GayathriSrividya opened a new pull request, #3423:
URL: https://github.com/apache/iceberg-python/pull/3423
## Summary
Fixes #3422.
`RestCatalog._create_session()` expected `auth` to be a `dict`, but values
loaded from environment variables always arrive as strings. This caused auth
initialization to fail silently or with a confusing `AttributeError` for all
pluggable auth types (`basic`, `oauth2`, `google`, `entra`, `custom`) when
configured via `PYICEBERG_CATALOG__<NAME>__AUTH`.
## Fixes
### 1. JSON string decode (primary fix)
If the `auth` property value is a `str`, JSON-parse it before processing.
This unblocks:
```bash
export
PYICEBERG_CATALOG__REST__AUTH='{"type":"oauth2","oauth2":{"client_id":"id","client_secret":"secret","token_url":"https://auth.example/token"}}'
```
### 2. Flat env-var property support (alternative fix)
Supports the canonical PyIceberg env-var style — no JSON blob required, no
quoting/escaping issues:
```bash
export PYICEBERG_CATALOG__REST__AUTH__TYPE=oauth2
export PYICEBERG_CATALOG__REST__AUTH__OAUTH2__CLIENT_ID=id
export PYICEBERG_CATALOG__REST__AUTH__OAUTH2__CLIENT_SECRET=secret
export
PYICEBERG_CATALOG__REST__AUTH__OAUTH2__TOKEN_URL=https://auth.example/token
```
The env-var parser maps these to flat properties (`auth.type`,
`auth.oauth2.client-id`, etc.). `_create_session` now checks for `auth.type`
when the `auth` dict is absent, builds the config dict from the flat `auth.*`
properties, and converts kebab-case keys to snake_case to match `AuthManager`
constructor parameters.
## Tests
Five new regression tests added to `tests/catalog/test_rest.py`:
| Test | What it covers |
|---|---|
| `test_rest_catalog_with_basic_auth_as_json_string` | JSON string → Basic
auth |
| `test_rest_catalog_with_oauth2_auth_as_json_string` | JSON string → OAuth2
auth |
| `test_rest_catalog_with_invalid_json_auth_string` | Invalid JSON →
descriptive `ValueError` |
| `test_rest_catalog_with_basic_auth_flat_properties` | Flat `auth.*` props
→ Basic auth |
| `test_rest_catalog_with_oauth2_auth_flat_properties` | Flat `auth.*` props
→ OAuth2 auth (kebab→snake conversion) |
All 13 `test_rest_catalog_with_*` tests pass; the 4 pre-existing failures
(`test_token_200`, `test_config_200`, `test_auth_header`, etc.) are unrelated
to this change and also fail on `main`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
