Revanth14 opened a new pull request, #2502: URL: https://github.com/apache/iceberg-go/pull/2502
## Problem Google's BigLake REST catalog is configured in Java and PyIceberg with `rest.auth.type=google`. iceberg-go has no `rest.auth.type`, so after #2433 BigLake still needs a hand-built `AuthManager` in code, and property-driven setups such as `catalog.Load` can't reach it. ## Fix `rest.auth.type` selects the authentication, as in Java's `AuthManagers`. Unset and `oauth2` keep the token / credential flow, `none` disables it, and any other value builds the manager registered under that name with the new `RegisterAuthManager`. An unknown value fails catalog construction; for `google` the error names the import to add, and for `sigv4` it points to `rest.sigv4-enabled`. `WithAuthManager` takes precedence over the property. The property is resolved once, from the client-supplied properties, before `/v1/config`, so a server's defaults and overrides can neither select nor configure the client's authentication. That matches where Java loads its auth manager. The new `catalog/rest/googleauth` package registers `google` from a blank import, as `catalog/rest/sigv4` does for SigV4, so `catalog/rest` itself still links no Google packages. It reads Java's `gcp.auth.credentials-path`, `gcp.auth.credentials-json` and `gcp.auth.scopes`, and falls back to Application Default Credentials. It loads the JSON with `CredentialsFromJSONWithType`, since the JSON comes only from client properties, and its errors never include the JSON. One manager serves both the `/v1/config` request and the catalog session. Token refreshes don't depend on the constructor's context, and each one has a 60-second timeout unless the context carries an HTTP client. `basic`, and `sigv4` as an auth type, are left for follow-ups. ## Testing - `TestLoadCatalogWithGoogleAuthType`: `catalog.Load` with only properties, against a fake Google token endpoint and a REST server that requires the token on `/v1/config` and later requests. - `TestAuthTypeSelectsAuthentication`, `TestAuthTypeIgnoresServerOverrides`, `TestWithAuthManagerTakesPrecedenceOverAuthType`, `TestAuthTypeErrors`: unset / `oauth2` / `none` / registered types, case-insensitivity, server overrides ignored, and the error paths. - `googleauth` unit tests cover the credentials path, scope parsing, both credentials properties set, malformed JSON, and a refresh after the constructor's context is canceled. Each of these fails with its fix reverted. gofmt, `go vet` (also with `-tags integration`), `go mod tidy` and `go test -race ./...` pass locally. Lint and a live BigLake check were not run. ## Context Closes #2428 (step 1 was #2433). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
