolutionManifest.class);
+ private final PolarisResolvedPathWrapper resolvedPath = mock(PolarisResolvedPathWrapper.class);
+ private final CatalogEntity catalogEntity = mock(CatalogEntity.class);
+ private final CallContext callContext = mock(CallContext.class);
+ private final RealmConfig realmConfig = mock(RealmConfig.class);
+ private final LocalCatalogFactory localCatalogFactory = mock(LocalCatalogFactory.class);
+ private final AccessDelegationModeResolver accessDelegationModeResolver =
+ mock(AccessDelegationModeResolver.class);
+ private final StorageAccessConfigProvider storageAccessConfigProvider =
+ mock(StorageAccessConfigProvider.class);
+
+ @SuppressWarnings({"unchecked", "rawtypes"})
+ private IcebergCatalogHandler newHandler() {
+ when(callContext.getRealmConfig()).thenReturn(realmConfig);
+ when(callContext.getRealmContext()).thenReturn(mock(RealmContext.class));
+
+ // Resolution manifest factory always returns our pre-configured manifest mock so we can
+ // observe and stub interactions with it.
+ ResolutionManifestFactory resolutionManifestFactory = mock(ResolutionManifestFactory.class);
+ when(resolutionManifestFactory.createResolutionManifest(any(), any()))
+ .thenReturn(resolutionManifest);
+
+ // Authorization path: any resolved path lookup returns a non-null wrapper so the
+ // "not found" check in CatalogHandler#authorizeBasicTableLikeOperationsOrThrow passes.
+ when(resolutionManifest.getResolvedPath(any(), any(), anyBoolean())).thenReturn(resolvedPath);
+ when(resolutionManifest.getResolvedPath(any(), any())).thenReturn(resolvedPath);
+ when(resolutionManifest.getResolvedPath(any())).thenReturn(resolvedPath);
+ when(resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles()).thenReturn(Set.of());
+
+ // initializeCatalog() reads the resolved catalog entity to decide federated vs. local.
+ // Return a CatalogEntity without a connection config so we take the local-catalog path.
+ when(resolutionManifest.getResolvedCatalogEntity()).thenReturn(catalogEntity);
+ when(catalogEntity.getConnectionConfigInfoDpo()).thenReturn(null);
+
+ return ImmutableIcebergCatalogHandler.builder()
+ .catalogName(CATALOG_NAME)
+ .polarisPrincipal(PolarisPrincipal.of("test", Map.of(), Set.of()))
+ .callContext(callContext)
+ .metaStoreManager(mock(PolarisMetaStoreManager.class))
+ .resolutionManifestFactory(resolutionManifestFactory)
+ .authorizer(mock(PolarisAuthorizer.class))
+ .diagnostics(mock(PolarisDiagnostics.class))
+ .credentialManager(mock(PolarisCredentialManager.class))
+ .federatedCatalogFactories(mock(Instance.class))
+ .prefixParser(mock(CatalogPrefixParser.class))
+ .resolverFactory(mock(ResolverFactory.class))
+ .localCatalogFactory(localCatalogFactory)
+ .reservedProperties(mock(ReservedProperties.class))
+ .catalogHandlerUtils(mock(CatalogHandlerUtils.class))
+ .storageAccessConfigProvider(storageAccessConfigProvider)
+ .eventAttributeMap(mock(EventAttributeMap.class))
+ .metricsReporter(mock(PolarisMetricsReporter.class))
+ .clock(mock(Clock.class))
+ .accessDelegationModeResolver(accessDelegationModeResolver)
+ .build();
+ }
+
+ /**
+ * For external (non-Polaris) catalogs, loadCredentials must skip the optimized
+ * entity-properties-based path and fall through to a full loadTable on the underlying catalog,
+ * propagating the credentials the storage provider returns for that table.
+ */
+ @Test
+ void loadCredentialsFallsBackForExternalCatalog() {
+ String tableLocation = "s3://fake-bucket/tables/table2";
+ Map<String, String> fakeCredentials =
+ Map.of("fake.access.key", "AKIAFAKE", "fake.secret.key", "fakeSecret");
+
+ TableMetadata metadata = mock(TableMetadata.class);
+ when(metadata.location()).thenReturn(tableLocation);
+ when(metadata.properties()).thenReturn(Map.of());
+ TableOperations ops = mock(TableOperations.class);
+ when(ops.current()).thenReturn(metadata);
+ BaseTable table = mock(BaseTable.class);
+ when(table.operations()).thenReturn(ops);
+
+ Catalog externalCatalog = mock(Catalog.class);
+ when(externalCatalog.loadTable(TABLE2)).thenReturn(table);
+ when(localCatalogFactory.createCatalog(any())).thenReturn(externalCatalog);
+
+ // VENDED_CREDENTIALS is what triggers the handler to attach credentials to the response.
