[I] [Client] [Server] Add temporary write authorization for bulk-load sessions [fluss]

["platinumhamburg (via GitHub)" <gi...@apache.org>]

platinumhamburg opened a new issue, #4226:
URL: https://github.com/apache/fluss/issues/4226

   ### Search before asking
   
   - [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.
   
   
   ### Description
   
   Bulk-load builders must write snapshot and manifest files to remote storage.
   The existing client credential flow may provide read-only access, which is
   insufficient in a production environment.
   
   Add a least-privilege mechanism that allows an authorized caller to obtain
   temporary write access for one active bulk-load transaction. The authorization
   must integrate with `openBuildSession` without placing credentials in the
   serializable build context.
   
   This task should align with a future complete authorization system, but it does
   not introduce general-purpose ACL or RBAC management.
   
   #### Scope
   
   - Authorize the caller before issuing temporary write access.
   - Scope the authorization to one BulkLoad transaction and its allowed remote
     storage location.
   - Grant only the operations required to write and finalize build artifacts.
   - Acquire the authorization when opening a build session.
   - Make the authorization available to bucket and manifest writers through the
     session.
   - Define expiration behavior for temporary credentials.
   - Define how builds that run longer than one credential lifetime continue or
     fail.
   - Prevent credentials from being serialized into build contexts, engine
     checkpoints, manifests, logs, or error messages.
   - Ensure closed or expired sessions cannot silently continue using invalid
     credentials.
   - Keep caller identity server-derived so the mechanism can evolve into the
     future authorization model.
   
   ### Willingness to contribute
   
   - [x] I'm willing to submit a PR!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Client] [Server] Add temporary write authorization for bulk-load sessions [fluss]

["Anurag15v (via GitHub)" <gi...@apache.org>]

Anurag15v commented on issue #4226:
URL: https://github.com/apache/fluss/issues/4226#issuecomment-5980409729

   Hi @wuchong @loserwang1024 
   Can you assign it to me ?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org