yuqi1129 opened a new issue, #12955: URL: https://github.com/apache/gravitino/issues/12955
### What would you like to be improved? A caller with CREATE_TABLE but no read permission can use CreateTable(mode=exist_ok) to obtain an existing table's location and properties even though DescribeTable returns 403. Review the analogous namespace paths as well. Parent: #9087. Follow-up from the review of #12954. ### How should we improve? Authorize access to the existing object before returning its metadata, reusing Gravitino authorization rules. Keep authorization tied to the resolved object across concurrent creation or replacement; preserve normal creation of absent objects. Add unit and HTTP integration tests covering create-only callers, authorized readers, namespace paths, and concurrent replacement without hidden-metadata disclosure. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