+ when(accessDelegationModeResolver.resolve(any(), any()))
+ .thenReturn(Optional.of(VENDED_CREDENTIALS));
+
+ StorageAccessConfig storageAccessConfig =
+ StorageAccessConfig.builder()
+ .putCredential("fake.access.key", "AKIAFAKE")
+ .putCredential("fake.secret.key", "fakeSecret")
+ .build();
+ when(storageAccessConfigProvider.getStorageAccessConfig(any(), any(), any(), any(), any()))
+ .thenReturn(storageAccessConfig);
+
+ IcebergCatalogHandler handler = newHandler();
+
+ ImmutableLoadCredentialsResponse response = handler.loadCredentials(TABLE2, Optional.empty());
+
+ verify(externalCatalog).loadTable(TABLE2);
+ assertThat(response.credentials())
+ .singleElement()
+ .satisfies(
+ (Credential c) -> {
+ assertThat(c.prefix()).isEqualTo(tableLocation);
+ assertThat(c.config()).containsExactlyInAnyOrderEntriesOf(fakeCredentials);
+ });
+ }
+
+ /**
+ * For native Polaris (Iceberg) catalogs, loadCredentials takes the optimized path: it reads the
+ * table location from the entity's internal properties and vends credentials without loading the
+ * full table metadata. The underlying catalog's loadTable must NOT be invoked.
+ */
+ @Test
+ void loadCredentialsUsesOptimizedPathForIcebergCatalog() {
+ String tableLocation = "s3://fake-bucket/tables/table2";
+ Map<String, String> fakeCredentials =
+ Map.of("fake.access.key", "AKIAFAKE", "fake.secret.key", "fakeSecret");
+
+ // The entity returned via the resolution manifest carries the table location in its internal
+ // properties; that's what lets the optimized path skip a full loadTable.
+ PolarisEntity leafEntity =
+ new PolarisEntity(
+ new PolarisBaseEntity.Builder()
+ .typeCode(PolarisEntityType.TABLE_LIKE.getCode())
+ .subTypeCode(PolarisEntitySubType.ICEBERG_TABLE.getCode())
+ .name(TABLE2.name())
+ .internalPropertiesAsMap(Map.of(IcebergTableLikeEntity.LOCATION, tableLocation))
+ .build());
+ when(resolvedPath.getRawLeafEntity()).thenReturn(leafEntity);
+
+ IcebergCatalog icebergCatalog = mock(IcebergCatalog.class);
+ when(localCatalogFactory.createCatalog(any())).thenReturn(icebergCatalog);
+
+ StorageAccessConfig storageAccessConfig =
+ StorageAccessConfig.builder()
+ .putCredential("fake.access.key", "AKIAFAKE")
+ .putCredential("fake.secret.key", "fakeSecret")
+ .build();
+ when(storageAccessConfigProvider.getStorageAccessConfig(any(), any(), any(), any(), any()))
+ .thenReturn(storageAccessConfig);
+
+ IcebergCatalogHandler handler = newHandler();
+
+ ImmutableLoadCredentialsResponse response = handler.loadCredentials(TABLE2, Optional.empty());
+
+ // The whole point of the optimized path is to skip loadTable on the underlying catalog.
