yuqi1129 opened a new pull request, #14529: URL: https://github.com/apache/gravitino/pull/14529
### What changes were proposed in this pull request? Override PostgreSQL Spark 3.5's write-aware loadTable on branch-1.3 and delegate to the existing shared loadTableForWriting authorization path. Add direct write-privilege cases and real Spark SQL INSERT/INSERT OVERWRITE planning regressions. ### Why are the changes needed? Spark's default write-aware overload falls back to the read load. Require MODIFY_TABLE before physical table access for writes through this connector. Fixes #14525 Enterprise tracking: https://github.com/datastrato/gravitino-enterprise/issues/3158. Main already has the common guard from #12414; this PR targets branch-1.3 only. ### Does this PR introduce _any_ user-facing change? Normal PostgreSQL Spark 3.5 writes on branch-1.3 now require MODIFY_TABLE and fail before accessing the physical table when denied. This preserves the existing trusted-connector authorization model; it does not add a new server security boundary. ### How was this patch tested? - Entire Spark 3.5 module test task: 7 cases across 2 classes, no failures. - New cases cover all TableWritePrivilege enum values, denial before delegate access, and actual INSERT/INSERT OVERWRITE SQL planning with controlled metadata and physical-table boundaries. - Reverting the override fails both new SQL authorization regressions; restored code passes. - Exact-head independent cumulative review. Deployed REST + PostgreSQL + released-artifact end-to-end verification remains separate. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
