lasdf1234 opened a new pull request, #14482: URL: https://github.com/apache/gravitino/pull/14482
### What changes were proposed in this pull request? When Iceberg REST `registerTable` is called with `overwrite=true`, authorize it as a table modification (`TABLE::OWNER` or `MODIFY_TABLE`) instead of only schema-level `CREATE_TABLE`, matching Lance overwrite authz. Plain register (`overwrite=false`) is unchanged. ### Why are the changes needed? Fix: #14242 `CREATE_TABLE` alone let a caller replace an existing table's metadata pointer without owning it or holding `MODIFY_TABLE`. ### Does this PR introduce _any_ user-facing change? Yes. `registerTable` with `overwrite=true` now requires ownership of the named table or `MODIFY_TABLE` (plus the usual catalog/schema use privileges). Callers that only hold `CREATE_TABLE` will get 403 on overwrite. ### How was this patch tested? `./gradlew :iceberg:iceberg-rest-server:test -PskipITs --tests org.apache.gravitino.server.web.filter.TestRegisterTableOverwriteAuthzHandler` Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
