flyrain commented on code in PR #16131:
URL: https://github.com/apache/iceberg/pull/16131#discussion_r3770965088
##########
data/src/main/java/org/apache/iceberg/data/IcebergGenerics.java:
##########
@@ -103,7 +108,16 @@ public ScanBuilder metricsReporter(MetricsReporter
reporter) {
}
public CloseableIterable<Record> build() {
- return new TableScanIterable(tableScan, reuseContainers);
+ Optional<ReadRestrictions> restrictions =
TableUtil.readRestrictions(table);
Review Comment:
[P1] Enforcement currently exists only in `IcebergGenerics`. Spark, Flink,
and callers that use `table.newScan()` directly never consult
`TableUtil.readRestrictions`, while `BaseRESTTable` still exposes a normal
unrestricted scan. A REST response with restrictions can therefore return raw
rows through those readers. The spec says restrictions apply to every read
performed using the response, so please either integrate enforcement at each
supported engine/scan boundary or make unsupported scan paths fail closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
