dylwylie opened a new issue, #20090: URL: https://github.com/apache/pinot/issues/20090
## Description With row/column-level auth enabled (`pinot.broker.enable.row.column.level.auth=true`), a multi-stage query reports `rlsFiltersApplied: true` whenever the `AccessControl` returns a row filter list for a queried table, even if the list is empty. An empty list attaches no filter, so all rows come back while the response says row-level security was applied. The `RLS_FILTERS_APPLIED` broker meter is incremented the same way. Single-stage queries aren't affected: `BaseSingleStageBrokerRequestHandler` only sets the flag when the list is non-empty and the rewrite succeeds. ## Steps to reproduce 1. Use an `AccessControl` whose `getRowColFilters` returns `new TableRowColAccessResultImpl(List.of())` for a table. 2. Run a multi-stage query against that table. 3. The response has `rlsFiltersApplied: true`, and no filter was applied. ## Expected `rlsFiltersApplied` is `true` only when a row filter was attached to the query, as in the single-stage engine. Fix: #20089 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