+ verify(icebergCatalog, never()).loadTable(any());
+ assertThat(response.credentials())
+ .singleElement()
+ .satisfies(
+ (Credential c) -> {
+ assertThat(c.prefix()).isEqualTo(tableLocation);
+ assertThat(c.config()).containsExactlyInAnyOrderEntriesOf(fakeCredentials);
+ });
+ }
+}
Review Comment:
will do :+1:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Move tests for direct credential vending call paths to IcebergCatalogHandlerTest [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #4540:
URL: https://github.com/apache/polaris/pull/4540#discussion_r3321974137
##########
runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerTest.java:
##########
@@ -0,0 +1,232 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.polaris.service.catalog.iceberg;
+
+import static org.apache.polaris.service.catalog.AccessDelegationMode.VENDED_CREDENTIALS;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import jakarta.enterprise.inject.Instance;
+import java.time.Clock;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import org.apache.iceberg.BaseTable;
+import org.apache.iceberg.TableMetadata;
+import org.apache.iceberg.TableOperations;
+import org.apache.iceberg.catalog.Catalog;
+import org.apache.iceberg.catalog.Namespace;
+import org.apache.iceberg.catalog.TableIdentifier;
+import org.apache.iceberg.rest.credentials.Credential;
+import org.apache.iceberg.rest.responses.ImmutableLoadCredentialsResponse;
+import org.apache.polaris.core.PolarisDiagnostics;
+import org.apache.polaris.core.auth.PolarisAuthorizer;
+import org.apache.polaris.core.auth.PolarisPrincipal;
+import org.apache.polaris.core.catalog.LocalCatalogFactory;
+import org.apache.polaris.core.config.RealmConfig;
+import org.apache.polaris.core.context.CallContext;
+import org.apache.polaris.core.context.RealmContext;
+import org.apache.polaris.core.credentials.PolarisCredentialManager;
+import org.apache.polaris.core.entity.CatalogEntity;
+import org.apache.polaris.core.entity.PolarisBaseEntity;
+import org.apache.polaris.core.entity.PolarisEntity;
+import org.apache.polaris.core.entity.PolarisEntitySubType;
+import org.apache.polaris.core.entity.PolarisEntityType;
+import org.apache.polaris.core.entity.table.IcebergTableLikeEntity;
+import org.apache.polaris.core.persistence.PolarisMetaStoreManager;
+import org.apache.polaris.core.persistence.PolarisResolvedPathWrapper;
+import org.apache.polaris.core.persistence.resolver.PolarisResolutionManifest;
+import org.apache.polaris.core.persistence.resolver.ResolutionManifestFactory;
+import org.apache.polaris.core.persistence.resolver.ResolverFactory;
+import org.apache.polaris.core.storage.StorageAccessConfig;
+import org.apache.polaris.service.catalog.AccessDelegationModeResolver;
+import org.apache.polaris.service.catalog.CatalogPrefixParser;
+import org.apache.polaris.service.catalog.io.StorageAccessConfigProvider;
+import org.apache.polaris.service.config.ReservedProperties;
+import org.apache.polaris.service.events.EventAttributeMap;
+import org.apache.polaris.service.reporting.PolarisMetricsReporter;
+import org.junit.jupiter.api.Test;
+
+class IcebergCatalogHandlerTest {
+
+ private static final String CATALOG_NAME = "test";
+ private static final Namespace NS1 = Namespace.of("ns1");
+ private static final TableIdentifier TABLE2 = TableIdentifier.of(NS1, "table2");
+
+ private final PolarisResolutionManifest resolutionManifest =
+ mock(PolarisResolutionManifest.class);
+ private final PolarisResolvedPathWrapper resolvedPath = mock(PolarisResolvedPathWrapper.class);
+ private final CatalogEntity catalogEntity = mock(CatalogEntity.class);
+ private final CallContext callContext = mock(CallContext.class);
+ private final RealmConfig realmConfig = mock(RealmConfig.class);
+ private final LocalCatalogFactory localCatalogFactory = mock(LocalCatalogFactory.class);
+ private final AccessDelegationModeResolver accessDelegationModeResolver =
+ mock(AccessDelegationModeResolver.class);
+ private final StorageAccessConfigProvider storageAccessConfigProvider =
+ mock(StorageAccessConfigProvider.class);
+
+ @SuppressWarnings({"unchecked", "rawtypes"})
+ private IcebergCatalogHandler newHandler() {
+ when(callContext.getRealmConfig()).thenReturn(realmConfig);
+ when(callContext.getRealmContext()).thenReturn(mock(RealmContext.class));
+
+ // Resolution manifest factory always returns our pre-configured manifest mock so we can
+ // observe and stub interactions with it.
+ ResolutionManifestFactory resolutionManifestFactory = mock(ResolutionManifestFactory.class);
+ when(resolutionManifestFactory.createResolutionManifest(any(), any()))
+ .thenReturn(resolutionManifest);
+
+ // Authorization path: any resolved path lookup returns a non-null wrapper so the
+ // "not found" check in CatalogHandler#authorizeBasicTableLikeOperationsOrThrow passes.
+ when(resolutionManifest.getResolvedPath(any(), any(), anyBoolean())).thenReturn(resolvedPath);
+ when(resolutionManifest.getResolvedPath(any(), any())).thenReturn(resolvedPath);
+ when(resolutionManifest.getResolvedPath(any())).thenReturn(resolvedPath);
+ when(resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles()).thenReturn(Set.of());
+
+ // initializeCatalog() reads the resolved catalog entity to decide federated vs. local.
+ // Return a CatalogEntity without a connection config so we take the local-catalog path.
