markhoerth opened a new pull request, #14477: URL: https://github.com/apache/gravitino/pull/14477
### What changes were proposed in this pull request? - `LoadTableAuthzHandler`: a view name on `/tables/` gets 404 only for a caller who may load the view or check that it exists (`ICEBERG_LOAD_VIEW_AUTHORIZATION_EXPRESSION` or `ICEBERG_LOAD_VIEW_EXISTENCE_CHECK_AUTHORIZATION_EXPRESSION` on the view). That 404 is what lets clients fall back to `/views/`. Anyone else goes through the normal table authorization with the name treated as missing, so they get the same answer as for a table name that does not exist. `IcebergLoadAuthzHandlerHelper` gets an `isAllowed` helper, which `authorizeLoadEntity` now also uses. - `IcebergNamespaceOperationExecutor.updateNamespace` rejects null property values and null removal keys with 400 before the catalog is called. ### Why are the changes needed? A member with no privileges could enumerate view names. A null namespace property value made the namespace unusable through every API. Fixes #14476 ### Does this PR introduce _any_ user-facing change? Yes. A caller who cannot see a view gets 403 instead of 404 for its name on `/tables/`. A namespace property update with a null value gets 400. A namespace that already holds a NULL value is not repaired by this change. ### How was this patch tested? - `TestLoadTableAuthzHandler`: a view name is 403 for a caller who cannot see the view, and 404 for one who can. - `TestIcebergNamespaceOperations#testUpdateNamespaceRejectsNullPropertyValue`: the raw JSON request gets 400, and the namespace still loads and updates afterwards. `./gradlew :iceberg:iceberg-rest-server:test -PskipITs` 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Eu6fb9pLfmrSJzGQDVLi1g -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
