yuqi1129 opened a new issue, #12988: URL: https://github.com/apache/gravitino/issues/12988
### Version main branch ### Describe what's wrong Lance REST CreateTable reads only the schema from an Arrow IPC stream and silently ignores supplied rows. A request containing data can therefore create an empty table, or replace an existing table in overwrite mode, instead of rejecting unsupported input before mutation. In standalone mode, backend Gravitino authentication and authorization failures are mapped to HTTP 500 instead of 401/403. Unexpected server errors and auxiliary authorization failures can also expose internal stack traces in responses. ### Error message and/or stacktrace CreateTable can succeed while discarding input rows. Backend access denials return HTTP 500; unexpected failures include internal exception details. ### How to reproduce 1. Send CreateTable an Arrow IPC stream containing a nonempty record batch, including in overwrite mode. Observe that rows are ignored instead of the request being rejected. 2. Configure standalone Lance REST with a backend service user lacking namespace access, then describe that namespace. Observe HTTP 500 instead of 403. 3. Trigger an unexpected server exception and inspect the error response for internal details. Expected: reject nonempty CreateTable input with HTTP 406 before changing metadata or storage; preserve backend 401/403; omit stack traces from authentication/authorization failures and return a generic message for unexpected 500 errors. ### Additional context Extracted from #12954 so that the fixes can be reviewed independently of the authentication documentation tracked by #12574. This does not change standalone identity propagation or authentication configuration. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