+ when(resolutionManifest.getResolvedCatalogEntity()).thenReturn(catalogEntity);
+ when(catalogEntity.getConnectionConfigInfoDpo()).thenReturn(null);
+
+ return ImmutableIcebergCatalogHandler.builder()
+ .catalogName(CATALOG_NAME)
+ .polarisPrincipal(PolarisPrincipal.of("test", Map.of(), Set.of()))
+ .callContext(callContext)
+ .metaStoreManager(mock(PolarisMetaStoreManager.class))
+ .resolutionManifestFactory(resolutionManifestFactory)
+ .authorizer(mock(PolarisAuthorizer.class))
+ .diagnostics(mock(PolarisDiagnostics.class))
+ .credentialManager(mock(PolarisCredentialManager.class))
+ .federatedCatalogFactories(mock(Instance.class))
+ .prefixParser(mock(CatalogPrefixParser.class))
+ .resolverFactory(mock(ResolverFactory.class))
+ .localCatalogFactory(localCatalogFactory)
+ .reservedProperties(mock(ReservedProperties.class))
+ .catalogHandlerUtils(mock(CatalogHandlerUtils.class))
+ .storageAccessConfigProvider(storageAccessConfigProvider)
+ .eventAttributeMap(mock(EventAttributeMap.class))
+ .metricsReporter(mock(PolarisMetricsReporter.class))
+ .clock(mock(Clock.class))
+ .accessDelegationModeResolver(accessDelegationModeResolver)
+ .build();
+ }
+
+ /**
+ * For external (non-Polaris) catalogs, loadCredentials must skip the optimized
+ * entity-properties-based path and fall through to a full loadTable on the underlying catalog,
+ * propagating the credentials the storage provider returns for that table.
+ */
+ @Test
+ void loadCredentialsFallsBackForExternalCatalog() {
+ String tableLocation = "s3://fake-bucket/tables/table2";
+ Map<String, String> fakeCredentials =
+ Map.of("fake.access.key", "AKIAFAKE", "fake.secret.key", "fakeSecret");
+
+ TableMetadata metadata = mock(TableMetadata.class);
+ when(metadata.location()).thenReturn(tableLocation);
+ when(metadata.properties()).thenReturn(Map.of());
+ TableOperations ops = mock(TableOperations.class);
+ when(ops.current()).thenReturn(metadata);
+ BaseTable table = mock(BaseTable.class);
+ when(table.operations()).thenReturn(ops);
+
+ Catalog externalCatalog = mock(Catalog.class);
+ when(externalCatalog.loadTable(TABLE2)).thenReturn(table);
+ when(localCatalogFactory.createCatalog(any())).thenReturn(externalCatalog);
+
+ // VENDED_CREDENTIALS is what triggers the handler to attach credentials to the response.
+ when(accessDelegationModeResolver.resolve(any(), any()))
+ .thenReturn(Optional.of(VENDED_CREDENTIALS));
+
+ StorageAccessConfig storageAccessConfig =
+ StorageAccessConfig.builder()
+ .putCredential("fake.access.key", "AKIAFAKE")
+ .putCredential("fake.secret.key", "fakeSecret")
+ .build();
+ when(storageAccessConfigProvider.getStorageAccessConfig(any(), any(), any(), any(), any()))
+ .thenReturn(storageAccessConfig);
+
+ IcebergCatalogHandler handler = newHandler();
+
+ ImmutableLoadCredentialsResponse response = handler.loadCredentials(TABLE2, Optional.empty());
+
+ verify(externalCatalog).loadTable(TABLE2);
+ assertThat(response.credentials())
+ .singleElement()
+ .satisfies(
+ (Credential c) -> {
+ assertThat(c.prefix()).isEqualTo(tableLocation);
+ assertThat(c.config()).containsExactlyInAnyOrderEntriesOf(fakeCredentials);
+ });
+ }
+
+ /**
+ * For native Polaris (Iceberg) catalogs, loadCredentials takes the optimized path: it reads the
+ * table location from the entity's internal properties and vends credentials without loading the
+ * full table metadata. The underlying catalog's loadTable must NOT be invoked.
+ */
+ @Test
+ void loadCredentialsUsesOptimizedPathForIcebergCatalog() {
+ String tableLocation = "s3://fake-bucket/tables/table2";
+ Map<String, String> fakeCredentials =
+ Map.of("fake.access.key", "AKIAFAKE", "fake.secret.key", "fakeSecret");
+
+ // The entity returned via the resolution manifest carries the table location in its internal
+ // properties; that's what lets the optimized path skip a full loadTable.
