markhoerth opened a new pull request, #14449: URL: https://github.com/apache/gravitino/pull/14449
Backport to branch-1.3 of the fix for #14447 (same change as the PR to main; it applies cleanly). ### What changes were proposed in this pull request? - Intercept `IcebergConfigOperations` and authorize `getConfig` with `LOAD_CATALOG_AUTHORIZATION_EXPRESSION` (the same expression as `listNamespaces`), against the catalog named by the `warehouse` parameter. The interceptor accepts a plain catalog name as well as a path prefix. An empty warehouse now resolves through `IcebergRESTUtils.getCatalogName`, so it uses the same default catalog as an empty prefix, which is the catalog it is authorized against. - `IcebergMetadataAuthorizationMethodInterceptor.shouldSkipAuthorization`: treat an `IllegalArgumentException` from the catalog lookup (a catalog that is not an Iceberg catalog) like a missing catalog. The request is then authorized normally: a caller without access gets 403 as for any other name, and an authorized caller gets the operation's 400. ### Why are the changes needed? Users without access to a catalog could read its configuration and probe catalog names, and a client mistake was reported as an internal server error. Fixes #14447 ### Does this PR introduce _any_ user-facing change? Yes. With authorization enabled, `/v1/config` requires `USE_CATALOG` or ownership on the catalog, so an engine's catalog initialization fails with 403 for users who could not use the catalog anyway. A prefix naming a non-Iceberg catalog returns 403 or 400 instead of 500. ### How was this patch tested? `TestIcebergMetadataAuthorizationMethodInterceptor`: - `testConfigEndpointIsAuthorizedOnTheWarehouseCatalog`: the config resource is intercepted, carries the expression, and resolves a named and an empty warehouse to the right catalog. - `testNonIcebergCatalogDoesNotSkipAuthorization`. - `testInvokeShouldSkipAuthorizationWrapperLookupFailureReturnsAuthInternalError` now uses an `IllegalStateException`, so it still checks that an unexpected lookup failure is a 500. `./gradlew :iceberg:iceberg-rest-server:test -PskipITs` 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Eu6fb9pLfmrSJzGQDVLi1g -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
