jarredhj0214 opened a new issue, #12480:
URL: https://github.com/apache/gravitino/issues/12480
### Version
main branch
### Describe what's wrong
The Gravitino Flink connector converts `ForbiddenException` thrown while
loading a table into Flink's `TableNotExistException`.
As a result, when Gravitino server correctly returns `403 Forbidden` for a
table authorization failure, Flink reports a misleading validation error:
`Cannot find table ... in any of the catalogs`
This makes an authorization failure look like a catalog/table resolution
problem.
The issue affects `BaseCatalog#getTable`, so catalogs that inherit the
default implementation, such as Paimon, may be affected. Hive is also affected
because `GravitinoHiveCatalog` overrides `getTable` and has the same exception
mapping.
### Error message and/or stacktrace
Flink side:
```text
Caused by: org.apache.flink.table.api.ValidationException:
Cannot find table '`hive_catalog`.`qa_dm_test`.`qa_dm_vom_integration_t1`'
in any of the catalogs [..., hive_catalog, ...], nor as a temporary table.
at
org.apache.flink.table.catalog.CatalogManager.getTableOrError(CatalogManager.java:700)
at
org.apache.flink.table.planner.operations.SqlNodeToOperationConversion.convertSqlInsert(...)
### How to reproduce
**How to reproduce**
```markdown
1. Configure Flink 1.20 with Gravitino catalog store.
2. Use a user that has `USE_CATALOG` and `USE_SCHEMA`, but does not have
`SELECT_TABLE` or `MODIFY_TABLE` on a target table.
3. Run an INSERT statement against the table, for example:
```sql
INSERT INTO `hive_catalog`.`qa_dm_test`.`qa_dm_vom_integration_t1`
SELECT ...;
### Additional context
**Additional context**
```markdown
The problematic mappings are:
- `BaseCatalog#getTable`: catches `ForbiddenException` and throws
`TableNotExistException`.
- `GravitinoHiveCatalog#getTable`: catches `ForbiddenException` and throws
`TableNotExistException`.
Expected behavior: authorization failures should be propagated as
permission/forbidden errors, for example by wrapping `ForbiddenException` in
`CatalogException`, instead of being converted to table-not-found errors.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