+ PolarisEntity leafEntity =
+ new PolarisEntity(
+ new PolarisBaseEntity.Builder()
+ .typeCode(PolarisEntityType.TABLE_LIKE.getCode())
+ .subTypeCode(PolarisEntitySubType.ICEBERG_TABLE.getCode())
+ .name(TABLE2.name())
+ .internalPropertiesAsMap(Map.of(IcebergTableLikeEntity.LOCATION, tableLocation))
+ .build());
+ when(resolvedPath.getRawLeafEntity()).thenReturn(leafEntity);
+
+ IcebergCatalog icebergCatalog = mock(IcebergCatalog.class);
+ when(localCatalogFactory.createCatalog(any())).thenReturn(icebergCatalog);
+
+ StorageAccessConfig storageAccessConfig =
+ StorageAccessConfig.builder()
+ .putCredential("fake.access.key", "AKIAFAKE")
+ .putCredential("fake.secret.key", "fakeSecret")
+ .build();
+ when(storageAccessConfigProvider.getStorageAccessConfig(any(), any(), any(), any(), any()))
+ .thenReturn(storageAccessConfig);
+
+ IcebergCatalogHandler handler = newHandler();
+
+ ImmutableLoadCredentialsResponse response = handler.loadCredentials(TABLE2, Optional.empty());
+
+ // The whole point of the optimized path is to skip loadTable on the underlying catalog.
+ verify(icebergCatalog, never()).loadTable(any());
+ assertThat(response.credentials())
+ .singleElement()
+ .satisfies(
+ (Credential c) -> {
+ assertThat(c.prefix()).isEqualTo(tableLocation);
+ assertThat(c.config()).containsExactlyInAnyOrderEntriesOf(fakeCredentials);
+ });
+ }
+}
Review Comment:
test case added
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Move tests for direct credential vending call paths to IcebergCatalogHandlerTest [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on code in PR #4540:
URL: https://github.com/apache/polaris/pull/4540#discussion_r3312506707
##########
runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerTest.java:
##########
@@ -0,0 +1,232 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.polaris.service.catalog.iceberg;
+
+import static org.apache.polaris.service.catalog.AccessDelegationMode.VENDED_CREDENTIALS;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import jakarta.enterprise.inject.Instance;
+import java.time.Clock;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import org.apache.iceberg.BaseTable;
+import org.apache.iceberg.TableMetadata;
+import org.apache.iceberg.TableOperations;
+import org.apache.iceberg.catalog.Catalog;
+import org.apache.iceberg.catalog.Namespace;
+import org.apache.iceberg.catalog.TableIdentifier;
+import org.apache.iceberg.rest.credentials.Credential;
+import org.apache.iceberg.rest.responses.ImmutableLoadCredentialsResponse;
+import org.apache.polaris.core.PolarisDiagnostics;
+import org.apache.polaris.core.auth.PolarisAuthorizer;
+import org.apache.polaris.core.auth.PolarisPrincipal;
+import org.apache.polaris.core.catalog.LocalCatalogFactory;
+import org.apache.polaris.core.config.RealmConfig;
+import org.apache.polaris.core.context.CallContext;
+import org.apache.polaris.core.context.RealmContext;
+import org.apache.polaris.core.credentials.PolarisCredentialManager;
+import org.apache.polaris.core.entity.CatalogEntity;
+import org.apache.polaris.core.entity.PolarisBaseEntity;
+import org.apache.polaris.core.entity.PolarisEntity;
+import org.apache.polaris.core.entity.PolarisEntitySubType;
+import org.apache.polaris.core.entity.PolarisEntityType;
+import org.apache.polaris.core.entity.table.IcebergTableLikeEntity;
+import org.apache.polaris.core.persistence.PolarisMetaStoreManager;
+import org.apache.polaris.core.persistence.PolarisResolvedPathWrapper;
+import org.apache.polaris.core.persistence.resolver.PolarisResolutionManifest;
+import org.apache.polaris.core.persistence.resolver.ResolutionManifestFactory;
+import org.apache.polaris.core.persistence.resolver.ResolverFactory;
+import org.apache.polaris.core.storage.StorageAccessConfig;
+import org.apache.polaris.service.catalog.AccessDelegationModeResolver;
+import org.apache.polaris.service.catalog.CatalogPrefixParser;
+import org.apache.polaris.service.catalog.io.StorageAccessConfigProvider;
+import org.apache.polaris.service.config.ReservedProperties;
+import org.apache.polaris.service.events.EventAttributeMap;
+import org.apache.polaris.service.reporting.PolarisMetricsReporter;
+import org.junit.jupiter.api.Test;
+
+class IcebergCatalogHandlerTest {
+
+ private static final String CATALOG_NAME = "test";
+ private static final Namespace NS1 = Namespace.of("ns1");
+ private static final TableIdentifier TABLE2 = TableIdentifier.of(NS1, "table2");
+
+ private final PolarisResolutionManifest resolutionManifest =
+ mock(PolarisResolutionManifest.class);
+ private final PolarisResolvedPathWrapper resolvedPath = mock(PolarisResolvedPathWrapper.class);
+ private final CatalogEntity catalogEntity = mock(CatalogEntity.class);
+ private final CallContext callContext = mock(CallContext.class);
+ private final RealmConfig realmConfig = mock(RealmConfig.class);
+ private final LocalCatalogFactory localCatalogFactory = mock(LocalCatalogFactory.class);
+ private final AccessDelegationModeResolver accessDelegationModeResolver =
+ mock(AccessDelegationModeResolver.class);
+ private final StorageAccessConfigProvider storageAccessConfigProvider =
+ mock(StorageAccessConfigProvider.class);
+
+ @SuppressWarnings({"unchecked", "rawtypes"})
+ private IcebergCatalogHandler newHandler() {
+ when(callContext.getRealmConfig()).thenReturn(realmConfig);
+ when(callContext.getRealmContext()).thenReturn(mock(RealmContext.class));
+
+ // Resolution manifest factory always returns our pre-configured manifest mock so we can
+ // observe and stub interactions with it.
