amdubovoi opened a new pull request, #18716: URL: https://github.com/apache/iceberg/pull/18716
When a catalog vends more than one GCS credential, `OAuth2RefreshCredentialsHandler` rejects the refresh response with "only one GCS credential should exist", and long-running jobs fail when the first token expires. The REST spec allows more than one credential of the same type and says clients should choose the longest matching prefix. `GCSFileIO` already builds one storage client per credential prefix, but the refresh handler does not know which prefix its client serves. This passes the storage prefix to the handler, which picks the longest credential prefix that the storage prefix starts with. With a single credential, the handler behaves as before. The change adds two public overloads because `PrefixedStorage` and `GCPAuthUtils` are in different packages. Follows up on #12591. Test plan: - More than one GCS credential: the handler picks the longest prefix that covers the storage prefix and skips a longer one that does not cover it. - More than one GCS credential and none covers the storage prefix: the refresh fails. - One GCS credential: the handler uses it even when its prefix does not cover the storage prefix, so catalogs that send one credential behave as before. - `GCSFileIO` with two storage credentials refreshes each prefix client with its own credential. This test fails without the change. - Also checked against a real GCS bucket, before and after the change. Polaris, Lakekeeper, Gravitino and Unity Catalog send one credential and behaved the same. Nessie with projectnessie/nessie#13128 sends two, and its refresh went from failing to working. The refreshed tokens kept their table scope. --- **AI Disclosure** - Model: Claude Opus 5.5 - Platform/Tool: Claude Code - Human Oversight: fully reviewed - Prompt Summary: Let GCS storage clients refresh vended credentials when a catalog returns more than one GCS credential. Claude generated the code, the tests and this description; the author and Claude worked out the approach and the reading of the spec together. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
