lishuxu opened a new pull request, #1041: URL: https://github.com/apache/iceberg-cpp/pull/1041
…r-uri Introduce rest.client-only-properties, an opt-in mechanism that lets clients prevent server-provided defaults/overrides from affecting specified configuration keys. Keys listed in this property are resolved from client configuration only. When oauth2-server-uri appears in the list: - Server-provided values for it are ignored during config merge - The endpoint is resolved to an absolute URL using the client's uri before merging, preventing indirect override via uri changes - InitSession and CatalogSession now use consistent endpoints This addresses the risk of OAuth2 credentials being sent to an unintended endpoint when a REST catalog server overrides oauth2-server-uri or uri. The protection is opt-in to maintain backward compatibility and align with REST spec defaults. Changes: - Add RestCatalogProperties::kClientOnlyProperties - Export auth::ResolveOAuth2ServerUri for reuse - Add MergeServerConfig() and ParseClientOnlyProperties() in rest_util - Replace MergeConfigs with MergeServerConfig in RestCatalog::Make - Warn when oauth2-server-uri is neither explicit nor protected while using credential auth (following Java's warnIfOAuthServerUriNotSet) - Add unit tests covering direct/indirect override scenarios Default behavior unchanged: without setting rest.client-only-properties, server overrides apply as before, consistent with Java and Rust clients. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