+ ResolutionManifestFactory resolutionManifestFactory = mock(ResolutionManifestFactory.class);
+ when(resolutionManifestFactory.createResolutionManifest(any(), any()))
+ .thenReturn(resolutionManifest);
+
+ // Authorization path: any resolved path lookup returns a non-null wrapper so the
+ // "not found" check in CatalogHandler#authorizeBasicTableLikeOperationsOrThrow passes.
+ when(resolutionManifest.getResolvedPath(any(), any(), anyBoolean())).thenReturn(resolvedPath);
+ when(resolutionManifest.getResolvedPath(any(), any())).thenReturn(resolvedPath);
+ when(resolutionManifest.getResolvedPath(any())).thenReturn(resolvedPath);
+ when(resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles()).thenReturn(Set.of());
+
+ // initializeCatalog() reads the resolved catalog entity to decide federated vs. local.
+ // Return a CatalogEntity without a connection config so we take the local-catalog path.
+ when(resolutionManifest.getResolvedCatalogEntity()).thenReturn(catalogEntity);
+ when(catalogEntity.getConnectionConfigInfoDpo()).thenReturn(null);
+
+ return ImmutableIcebergCatalogHandler.builder()
+ .catalogName(CATALOG_NAME)
+ .polarisPrincipal(PolarisPrincipal.of("test", Map.of(), Set.of()))
+ .callContext(callContext)
+ .metaStoreManager(mock(PolarisMetaStoreManager.class))
+ .resolutionManifestFactory(resolutionManifestFactory)
+ .authorizer(mock(PolarisAuthorizer.class))
+ .diagnostics(mock(PolarisDiagnostics.class))
+ .credentialManager(mock(PolarisCredentialManager.class))
+ .federatedCatalogFactories(mock(Instance.class))
+ .prefixParser(mock(CatalogPrefixParser.class))
+ .resolverFactory(mock(ResolverFactory.class))
+ .localCatalogFactory(localCatalogFactory)
+ .reservedProperties(mock(ReservedProperties.class))
+ .catalogHandlerUtils(mock(CatalogHandlerUtils.class))
+ .storageAccessConfigProvider(storageAccessConfigProvider)
+ .eventAttributeMap(mock(EventAttributeMap.class))
+ .metricsReporter(mock(PolarisMetricsReporter.class))
+ .clock(mock(Clock.class))
+ .accessDelegationModeResolver(accessDelegationModeResolver)
+ .build();
+ }
+
+ /**
+ * For external (non-Polaris) catalogs, loadCredentials must skip the optimized
+ * entity-properties-based path and fall through to a full loadTable on the underlying catalog,
+ * propagating the credentials the storage provider returns for that table.
+ */
+ @Test
+ void loadCredentialsFallsBackForExternalCatalog() {
+ String tableLocation = "s3://fake-bucket/tables/table2";
+ Map<String, String> fakeCredentials =
+ Map.of("fake.access.key", "AKIAFAKE", "fake.secret.key", "fakeSecret");
+
+ TableMetadata metadata = mock(TableMetadata.class);
+ when(metadata.location()).thenReturn(tableLocation);
+ when(metadata.properties()).thenReturn(Map.of());
+ TableOperations ops = mock(TableOperations.class);
+ when(ops.current()).thenReturn(metadata);
+ BaseTable table = mock(BaseTable.class);
+ when(table.operations()).thenReturn(ops);
+
+ Catalog externalCatalog = mock(Catalog.class);
+ when(externalCatalog.loadTable(TABLE2)).thenReturn(table);
+ when(localCatalogFactory.createCatalog(any())).thenReturn(externalCatalog);
+
+ // VENDED_CREDENTIALS is what triggers the handler to attach credentials to the response.
