geyanggang commented on PR #12482:
URL: https://github.com/apache/gravitino/pull/12482#issuecomment-5339349034
> I updated the PR to use the connector-side approach.
This approach won't solve the real problem. Since TableForbiddenException
still extends TableNotExistException, Flink's
CatalogManager.getPermanentTable() will catch it the same way and wrap it into
a new ValidationException("Cannot find table ... in any of the catalogs"). The
user will still see "table not found" — not the improved "not authorized"
message.
The improved message only lives in the inner exception chain (visible in
stack traces), but the final user-facing error stays the same.
To actually fix this on the connector side, we need to throw something that
Flink won't swallow — e.g., CatalogException for real auth failures. The
challenge is distinguishing speculative probes from real failures. One
approach: after catching ForbiddenException, check
databaseExists(tablePath.getObjectName()) — if the "table name" is actually an
existing schema, it's a speculative probe (throw TableNotExistException);
otherwise it's a real auth failure (throw CatalogException).
WDYT？@roryqi
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
