roryqi opened a new pull request, #13981: URL: https://github.com/apache/gravitino/pull/13981
### What changes were proposed in this pull request? - Require table read authorization before accepting Iceberg REST metrics reports. - Verify that the table exists and that the report names the addressed table, including supported qualified names. - Deny intercepted methods that lack an authorization expression, and keep local authorization for metrics stored by a REST-backed catalog. ### Why are the changes needed? An authenticated caller without table access could submit fabricated metrics because the report endpoint had no authorization annotation. Fix: #13980 ### Does this PR introduce _any_ user-facing change? Unauthorized reports return 403. Reports for nonexistent tables return 404. Reports naming another table return 400. ### How was this patch tested? - Ran Spotless for `server-common` and `iceberg-rest-server`. - Ran `TestBaseMetadataAuthorizationMethodInterceptor`, `TestIcebergMetadataAuthorizationMethodInterceptor`, and `TestIcebergTableOperations.testReportTableMetrics` with Gradle; all passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