+ when(accessDelegationModeResolver.resolve(any(), any()))
+ .thenReturn(Optional.of(VENDED_CREDENTIALS));
+
+ StorageAccessConfig storageAccessConfig =
+ StorageAccessConfig.builder()
+ .putCredential("fake.access.key", "AKIAFAKE")
+ .putCredential("fake.secret.key", "fakeSecret")
+ .build();
+ when(storageAccessConfigProvider.getStorageAccessConfig(any(), any(), any(), any(), any()))
+ .thenReturn(storageAccessConfig);
+
+ IcebergCatalogHandler handler = newHandler();
+
+ ImmutableLoadCredentialsResponse response = handler.loadCredentials(TABLE2, Optional.empty());
+
+ verify(externalCatalog).loadTable(TABLE2);
+ assertThat(response.credentials())
+ .singleElement()
+ .satisfies(
+ (Credential c) -> {
+ assertThat(c.prefix()).isEqualTo(tableLocation);
+ assertThat(c.config()).containsExactlyInAnyOrderEntriesOf(fakeCredentials);
+ });
+ }
+
+ /**
+ * For native Polaris (Iceberg) catalogs, loadCredentials takes the optimized path: it reads the
+ * table location from the entity's internal properties and vends credentials without loading the
+ * full table metadata. The underlying catalog's loadTable must NOT be invoked.
+ */
+ @Test
+ void loadCredentialsUsesOptimizedPathForIcebergCatalog() {
+ String tableLocation = "s3://fake-bucket/tables/table2";
+ Map<String, String> fakeCredentials =
+ Map.of("fake.access.key", "AKIAFAKE", "fake.secret.key", "fakeSecret");
+
+ // The entity returned via the resolution manifest carries the table location in its internal
+ // properties; that's what lets the optimized path skip a full loadTable.
+ PolarisEntity leafEntity =
+ new PolarisEntity(
+ new PolarisBaseEntity.Builder()
+ .typeCode(PolarisEntityType.TABLE_LIKE.getCode())
+ .subTypeCode(PolarisEntitySubType.ICEBERG_TABLE.getCode())
+ .name(TABLE2.name())
+ .internalPropertiesAsMap(Map.of(IcebergTableLikeEntity.LOCATION, tableLocation))
+ .build());
+ when(resolvedPath.getRawLeafEntity()).thenReturn(leafEntity);
+
+ IcebergCatalog icebergCatalog = mock(IcebergCatalog.class);
+ when(localCatalogFactory.createCatalog(any())).thenReturn(icebergCatalog);
+
+ StorageAccessConfig storageAccessConfig =
+ StorageAccessConfig.builder()
+ .putCredential("fake.access.key", "AKIAFAKE")
+ .putCredential("fake.secret.key", "fakeSecret")
+ .build();
+ when(storageAccessConfigProvider.getStorageAccessConfig(any(), any(), any(), any(), any()))
+ .thenReturn(storageAccessConfig);
+
+ IcebergCatalogHandler handler = newHandler();
+
+ ImmutableLoadCredentialsResponse response = handler.loadCredentials(TABLE2, Optional.empty());
+
+ // The whole point of the optimized path is to skip loadTable on the underlying catalog.
+ verify(icebergCatalog, never()).loadTable(any());
+ assertThat(response.credentials())
+ .singleElement()
+ .satisfies(
+ (Credential c) -> {
+ assertThat(c.prefix()).isEqualTo(tableLocation);
+ assertThat(c.config()).containsExactlyInAnyOrderEntriesOf(fakeCredentials);
+ });
+ }
+}
Review Comment:
Minor: Worth a third case for the `baseLocation == null` branch (handler line ~784, entity present but no LOCATION in internal properties โ also falls back to full loadTable). Cheap to add given the harness you've built here, and it locks in the backfill-fallback behavior the comment in the handler explicitly calls out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Move tests for direct credential vending call paths to IcebergCatalogHandlerTest [polaris]
Posted by "adutra (via GitHub)" <gi...@apache.org>.
