Hi all, Thanks Yufei, Dmitri and JB. I've restacked #5246 [1]
Dropped GET_CATALOG_CONFIG_PROPERTIES. That takes out the second authorizer op and the partial-result case Yufei called out, where a client can't tell absent settings from withheld ones. Kept GET_CATALOG_CONFIG behind ENFORCE_CATALOG_CONFIG_AUTHORIZATION (default false), as Dmitri asked. That covers the /config AuthZ gap as of 1.8.0, and existing deployments keep today's behaviour. Once that check passes, the response still returns catalog properties as it does today. CHANGELOG says the default is not flipping until the client-facing config follow-up is settled, as JB asked. Client-facing vs server-only properties can stay in its own thread. PR is updated now. PTAL Thanks, *Vignesh* [1] https://github.com/apache/polaris/pull/5246
