henrib opened a new pull request, #6702: URL: https://github.com/apache/hive/pull/6702
### What changes were proposed in this pull request? Enforces per-operation authorization for Iceberg REST catalog read/list operations at the REST choke point (`HMSCatalogAdapter`), closing gaps left after HIVE-29035 reduced `HMSCachingCatalog` to a pure cache: - **`loadTable` / `loadView`** — a `QUERY` privilege check via `IcebergAuthorizer`, so cache-served reads authorize identically to HMS-served ones (a cache hit never reaches HMS, so it would otherwise bypass `ReadTableEvent`). - **`listTables` / `listViews` / `listNamespaces`** — result filtering via `HiveAuthorizer.filterListCmdObjects` (mirroring `SHOW TABLES`/`SHOW DATABASES`): a user sees only entries they may read; a fully-denied user gets an empty list rather than an error. HMS fires no pre-event authorization for `get_tables`/`get_databases`, so this closes a standing gap independent of caching. Writes (create/drop/rename/register) remain authorized by HMS's `HiveMetaStoreAuthorizer` pre-event listener, and stage-create authorization is unchanged. ### Why are the changes needed? After HIVE-29035, cache hits and list operations were not authorized. This makes read/list authorization explicit and uniform at the REST layer, independent of whether an operation happens to reach HMS. ### Does this PR introduce _any_ user-facing change? No behavioral change for authorized users. Unauthorized reads now consistently return `403 Forbidden`, and list results are filtered to the caller's visible subset. ### How was this patch tested? `TestIcebergAuthorizer` (unit, incl. filter cases), `TestRESTCatalogSimpleAuth`, and `TestRESTViewCatalogSimpleAuth` (end-to-end permission enforcement through the REST path) all pass. --- > **Note:** stacked on top of #6441 (HIVE-29035). Until that merges, the diff includes the HIVE-29035 commits — review only the top commit `HIVE-29817: enforce read/list authorization at the Iceberg REST choke point`. The diff will collapse to the single commit once #6441 lands. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
