You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@paimon.apache.org by "JingsongLi (via GitHub)" <gi...@apache.org> on 2026/08/26 10:51:21 UTC
[PR] [core][test] Add REST management query authorization support [paimon]
JingsongLi opened a new pull request, #9416:
URL: https://github.com/apache/paimon/pull/9416
## Purpose
Extract the non-Spark prerequisite from #9410 so the REST management runtime and test service can be reviewed independently.
## Changes
- fail closed when managed row filters or column masks are invalid
- preserve nested projections while loading only selected mask dependencies
- add a REST management test service for permissions and policies
- keep assignments and policies consistent across resource and schema lifecycle changes
- use stable opaque pagination and serialize permission mutations with lifecycle operations
- document the fail-closed column allowlist evolution rule
## Verification
- Core targeted tests: 13 passed
- REST OpenAPI validator: 56 catalog operations and 6 management operations
- Split mirror Spark procedure tests: 11 passed
- Every file changed by the original branch matches the recomposed split mirror
- `git diff --check`
This is a prerequisite for #9410 and contains no Spark connector changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [core][test] Add REST management query authorization support [paimon]
Posted by "JingsongLi (via GitHub)" <gi...@apache.org>.
JingsongLi merged PR #9416:
URL: https://github.com/apache/paimon/pull/9416
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [core][test] Add REST management query authorization support [paimon]
Posted by "leaves12138 (via GitHub)" <gi...@apache.org>.
leaves12138 commented on code in PR #9416:
URL: https://github.com/apache/paimon/pull/9416#discussion_r3862747653
##########
paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java:
##########
@@ -1113,7 +1245,7 @@ private MockResponse rollbackTableByTagNameHandle(Identifier identifier, String
}
private MockResponse rollbackSchemaHandle(Identifier identifier, String data) throws Exception {
- RollbackSchemaRequest requestBody = RESTApi.fromJson(data, RollbackSchemaRequest.class);
+ RollbackSchemaRequest requestBody = parseRequest(data, RollbackSchemaRequest.class);
Review Comment:
Schema rollback bypasses the lifecycle validation added for policies and column permissions. This handler calls `SchemaManager.rollbackTo` directly, without validating the target schema, evolving assignments, refreshing `tableMetadataStore`, or serializing with the table/policy lifecycle locks. For example: create a query-auth table, add `secret`, create a column-mask policy on `secret`, then roll back to the schema before `secret` existed. The rollback currently succeeds, leaving the stored policy (and REST metadata) inconsistent with the actual schema. I reproduced this with a focused `MockRESTCatalogTest`; the expected rejection was not raised. Please apply the same target-schema validation/state update as alter/replace (or reject an incompatible rollback) and add a regression test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org