geyanggang commented on PR #12482: URL: https://github.com/apache/gravitino/pull/12482#issuecomment-5338249262
> > I also don't think we can simply convert ForbiddenException to CatalogException here. This will break the Calcite speculative probe scenario that the original fix. The fix should be in the server's authorization interceptor(issue：#11130). The root cause: the authorization interceptor returns 403 for non-existent resources, WDYT?@roryqi > > I checked #11130 and #11286. My understanding is that the Flink connector change there was more like a workaround: because the server authorization interceptor returned 403 before the actual `loadTable` method could return 404 for a non-existent resource, the Flink connector treated `ForbiddenException` as `TableNotExistException` to preserve Calcite speculative probe fallback. > > However, this workaround also causes a real existing table without permission to be reported as table-not-found. > > So I think a more complete fix should be: > > 1. Fix the server authorization interceptor first, so non-existent resources return 404, while existing resources without permission still return 403. > 2. After the server-side behavior is fixed, remove the Flink connector workaround that maps `ForbiddenException` to `TableNotExistException`. > > This should preserve the Calcite fallback behavior from #11130, while allowing real authorization failures to surface as 403. Does this understanding sound right? Yes, exactly right. That's the plan. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