adutra commented on code in PR #4540:
URL: https://github.com/apache/polaris/pull/4540#discussion_r3310362771
##########
runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerTest.java:
##########
@@ -0,0 +1,232 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.polaris.service.catalog.iceberg;
+
+import static org.apache.polaris.service.catalog.AccessDelegationMode.VENDED_CREDENTIALS;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import jakarta.enterprise.inject.Instance;
+import java.time.Clock;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import org.apache.iceberg.BaseTable;
+import org.apache.iceberg.TableMetadata;
+import org.apache.iceberg.TableOperations;
+import org.apache.iceberg.catalog.Catalog;
+import org.apache.iceberg.catalog.Namespace;
+import org.apache.iceberg.catalog.TableIdentifier;
+import org.apache.iceberg.rest.credentials.Credential;
+import org.apache.iceberg.rest.responses.ImmutableLoadCredentialsResponse;
+import org.apache.polaris.core.PolarisDiagnostics;
+import org.apache.polaris.core.auth.PolarisAuthorizer;
+import org.apache.polaris.core.auth.PolarisPrincipal;
+import org.apache.polaris.core.catalog.LocalCatalogFactory;
+import org.apache.polaris.core.config.RealmConfig;
+import org.apache.polaris.core.context.CallContext;
+import org.apache.polaris.core.context.RealmContext;
+import org.apache.polaris.core.credentials.PolarisCredentialManager;
+import org.apache.polaris.core.entity.CatalogEntity;
+import org.apache.polaris.core.entity.PolarisBaseEntity;
+import org.apache.polaris.core.entity.PolarisEntity;
+import org.apache.polaris.core.entity.PolarisEntitySubType;
+import org.apache.polaris.core.entity.PolarisEntityType;
+import org.apache.polaris.core.entity.table.IcebergTableLikeEntity;
+import org.apache.polaris.core.persistence.PolarisMetaStoreManager;
+import org.apache.polaris.core.persistence.PolarisResolvedPathWrapper;
+import org.apache.polaris.core.persistence.resolver.PolarisResolutionManifest;
+import org.apache.polaris.core.persistence.resolver.ResolutionManifestFactory;
+import org.apache.polaris.core.persistence.resolver.ResolverFactory;
+import org.apache.polaris.core.storage.StorageAccessConfig;
+import org.apache.polaris.service.catalog.AccessDelegationModeResolver;
+import org.apache.polaris.service.catalog.CatalogPrefixParser;
+import org.apache.polaris.service.catalog.io.StorageAccessConfigProvider;
+import org.apache.polaris.service.config.ReservedProperties;
+import org.apache.polaris.service.events.EventAttributeMap;
+import org.apache.polaris.service.reporting.PolarisMetricsReporter;
+import org.junit.jupiter.api.Test;
+
+class IcebergCatalogHandlerTest {
+
+ private static final String CATALOG_NAME = "test";
+ private static final Namespace NS1 = Namespace.of("ns1");
+ private static final TableIdentifier TABLE2 = TableIdentifier.of(NS1, "table2");
+
+ private final PolarisResolutionManifest resolutionManifest =
+ mock(PolarisResolutionManifest.class);
+ private final PolarisResolvedPathWrapper resolvedPath = mock(PolarisResolvedPathWrapper.class);
+ private final CatalogEntity catalogEntity = mock(CatalogEntity.class);
+ private final CallContext callContext = mock(CallContext.class);
+ private final RealmConfig realmConfig = mock(RealmConfig.class);
+ private final LocalCatalogFactory localCatalogFactory = mock(LocalCatalogFactory.class);
+ private final AccessDelegationModeResolver accessDelegationModeResolver =
+ mock(AccessDelegationModeResolver.class);
+ private final StorageAccessConfigProvider storageAccessConfigProvider =
+ mock(StorageAccessConfigProvider.class);
+
+ @SuppressWarnings({"unchecked", "rawtypes"})
+ private IcebergCatalogHandler newHandler() {
+ when(callContext.getRealmConfig()).thenReturn(realmConfig);
+ when(callContext.getRealmContext()).thenReturn(mock(RealmContext.class));
+
+ // Resolution manifest factory always returns our pre-configured manifest mock so we can
+ // observe and stub interactions with it.
+ ResolutionManifestFactory resolutionManifestFactory = mock(ResolutionManifestFactory.class);
+ when(resolutionManifestFactory.createResolutionManifest(any(), any()))
+ .thenReturn(resolutionManifest);
+
+ // Authorization path: any resolved path lookup returns a non-null wrapper so the
+ // "not found" check in CatalogHandler#authorizeBasicTableLikeOperationsOrThrow passes.
+ when(resolutionManifest.getResolvedPath(any(), any(), anyBoolean())).thenReturn(resolvedPath);
+ when(resolutionManifest.getResolvedPath(any(), any())).thenReturn(resolvedPath);
+ when(resolutionManifest.getResolvedPath(any())).thenReturn(resolvedPath);
+ when(resolutionManifest.getAllActivatedCatalogRoleAndPrincipalRoles()).thenReturn(Set.of());
+
+ // initializeCatalog() reads the resolved catalog entity to decide federated vs. local.
+ // Return a CatalogEntity without a connection config so we take the local-catalog path.
+ when(resolutionManifest.getResolvedCatalogEntity()).thenReturn(catalogEntity);
+ when(catalogEntity.getConnectionConfigInfoDpo()).thenReturn(null);
+
+ return ImmutableIcebergCatalogHandler.builder()
Review Comment:
Would it make sense to turn this class into a `@QuarkusTest` and just inject `IcebergCatalogHandler`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org